2

I may got stuck in a very simple problem, but I can't figure it out. I would like to run using a cgi script a simple command: sudo service transmission-daemon stop in order to stop a system daemon.

I learned to manage the sudo privileges, using sudo visudo, and declaring the www-data user the access to the folder containing the scripts (in this case, /var/www/cgi-bin). At the moment I'm not concerned about security simply because my Raspberry PI isn't accessible externally.

Anyway, I obviously set the script as executable (sudo chmod +x reboot.cgi), and the ownership of the script (sudo chown www-data:www-data reboot.cgi).

The problem is that simply the script won't succeed, and looking at the error.log of apache it says:

    [Sun Nov 17 17:09:27 2013] [error] [client 192.168.0.3] sudo, referer: http://mezzopi.local/cgi-bin/info.cgi
[Sun Nov 17 17:09:27 2013] [error] [client 192.168.0.3] : , referer: http://mezzopi.local/cgi-bin/info.cgi
[Sun Nov 17 17:09:27 2013] [error] [client 192.168.0.3] no tty present and no askpass program specified, referer: http://mezzopi.local/cgi-bin/info.cgi
[Sun Nov 17 17:09:27 2013] [error] [client 192.168.0.3] , referer: http://mezzopi.local/cgi-bin/info.cgi

It seems that apache is required to have a tty to input the sudo password (isn't it strange in the first place?), although I set using sudo visudo the option Defaults:www-data !requiretty in order to disable such possibility.

Following is my CGI script:

#!/bin/bash

echo "Content-type: text/html"
echo ""

echo "<html> <head>"
echo "<title>Transmission</title> </head> <body>"

echo "<table><tr><td>"
echo "<a href=../index.html>Home</a><br>"

echo "<h3>Transmission</h3>"
echo "<pre> $(sudo service transmission-daemon stop) </pre>"

echo "</body></html>"

It doesn't work either if I change the daemon to stop, i.e. minidlna or pyLoad. What I'm missing?

Thanks everyone for your time.

3
  • Try echo "password"|sudo service transmission-daemon stop
    – Gerben
    Commented Nov 17, 2013 at 19:20
  • Just tried. Didn't work. I am completely lost. Commented Nov 17, 2013 at 20:20
  • Create a sh script with sudo service transmission-daemon stop, set owner to root (chown), allow all to execute (chmod) and set sticky flag. This will allow all users to start the script, which will run as the admin user - en.m.wikipedia.org/wiki/Sticky_bit
    – Jervelund
    Commented Feb 16, 2014 at 10:38

3 Answers 3

2

If you are sure you want to give the www-data group the ability to restart a service, you should specify the commands within the sudoers file.

%www-data ALL=NOPASSWD: /usr/sbin/service SERVICENAME *

or

%www-data ALL=NOPASSWD: /usr/sbin/service SERVICENAME stop, /usr/sbin/service SERVICENAME start, /usr/sbin/service SERVICENAME restart

Note: The www-data group is typically reserved for publicly accessible web services and extra care should be taken when giving this group (or any other group) sudo privileges.

0

the correct way to supply the password to "sudo" command would be:

echo <password> | sudo -S service transmission-daemon stop

(note the "-S" command line option, that is capital S, not the lowercase one)

-1

I had this exact same problem!

I know and as others have mentioned, this is very bad, but as it's a Pi and the question stated that they wern't worried about security...

I fixed it by putting this in the sudoers file:

www-data ALL=(ALL) NOPASSWD: ALL

This basically means that the user www-data doesn't need a password to run sudo.

2
  • This is a very, very bad thing. The www-data group is typically reserved for untrusted, publicly accessible daemons/servers, such as web (nginx, apache) and torrenting. You are allowing easy escalation to root. If you really want to allow someone on the web to restart a service, list the specific commands explicitly, as shown here.
    – earthmeLon
    Commented May 17, 2014 at 16:25
  • I know it is. In fact, I got it slightly wrong, what I have is: Defaults:www-data !requiretty and www-data ALL=(ALL) NOPASSWD: ALL
    – developius
    Commented May 17, 2014 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.