'at' command and apache user

Rick Stevens ricks at nerd.com
Sat Jun 18 00:16:31 UTC 2011


On 06/17/2011 11:12 AM, Robert Cates wrote:
> On 06/17/2011 01:56 PM, Tim wrote:
>> Ed Greshko:
>>>> Depending on the type of web pages you serve you may find there to be a
>>>> buffer overflow vulnerability which gives an attacker a shell and allows
>>>> them to execute arbitrary commands as "apache".
>>>>
>>>> I smell "danger Will Robinson"!
>> Gary Stainburn:
>>> You do have a valid point, but this is a non-public low-risk server used for
>>> internal admin stuff.
>> Though that may lead to complacency, and someone may find a way to cause
>> you problems that you hadn't thought of.  You are probably far better
>> finding a way to run your command as some other user, triggered by your
>> risky apache user.
>>
>> Generally, risky users are prevented from being able to run things for
>> good reasons; and you're best not to shred your security blankets for
>> the sake of convenience, now.
>>
> 
> Thank you Ed, thank you Tim!  I completely agree.  Bad/risky practice 
> can easily carry over at some point to the danger zone, and I think it's 
> especially important to stress this view/point on mailing lists not that 
> somebody later will think this is a solution to their problem, 
> jeopardizing a productive system.

May I recommend you create some unprivileged user (I use the name
"avatar"), then set up sudo to permit user "apache" to run the "at"
command as user "avatar" without a password?  Something like:

	avatar	ALL = NOPASSWD:/usr/bin/at

Then your PHP script could:

	exec("sudo -u innocuoususer at blah-blah");

and the at command would run as "avatar".  You could set "apache" back
to /bin/nologin and be quite a bit safer.
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, C2 Hosting          ricks at nerd.com -
- AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
-                                                                    -
-     If you can't beat your computer at chess...try kickboxing!     -
----------------------------------------------------------------------


More information about the users mailing list