Using PHP to restart apache

[jimjimbobim]

I am trying to figure out if this is a terrible security risk.

I need to have PHP restart apache in order to effect changes made to httpd.conf.

I have managed to do this by installing SUDO and then adding

www-data ALL=(ALL) NOPASSWD: /usr/sbin/apachectl

to /etc/sudoers.

I then add this to the PHP page:

passthru("sudo apachectl graceful", $output_var);

Is this a massive risk if I have the page that execute it is passworded?

Thanks!

-Jim

[e_dreamer]

if the page is properly protected then it should be fine... i would avoid using basic http authentification (with .htaccess and .htpasswd) because there are to many people who can work a basic http auth brute forcer...

also, seen as it only restarts the server i wouldn't think it to be THAT big of a risk anyway... sure people could use it for DoS on your server if they got to it, but its not like you'd loose any data or anything

[flw]

I need to have PHP restart apache in order to effect changes made to httpd.conf.

Why would you use php? Instead do it manually via ssh2 or just have cron restart on a time schedule that fits your needs and would have no security issues.

[jimjimbobim]

Dreamer: Thanks! That is what I wanted to know. I feel that the page is well protected, and I am not using htaccess.

fastlanwan: I am using PHP to add websites and web directories to a web server. This needs to be done at will. Thanks for the suggestion.

[bbuntyb]

I am trying to do the same thing, creating domain name, adding it to httpd.conf and zone file and to restart apache and named services.

Can you please tell me how you did it or provide me source code.

Regards,
Bunty

[oz]

Welcome to the forums, bbuntyb!

Please start a new thread describing in detail any issues that you are having. This one is almost 6 years old and is not likely to be monitored any longer by the other posters.

Sorry for any inconvenience.