php-linux-expect-su-continued
the php is simple, the f*cking expect script wasn't working as expected
basically the su - username or even the spawn stuff wasn't working
apparently the timing in expect is really flaky...
NOTE: to debug expect you need the
#!/usr/bin/expect -d
and use the "interact" command once in a while in the middle
THE OTHER TRICK is you could setup a user who doesn't have access to
anything but the password is in cleartext in the script... this user
owns the file you want to modify so when you su - username you can
actually modify the file (but www-data still can't)...
// test.php minimum permissions are chown root:www-data, chmod 440
// this means that only root can modify the file but since www-data
// can read the file it can execute the script?
<?php
passthru('./atest.sh');
?>
//btest.sh chown username:username, chmod 700, username must be su'd from atest.sh
#!/usr/bin/expect
set userpass "atest"
set username "atest"
spawn htpasswd /web/example $username
sleep 1
expect "New password:"
send $userpass\n
expect "Re-type new password:"
send $userpass\n
interact
- - WORKING! - atest.sh - - - - - - - - - - - - - - - - - - - - - -
//atest.sh chown root:www-data, chmod 550, so php can execute it
#!/usr/bin/expect -d
set timeout -1
sleep 1
spawn su andmin -c /bin/date
sleep 1
expect "Password:"
send "pass-"
sleep 1
send "\r"
interact
- - - - - - - - - - - - - - - - - - - - - - - - -
# su - andmin -c command-remember-in-andmin's-home-dir
# spawn
# system ls
#!/usr/bin/expect -d //very useful for debugging!
expect version 5.43.0
argv[0] = /usr/bin/expect argv[1] = -d argv[2] = ./ctest.sh
set argc 0
set argv0 "./ctest.sh"
set argv ""
executing commands from command file ./ctest.sh
spawn su andmin -c /usr/bin/whoami
parent: waiting for sync byte
parent: telling child to go ahead
parent: now unsynchronized from child
spawn: returns {29069}
expect: does "" (spawn_id exp6) match glob pattern "Password:"? no
Password:
expect: does "Password: " (spawn_id exp6) match glob pattern "Password:"? yes
expect: set expect_out(0,string) "Password:"
expect: set expect_out(spawn_id) "exp6"
expect: set expect_out(buffer) "Password:"
send: sending "PASS-\r" to { exp6 }
WHAT'S THE DIFFERENCE!
- - - - - - -
expect version 5.43.0
argv[0] = /usr/bin/expect argv[1] = -d argv[2] = ./ctest.sh
set argc 0
set argv0 "./ctest.sh"
set argv ""
executing commands from command file ./ctest.sh
spawn su andmin -c /usr/bin/whoami
parent: waiting for sync byte
parent: telling child to go ahead
parent: now unsynchronized from child
spawn: returns {29085}
expect: does "" (spawn_id exp6) match glob pattern "Password:"? no
andmin
expect: does "andmin\r\n" (spawn_id exp6) match glob pattern "Password:"? no
expect: read eof
expect: set expect_out(spawn_id) "exp6"
expect: set expect_out(buffer) "andmin\r\n"
send: sending "PASS-\r" to { exp6 send: spawn id exp6 not open
while executing
"send "PASS-\r""
(file "./ctest.sh" line 10)