CentOS 5.3 apache sudo "can't set runas group vector"

Discussion in 'Server Operation' started by cento_claus, Nov 12, 2009.

  1. cento_claus

    cento_claus New Member

    Hi,

    I'm running out of ideas (and of forum threads to try), so here is my problem:
    I want to create a web page using perl to configure a router.
    The router is going to be used to limit bandwidth to some IPs and also to block some IPs.
    I'm using Centos 5.3 which comes with httpd and suexec pre-installed.
    The command I want to use are "route add -host ..." and "tc filter ...", these commands can only be run as root.

    So far here's what I've been trying:
    1. Make suexec executable:
    chmod a+x /usr/sbin/suexec
    chmod a+s /usr/sbin/suexec

    2. Set "user" and "group" to the desired user ("test") in httpd.conf

    3. Add my user ("test") to the sudoers:
    echo "test ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

    3. Make my perl scripts executable in /var/www/bin-cgi/

    4. Start apache
    /sbin/service httpd start

    Here is my script:

    #!/usr/bin/perl -T
    use CGI;
    use strict;
    delete @ENV{qw(IFS CDPATH ENV BASH_ENV PERL5SHELL)};
    $ENV{PATH} = "/usr/bin/:/usr/local/bin";

    my $query = new CGI;
    foreach my $field (sort ($query->param)) {
    foreach my $value ($query->param($field)) {
    print "$field: $value<br/>";
    }
    }

    my $command = "id";
    my $res = qx/$command/;
    print "Result Whoami=$res<br/>";

    my $ip = $query->param('addressIP');
    if ( $ip =~ /^(.*)$/ ) { # to update: to check $ip
    $ip = $1;
    print "IP = $ip<br/>";
    my $command = "/sbin/route add -host $ip reject";
    #my $command = "sudo /sbin/route add -host $ip reject";
    print "Command: $command<br/>";
    my $res = qx/$command/;
    print "Result=$res<br/>";"/sbin/route add -host $ip reject"
    } else {
    print "Sorry, that’s not a valid ip\n";
    }

    ########################################
    When running the script, the user is indeed "test", but for some reason, either command "/sbin/route add -host $ip reject" or "sudo /sbin/route add -host $ip reject" won't be executed.

    Does anybody know what I'm missing?

    Thanks
     
  2. falko

    falko Super Moderator

    Have you tried the full path to sudo in your script?
     

Share This Page