CODEWITHSUNDEEP
phplinuxservice
Pavel
Pavel

Reputation: 694

Checking service status with php on linux?

I'm trying to read status of a service using php7 on Debian 9. The command is simple: 

sudo -u root -S service openvpn@debideb status < /var/www/html/.htpass

I do get desired result when I test it in terminal:

[email protected] - OpenVPN connection to debideb
   Loaded: loaded (/lib/systemd/system/[email protected]; disabled; vendor preset: enabled)
   Active: active (running) since Mon 2018-06-25 06:17:15 PDT; 1h 2min ago
     Docs: man:openvpn(8)
           https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
           https://community.openvpn.net/openvpn/wiki/HOWTO
  Process: 5049 ExecStart=/usr/sbin/openvpn --daemon ovpn-debideb --status /run/openvpn/debideb.status 10 --cd /etc/openvpn -
 Main PID: 5051 (openvpn)
    Tasks: 1 (limit: 4915)
   CGroup: /system.slice/system-openvpn.slice/[email protected]
           └─5051 /usr/sbin/openvpn --daemon ovpn-debideb --status /run/openvpn/debideb.status 10 --cd /etc/openvpn --config

however,when I do it through www-data I get following results: passthru() returns int(1); shell_exec() returns NULL; exec() and system() return string("");

Where did I screw up?

Upvotes: 1

Views: 3691

Answers (2)

Sergio Garc&#237;a Gal&#225;n
Sergio Garc&#237;a Gal&#225;n

Reputation: 21

Agree with Allenph.

However, if there's any reason to exec() some script from your PHP code, maybe you can install sudo, then add www-data to sudoers and restrict it to execute just only the script you need to be run with no password.

In /etc/sudoers (thinking on the fly, please, review the syntax with some docs):

www-data  NOPASWD:/path/to/my/script.sh

The permissions for the script should be set to something like 500 or 700 and the owner should be root (never www-data).

Upvotes: 0

Allenph
Allenph

Reputation: 2015

You could run a CRON to check service status and output the result to some kind of output format then read the output file from the web server user. This way you could isolate the user running the CRON from the webserver user, and make this a lot more secure.

It's a really bad idea to have an exec call in your PHP at all, let alone when the web server has root permissions (which you'd need here.)

Upvotes: 1

Related Questions