Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to run a command line program with PHP script. What are the security issues of doing this on VPS?

I've heard a lot that this is not secure. But want to know how exactly? Also, what will be the best way to run the command then.

EDIT: I want to run cutycapt (a screenshot tool) along with xvfb-run (virtual window). So it will require privileges.

share|improve this question

3 Answers 3

Allowing your script to run command-line tools may or may not be secure. It depends greatly on what you are doing.
Consider the following two scenarios:

  1. A script that runs ls /tmp and displays the output
    This is probably fine. You may have an information leak (someone hitting the page knows the contents of /tmp on the server, which may give them ideas on how to bypass your security).

  2. A script that greps for a user-specified string in a file
    This is probably NOT fine: The script will call something like system("grep $user_string /some/file"), and a creative attacker can figure out what it's doing, insert an extra ; into the $user_string bit, and then run arbitrary code as the web server's user.

There are mitigating steps you can take to deal with (2) above (PHP has escapeshellarg() and escapeshellcmd() to help you out), but the bottom line is any time you allow a web application to execute commands you open yourself up for command injection attacks, and you need to thoroughly plan, audit and secure your code (including the command you're calling) to make sure you don't leave yourself open to attack.

If what you are trying to do can be accomplished with (securely-written) native PHP that's almost always a better option for both speed and security.

share|improve this answer

To run things under apache, including via PHP, with privilege, there seems to be some agreement that passwordless sudo is the right tool.

how do i perform root actions from non-root account? is an earlier answer of mine that discussed this in more detail and gives examples, which seems to have received some approval.

share|improve this answer

What I would suggest is I write up a shell script that includes any and all commands that needs to be run. So PHP would not be running the command directly rather using the wrapper script to accomplish what is required. Further, you could use sudo and edit sudoers as necessary to help you run commands that need higher privileges.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["                  <li><a href=\"//area51.stackexchange.com\" title=\"proposing new sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"//careers.stackoverflow.com\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2015 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a> \r\n                with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2015.2.26.2347\r\n            </div>\r\n            \r\n        </div>\r\n    </div>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Server Fault works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\"dno\"></div>\r\n    </noscr"], "copyright__copyright__copyright": ["t includes any and all commands that needs to be run. So PHP would not be running the command directly rather using the wrapper script to accomplish what is required. Further, you could use sudo and edit sudoers as necessary to help you run commands that need higher privileges.\n\nshare|improve this answer\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}