External programs running only if root users can run in PHP, have always been an old problem, and it is difficult to implement in conventional approach. This is because the PHP is a module as Apache, that is, PHP is part of Apache, and Apache is not executed in different user IDs, but the Suexec mechanism can only CGI is valid.
There is an article on the Internet, saying that "Su--c Command" can be implemented, but after multiple tests, it is not possible, because the su command must enter the root password on stdin.
How to do? It is difficult to work with a conventional method and can only think about other methods. The key to success is that there is a tool that can switch the user ID but can enter a password (or not entering a password) on the command. Is there such a tool? Yes, it is super.
Let's talk about how to do it below?
It should be noted that installing and configuring Super, both root identity.
First step, switch to root
Step 2, install super
First go to ftp://ftp.mdtsoft.com/pub/super download SUPER-3.14.0-1.i386.rpm. This is an RPM file that includes two tools: SetUID and Super, as well as their documents and MAN manuals. Install it into the system with the following command:
% rpm -uvh super-3.14.0-1.i386.rpm
You can also use this command to view files in this rpm:
% rpm -qpl super-3.14.0-1.i386.rpm
As can be seen from the results, both tools will be installed under the / bin directory.
Step 3, configure super
Super profile is /etc/super.tab. This is a text file, the format is more complicated. However, we can add a few lines as long as we are simple. As for a detailed description, you can view by man super.tab.
Assuming that the user runs Apache is Nobody, we want to add the system user (call usradd command) through Super, then we just add the following: SUPER.TAB file:
AUSER / SBIN / USERADD NOBOBODY, HUNTE
The first section is an alias of the command that Super's command can be identified; the second section is the full path to the system command corresponding to the alias; the third paragraph is a list of users who can run the command, separated by commas. Here, in addition to Nobody, it is also a normal user called Hunte, which is used for the following tests. Of course, you should use any ordinary users in your system.
At this point, the SUPER configuration is better.
Fourth step, test
Log in with the non-Nobody user specified in the third step, run:
% / bin / super auser testuser
If the front configuration has no error, the user TestUser should be successfully created. Can use:
% CAT / ETC / Passwd | GREP TESTUSER
Command to verify.
Step 5, call this command in PHP
Below is a PHP code:
IF ($ usrname)
{
/ / Should check if the new user already exists
Echo is creating a user <$ usrname> ...;
System (escapeshellcmd ("/ bin / super auser $ usrname));
}
?>
Using Super, you will not be difficult to run external commands as root in PHP. Try it.
