Find the answer to your Linux question:
Results 1 to 6 of 6
I am trying to figure out if this is a terrible security risk. I need to have PHP restart apache in order to effect changes made to httpd.conf. I have ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Jul 2003
    Location
    Seattle
    Posts
    2

    Using PHP to restart apache


    I am trying to figure out if this is a terrible security risk.

    I need to have PHP restart apache in order to effect changes made to httpd.conf.

    I have managed to do this by installing SUDO and then adding

    www-data ALL=(ALL) NOPASSWD: /usr/sbin/apachectl

    to /etc/sudoers.

    I then add this to the PHP page:

    passthru("sudo apachectl graceful", $output_var);

    Is this a massive risk if I have the page that execute it is passworded?

    Thanks!

    -Jim

  2. #2
    Just Joined!
    Join Date
    Mar 2003
    Location
    UK
    Posts
    82
    if the page is properly protected then it should be fine... i would avoid using basic http authentification (with .htaccess and .htpasswd) because there are to many people who can work a basic http auth brute forcer...

    also, seen as it only restarts the server i wouldn't think it to be THAT big of a risk anyway... sure people could use it for DoS on your server if they got to it, but its not like you'd loose any data or anything

  3. #3
    flw
    flw is offline
    Linux Engineer
    Join Date
    Mar 2003
    Location
    U.S.A.
    Posts
    1,025
    I need to have PHP restart apache in order to effect changes made to httpd.conf.
    Why would you use php? Instead do it manually via ssh2 or just have cron restart on a time schedule that fits your needs and would have no security issues.
    Dan

    \"Keep your friends close and your enemies even closer\" from The Art of War by Sun Tzu\"

  4. #4
    Just Joined!
    Join Date
    Jul 2003
    Location
    Seattle
    Posts
    2

    Thanks!

    Dreamer: Thanks! That is what I wanted to know. I feel that the page is well protected, and I am not using htaccess.

    fastlanwan: I am using PHP to add websites and web directories to a web server. This needs to be done at will. Thanks for the suggestion.

  5. #5
    Just Joined!
    Join Date
    Jun 2009
    Posts
    3

    hi

    I am trying to do the same thing, creating domain name, adding it to httpd.conf and zone file and to restart apache and named services.

    Can you please tell me how you did it or provide me source code.

    Regards,
    Bunty

  6. #6
    oz
    oz is offline
    forum.guy
    Join Date
    May 2004
    Location
    arch linux
    Posts
    18,733
    Welcome to the forums, bbuntyb!

    Please start a new thread describing in detail any issues that you are having. This one is almost 6 years old and is not likely to be monitored any longer by the other posters.

    Sorry for any inconvenience.
    oz

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •