Safe way to delete a file owned by ROOT from a PHP script on Apache

[thedaver]

I'm playing around with coding a tool to control SSHd access via scripted processing of IPs from logs and stuffing them into /etc/hosts.deny. (yes I know other tools already can do this, I'm forcing my self to think on my own as a coding exercise with some spare time...)

This is on a remote linux server and SSH is my only console access. Obviously I don't want an erroneous value to lock me out. So....

I'd like to have a simple PHP script on my Apache that I can call (e.g. hostname.tld/resethostsdeny.php), that would either delete or rename the /etc/hosts.deny file.

Obvious trouble is that this file is perm 644 and owned by user 'root'. I don't want to escalate my Apache's user to become root just to delete/rename this file.

Would you advise that PHP could tell 'cron' to do something directly? Use PHP to write a flag file that a cron job would periodically check as a flag to remove hosts.deny?

This is kind of an exercise to have an unprivileged process (apache) tell the system to act on a privileged file.

How would you do it? Thanks! Dave.







D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[RhythmAce]

As I was reading the post I was thinking along the same lines as you. I would have the php script keep a file updated. Then use cron to write that file over hosts.deny. If a timed interval doesn't fit your needs, maybe you can use an event to trigger the script instead of cron.

 

[thedaver]

I went ahead and make a PHP script that writes a specifically named file to a specific folder (my "flag file"). No particular content in the folder.

Then, a cron job polls for that file's presence, deletes that flag file, and then takes action from there. Otherwise, if the flag is absent when the cron script runs, it terminates with no further action.

I think there's a tool called 'filemon' that does some similar monitoring, but this met my needs...

Thanks for the comment!

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/