Posted by Jonas Werres on 01/04/08 18:28

It is quite easy:
If PHP hast root permission, it can run root tasks. And we don't want
that. Really. So Erwins suggestion is an immensely stupid idea.
The least thing you can do is use sudo restriced to the passwd command.
But do we want PHP to have full access to passwd? No.
I don't even use it to copy some files for maildrop.

So my suggestion is: Let the webserver PHP write into a db or file whats
absolutly necessary. In this case: username and password, I think.

Then run a shellscript (or even better a compiled program) with those
informations (outside webroot, with cron).

• Next in forum: Re: What is wrong?
• Prev in forum: Why are these so brilliantly hidden when it comes to PHP's functions...?
• Thread view: Re: how can I run root commands in php

[Reply to this message]