#Bash - Do some stuff, do some more, shut my system down..

rockhopper_penguin · 10-25-2013, 11:15 AM

Hi,

Sorry about bombarding you with questions, it's just that I have really fallen in love with this Linux stuff

My question:

Can I make a batch-like/mac-automator command to run from command line that does some things and then automatically shuts down my computer?

Example:

Code:

# fresclam
# clamscan -r -i
# yum update
# php var/www/html/myphp-directory/ do-some-sh.php
# python var/www/html/mypy-directory/ do-some-sh.py

..and then shut my system down when it's done doing everything.

And if this is possible and I assume it is..

Anyway to put this inside a php script for example that would echo it in the terminal and execute it?

catkin · 10-25-2013, 11:21 AM

The script will have to be running with root privileges. If it is, you can end the script with shutdown -h now

rockhopper_penguin · 10-25-2013, 11:24 AM

Excellent, thanks!

Firerat · 10-25-2013, 11:50 AM

there are rules with who can shutdown a system and when.

Code:

shutdown -h now

is an immediate shutdown

Code:

shutdown -h +10

introduces a 10 min delay

Normally it must be run as root
however, if you add your user to /etc/shutdown.allow

Code:

shutdown -a -h +10

they can shutdown

man shutdown
for details

an alternative is sudo
man sudoers
man visudo

Code:

visudo

and add ( at the end, last rule wins )

Code:

username ALL=NOPASSWD:/sbin/shutdown

and then

Code:

sudo shutdown -a -h +10

since NOPASSWD for the command /sbin/shutdown, there will be no password prompt

be careful with that NOPASSWD, seemingly innocent things like less can lead to a root shell

example

Code:

username ALL=NOPASSWD:/usr/bin/less /var/log/someProtectedLogs/file.log

ok, now your username can look at a logfile using less, something they can not otherwise view

However,
when in less, type v
now you have vi ( or vim ) editor
now type :!bash
you now have a bash shell as root!

Just a made up example of the dangers with sudo

Code:

username NOPASSWD: NOEXEC:/usr/bin/less /var/log/someProtectedLogs/file

NOEXEC fixes it,
see NOEXEC and EXEC section in, man sudoers

rockhopper_penguin · 10-25-2013, 12:04 PM

Hi Firerat,

Interesting, great explanation. I tried to do the less trick but it gave 'cannot edit standard input <press return>'. I will try to play with these settings although it seems unnecessary, I have 1 user & root, which is both me. Bash does not even allow me to sudo things, I have to su - root if I want to do stuff from command line. That's why I want to make a php-script of it and then just su & php runmything.php the question is will it run from command line when I

Code:

<?php echo 'shutdown -h now'; ?>

NOPASSWD: NOEXEC: seems like a really handy trick when working with multiple users

suicidaleggroll · 10-25-2013, 12:15 PM

Quote:

Originally Posted by rockhopper_penguin

That's why I want to make a php-script of it and then just su & php runmything.php the question is will it run from command line when I

Code:

<?php echo 'shutdown -h now'; ?>

That would just print the string "shutdown -h now" to the screen, it wouldn't actually run anything.

If you want to run a command line program from php you need to use exec(), eg:

Code:

exec("ps -f -p " . $pid,$output,$retval);

to run ps -f -p on whatever process ID is contained in the variable $pid, and save the output of the command to the variable $output and the return value to the variable $retval.

rockhopper_penguin · 10-25-2013, 12:20 PM

Just as you answered I tried a test-script, so I found out it wasn't working. Indeed it just echoes. However with the exec(), I should be able to come up with something. Thanks.

Firerat · 10-25-2013, 02:48 PM

regards less, you have to open a file directly,. not via a pipe

Code:

less /path/to/file

Of course, it was just an example of how miss configuring sudoers can lead to security risks
( less more vi vim emacs , etc.)

Also , I guess it is Off topic, but I thought it best to include the warning since someone may stumble upon this thread and get creative with NOPASSWD

rockhopper_penguin · 10-25-2013, 03:57 PM

Ah Firerat, on my macbook now but will try it out tomorrow. If someone has an agenda of compromising the security of computers I doubt this topic would be of much interest to him/her. If anything I think it's great you point out the potential risks.

I still have a lot to learn in those command line- editors. For now I've just learned how to use the command line a bit. I'll probably wallpaper the bedroom with cheat sheets, to get me there faster. Loving this distro, easy enough to get it all up and running, hard enough to learn some stuff. (Hate those fancy gui packet management tools almost as much as I hate 'app stores'.) Good responsive forum to ask questions, feeling confident that I'll be finding my way.

On topic, I will post what I come up with when I do. Thanks again.

rockhopper_penguin · 10-26-2013, 05:36 AM

So far it works fine with command line commands.
For example:

Code:

passthru ('clamscan -r -i /home/') . PHP_EOL;

However:

Code:

exec('/var/www/something.php'); //does not work
passthru('/var/www/something.php'); //does not work

$pid = '/var/www/something.php';
exec("ps -f -p " . $pid,$output,$retval); //does not work.

What am I not seeing here? It's needed to run a php-script to update a database I have.

Firerat · 10-26-2013, 11:43 AM

I don't know php, never used it

//does not work
is not all that helpful, do you get an actual error message?

Those lines 'look ok' to me, but like I said, php is not something I know, so that means nothing

my best guess right now, is /var/www/something.php executable?

rockhopper_penguin · 10-26-2013, 01:24 PM

Hi Firerat,

The problem that the terminal gives me has to do with the processing of the php file. As in every php file it starts with <?php and ends with ?>. The terminal will give me an error when executing a php file from within a popen/passthru/exec command because it will process <?php again literally. So I think the problem with the execution is that it will read <?php inside the already existing tags. Like <html><html> bla </html></html> for html-script, does that make sense? I tried to let the terminal ignore the tags with

Code:

php -R something.php

as I read something about ignoring those tags, but no luck with that either. So far I've come up with a cool script that does almost everything I want it to. Just not execute php. This would not pose a serious problem, but I think I would want to learn it for future reference.

Code:

<?php 
echo 'Running shutdown-script..' . PHP_EOL;
echo ' ' . PHP_EOL;
echo 'Update system first..' . PHP_EOL;
passthru('yum -y update') . PHP_EOL;
echo ' ' . PHP_EOL;
echo 'Retrieve spots for the last time..' . PHP_EOL;
//passthru("/var/www/html/spotweb/retrieve.php");
echo ' ' . PHP_EOL;
echo 'Update and run antivirus scan' . PHP_EOL;
passthru ('freshclam') . PHP_EOL;
echo ' ' . PHP_EOL;
passthru ('clamscan -r -i --move /home/rhp/Infected') . PHP_EOL;
echo ' ' . PHP_EOL;
echo 'Shutting down, goodbye!' . PHP_EOL;
echo ' ' . PHP_EOL;
passthru('shutdown -h now') . PHP_EOL;
?>

Is what I have so far, works fine and will be adding more to it in the future. Pretty simple way of batching stuff up.

Code:

Retrieve spots for the last time..
/var/www/html/spotweb/retrieve.php: line 1: ?php: No such file or directory
/var/www/html/spotweb/retrieve.php: line 2: syntax error near unexpected token `2147483647'
/var/www/html/spotweb/retrieve.php: line 2: `error_reporting(2147483647);'