Webcontrolpanel with access to console

Morten · 09-29-2011, 04:59 PM

Hi,

How can I create a website which can perform console commands in Debian 6.0?

I would like to develop a controlpanel for a server i'm running as an user called 'ServerAdmin' with the screen command.

Issuing a similar command to this one in the debian console, will make the server ban the specified player:

screen -p 0 -S ServerAdmin -X eval 'stuff \"ban playername\"\015'"

How can I issue such a command by running a php-application without exposing my computer/server?

Regards

kbp · 09-29-2011, 06:04 PM

With great difficulty ... you might want to start by reading the OWASP guides. I'm building a webapp from scratch in python and the OWASP guides have been invaluable, even though I've done some of the things you're not supposed to like creating your own session management etc..

Morten · 09-30-2011, 12:09 AM

Thank you for that information, I'll dig into that

However I'm going to make my system in PHP and was counting on using a function like exec(). But when this runs as apache and not the ServerAdmin user, I don't have enough permissions. How can I solve this?

Lowering the required permissions e.g. using chmod 777 would be a security risk, but should I just grant apache extra permissions?