Re: Re[2]: How to allow httpd to run 'ipfw table 7 add ... '

[Steve O'Hara-Smith]

On Thu, 29 Nov 2012 23:03:08 +0200
Eugen Konkov  wrote:

> Здравствуйте, Steve.

> SOHS> The only problem with this is it will allow apache to
> SOHS> do anything with ipfw including flush all of the rules. I would
> SOHS> suggest having apache dumping the parameters of the command to
> SOHS> be run into a queue of some kind (named pipe perhaps or a file
> SOHS> based queue if it's important to survive shutdowns) and have a
> SOHS> process reading the queue, sanity checking the parameters and
> SOHS> then executing the appropriate command.
> 
> maybe:
> apache host=(root) NOPASSWD: /my/script/add_table.pl
> apache host=(root) NOPASSWD: /my/script/del_table.pl
> 
> this will restrict apache to run only add/del tasks with table.
> what do you think?

That also works. I have a slight preference for queue based approaches 
but that's just me really.

-- 
Steve O'Hara-Smith 
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re[2]: How to allow httpd to run 'ipfw table 7 add ... '

[Eugen Konkov]

Здравствуйте, Steve.

Вы писали 29 ноября 2012 г., 21:38:35:

SOHS> On Wed, 28 Nov 2012 20:09:03 -0800
SOHS> Devin Teske  wrote:

>> 
>> On Nov 28, 2012, at 7:48 PM, Eugen Konkov wrote:
>> 
>> > Hi.
>> > 
>> > How to allow httpd to run this command 'ipfw table 7 add ... '?
>> > 
>> 
>> imho the most secure way is to add an entry to sudoers(5) (you can use visudo

SOHS> This is not very secure for this purpose - see below.

>> (8) to edit sudoers(5)) allowing the apache privilege-separation user (www? 
>> we use apache here -- check your httpd.conf for "User") to execute that 
>> specific command without a password. The entry might look something like 
>> this:
>> 
>> apache ALL=(ALL) NOPASSWD: /sbin/ipfw
>> 
>> That will allow the apache user to do things like:
>> 
>>   sudo ipfw table 7 add …

SOHS> The only problem with this is it will allow apache to
SOHS> do anything with ipfw including flush all of the rules. I would
SOHS> suggest having apache dumping the parameters of the command to
SOHS> be run into a queue of some kind (named pipe perhaps or a file
SOHS> based queue if it's important to survive shutdowns) and have a
SOHS> process reading the queue, sanity checking the parameters and
SOHS> then executing the appropriate command.

maybe:
apache host=(root) NOPASSWD: /my/script/add_table.pl
apache host=(root) NOPASSWD: /my/script/del_table.pl

this will restrict apache to run only add/del tasks with table.
what do you think?

-- 
С уважением,
 Eugen  mailto:kes-...@yandex.ru

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"