how to delete user in a Linux OS using Apache and PHP

Forum Moderators: coopster

Message Too Old, No Replies

how to delete user in a Linux OS using Apache and PHP

hsceeus

9:38 am on Mar 18, 2006 (gmt 0)

i'm using shell_exec('userdel -r $username');

but the user account still cannot be deleted from linux there. Can anyone help me or give my some suggestion? thank..

coopster

8:07 pm on Mar 18, 2006 (gmt 0)

You are likely running into a permissions issue as the user that PHP runs as is the same as the Apache server, which is typically 'nobody'.

hsceeus

6:24 am on Mar 19, 2006 (gmt 0)

so what should i do... how to set the permission? Can you teach me... thanks

Mr_Fern

7:13 am on Mar 19, 2006 (gmt 0)

You'd need Apache running as root, which is ill advised. One of the worst things you could do.

hsceeus

11:09 am on Mar 19, 2006 (gmt 0)

i using PHP with some shell script to delete the user account in the linux (fedora Core 4). the problem is, i can't delete it.

i using this line of code in PHP:

$res=`bash /var/www/cgi-bin/del.sh $username 2>&1`;

while in the del.sh, the code is like this:

userdel -r $1

In the apache there, i already set the root for apache in /etc/sudoers.. i set like this:

apache ALL= NOPASSWD:/usr/sbin/userdel \
/bin/mkdir, /bin/ln, /bin/chown

Can anyone know why i fail to delete the user in linux.. Thank..

hsceeus

6:40 pm on Mar 19, 2006 (gmt 0)

i really help someone to point me out where is the mistake.. Please...

SeanW

8:04 pm on Mar 19, 2006 (gmt 0)

For sudo to work, you have to run the command under sudo, ie

sudo userdel -r $USER

Sean

hsceeus

6:34 am on Mar 20, 2006 (gmt 0)

i using PHP with some shell script to delete the user account in the linux (fedora Core 4). the problem is, i can't delete it.
i using this line of code in PHP:

$res=`bash /var/www/cgi-bin/del.sh $username 2>&1`;

while in the del.sh, the code is like this:

sudo userdel -r $1

In the apache there, i already set the root for apache in /etc/sudoers.. i set like this:

apache ALL= NOPASSWD:/usr/sbin/userdel \
/bin/mkdir, /bin/ln, /bin/chown

Can anyone know why i fail to delete the user in linux.. Thank..

hsceeus

6:44 am on Mar 20, 2006 (gmt 0)

Now below is the complete code of line that i have writen. can anyone check for me the mistake..

1) Coding in PHP page:

<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<form name="form1" method="post" action="deleteLinux.php">
<p>Login:
<input name="login" type="text" id="login">
</p>
<p>
<input type="submit" name="Submit" value="Crear">
</p>
</form>
</body>
</html>

<?php
if (isset($_POST['Submit'])) {
$login=$_POST['login'];

$res=`bash /var/www/cgi-bin/del.sh $login 2>&1`;
echo"<pre>$res</pre>";

}
?>

2) While the below is the del.sh

sudo userdel -r $1

hsceeus

7:15 am on Mar 20, 2006 (gmt 0)

i already know how to delete the linux user.. thank for everyone....

SeanW

3:19 pm on Mar 20, 2006 (gmt 0)

Is anything popping up in apache's error_log?

Sean

hsceeus

3:43 pm on Mar 20, 2006 (gmt 0)

Nothing displayed..

jatar_k

5:35 pm on Mar 20, 2006 (gmt 0)

this is such a bad idea, I really hope this script isn't up on the web somewhere.

The hacking opportunities are endless, just having apache running as root is a nasty issue. Having scripts dop things such as these is even worse.

hsceeus

5:31 am on Mar 21, 2006 (gmt 0)

i know that it a bad idea..... i can't figure out a better solution..

is there any other better way? by not just let the apache as root? Could anyone give me a idea...thanks

jatar_k

3:27 pm on Mar 21, 2006 (gmt 0)

if it really needed to be automated I guess you could use a shell script of some kind, maybe

the thing is that it really should be a manual process where someone logs in as root and does it

hsceeus

6:27 pm on Mar 21, 2006 (gmt 0)

i writing the userdel -r $username in the .sh file, so is it consider one of the way of using shell script?

if i wrong with it, can tell me what is the shell script can did for security...

jatar_k

11:47 pm on Mar 21, 2006 (gmt 0)

as I don't wholly understand the reason you think you need to script this it is rather difficult to give you a good alternative

I am assuming this is something that needs to be done often and may involve many steps

I have used shell scripts for complicated processes many times but I always have to login as root to fire them off.

maybe if you explain the reasoning behind doing this scripted user removal I might be ble to shed a little more light

hsceeus

11:13 am on Mar 22, 2006 (gmt 0)

This is my final project, one of the modules in this project is to create a web based system using PHP to add and delete the linux account. It want to provide a user interface for the admin to add and delete linux account instead of using a interactive way to add and delete the linux account by using linux command.

So, is it clear enough?

jatar_k

4:46 pm on Mar 22, 2006 (gmt 0)

well I think you will have to run apache as root or give the web user shell or root access to make this work

hsceeus

5:46 pm on Mar 22, 2006 (gmt 0)

I have run apache as root at the beginning.. but from the security aspect, is it not a good idea using apache as root. So how you think about it, and did you have any idea about this...

jatar_k

8:16 pm on Mar 22, 2006 (gmt 0)

if you don'r give apache or the web user root access then you can't delete a user, just how it is