Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #6920

Re: Exec Security

Show all headers | View raw

On 01/09/12 03:49, Ryan wrote:
> I am working on a PHP script that will create Nginx vhosts. Creating the files should be simple enough. The hard part is this command "service nginx reload" to load the new vhost config.
>
> The result is I have to use Exec() to run the command.  The bad problem I host sites for clients on the server, they obviously should not have access to Exec().
>
> Is there anything I can do to allow me to use it but prevent my other users?
>

You could make a database table in which you store command to execute 
(use a id, not the command it self, like id 1 = reload nginx rules), 
time stamp when inserted and time stamp when executed.

Your php script will just add a line to the table.

You have another job which reads the table say every minute and takes 
all unexecuted and execute those (write some logic that makes it will 
only restart once if there is more than one request for reload/restart 
in the list at one time), as this one will run as a privileged user, it 
will not have issues with the commands.


This method is scalable to work with multiple servers if you have a 
centralized database server, in that case you need to add column for 
which host is supposed to execute the command. Worked fine when I workd 
at a hosting company.

-- 

  //Aho

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Exec Security Ryan <rbilesky@gmail.com> - 2012-08-31 18:49 -0700
  Re: Exec Security Jerry Stuckle <jstucklex@attglobal.net> - 2012-08-31 22:12 -0400
  Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-01 08:54 +0200
  Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 02:51 -0700
    Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-01 13:19 +0200
      Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 11:50 -0700
        Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 13:19 -0700
          Re: Exec Security Jerry Stuckle <jstucklex@attglobal.net> - 2012-09-01 16:26 -0400
            Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 14:11 -0700
              Re: Exec Security Jerry Stuckle <jstucklex@attglobal.net> - 2012-09-01 19:14 -0400
                Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 17:17 -0700
                Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-02 09:25 +0200
                Re: Exec Security The Natural Philosopher <tnp@invalid.invalid> - 2012-09-02 12:02 +0100
                Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-02 20:32 -0700
                Re: Exec Security Jerry Stuckle <jstucklex@attglobal.net> - 2012-09-02 23:43 -0400
                Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-02 20:53 -0700
                Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-03 06:55 +0200
        Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-01 23:23 +0200

csiph-web