last day (14 days later) » 

10:58 AM
0
Q: Using subprocess to execute shell script with sudo

YentheI have a Python script that automatically has to trigger a shell script. Everything works fine but there is one problem. When I execute the script (from a webinterface) the terminal where the process runs under will ask for the password of the user. This shouldn't be asked and should automaticall...

 
have you considered enabling password-less sudo for the relevant user?
 
@scytale yes I have thought about that but I'd really rather not. This application has to work on multiple systems out of the box and that wouldn't be the case with password-less sudo since it would have to be configured. Plus security wise I don't really like it either.
 
well you're going to be storing a password in a db that effectively gives root access to all these boxes so security is not exactly tight
 
The database and interface will be unaccessible for any user and there is only one way in to the system from where you could execute the script. The rest of the system is blocked out for this user so I don't think it would give too many security problems than?
 
basically either way if an attacker gets into this user account they have root - it's just a question of if they need to query the db to get the password for sudo.
 
10:58 AM
@scytale you have a point there, although it makes it a little bit harder. Paulo Almeida and scytale the main problem is that this application should be a one-click install and nothing should have to be configured. Which wouldn't be the case when adding password-less rules. I couldn't even automate those in the install.
 
does the "1 click install" require root priviliges?
and will each machine the script is installed on use the same user - and will the password for that user be the same?
 
@scytale the application will not need root access. It only needs sudo rights for the user where the application runs under (to execute the shell with sudo). The username and password will always be different on every device.
 
so you're going to store the username/password for multiple accounts on multiple devices in your db?
and how are those accounts going to be given sudo? that will already be in place before your application is installed? or you will have to configure that somehow?
 
The account that runs the application will always have sudo rights in place, by default. Every application will be on its own server with its own username, password and database. So everything is 100% seperated. The only thing that needs to work is to execute a shell with sudo and then everything is working fine.
@Igor I did find that post before and tried a few ways but none of them work either.
Actually I made a fault in one of the solutions from that question. Let me give this another try! I will post back soon.
 
this sounds like a potential security disaster. there is probably a much better way to do what you need to do.
 
11:00 AM
hi @scytale I wanted to give you some more context to give you an idea.
The application is a service that makes a sort of webservice available through where users can save data (an ERP).
I am the only super admin on that system and the application only has rights regarding to this service for that specific database, nothing else.
Do you still consider this as major security issues? The problem is that I'm a programmer and in no way a sysadmin so I like any input on this.
 
no, it effectively has root rights. the application/user can query the db, get the password and sudo to root.
so a security flaw in the web service is effectively a root exploit
 
Hmm.. also if the database is only accessible by one user? (which is the user running the web service)?
 
yes
 
I see.. Well I knew it wasn't ideal but not that it would be that severe. What would you suggest to be the best way to handle this situation?
 
if you want more discussion on this you should open a new quesiton. I'm not really into providing 1-1 advice in chat
if you open a qustion then many people can benefit from the discussion
you should explain 1) your applications requirements (i.e. that it needs to run 1 script as root)
2) your current implementaiton (password in db, sudo)
3) why you don't use password-less sudo
4) explain that each install has its own db running locally
 
11:06 AM
Hmm yes I understand! Alright I'll have a chat about this with the guys at the company and I will probably create a new topic about this since I can imagine more people run in to these 'problems'.
 
and of course the question arises why a web application needs to run a script with root priviliges
 
That is because this script will automatically create new webservices
The idea is to automate installs for an ERP package which runs on a webservice.
So in essence nobody can access the webservice which this script executes, since this will be secured by our firewall to keep it only accessible internal in the company. The other webservices will have no access to these scripts or to create new ones
 
 
1 hour later…
12:19 PM
Just a thought. Instead of running the script, the web application user could just create a file in a certain location on disk. That would trigger an incron job of the root user, to run the script. This way no password is ever necessary. You could also just use cron, running every minute. I mentioned incron because you wouldn't have to poll.
 

last day (14 days later) »