Linux - create user through PHP

Question

I'm writing a PHP program that calls bash scripts. I'm using Linux (Centos). I'm trying to create a new user in Linux by entering username and password in the PHP page. this is the script I'm using:

egrep "^$1" /etc/passwd >/dev/null
if [ $? -eq 0 ]; then
    echo "$1 exists!"
    exit 1
else

    sudo useradd -m -p $2 $1
    [ $? -eq 0 ] && echo "User has been added to system!" || echo "Failed to add a user!"
fi

this is how I call the script from PHP:

echo exec("/var/www/html/addUser.sh ".$username." ".$password);

it works when running it from terminal, but when calling the script from PHP it doesn't work. it is a matter of permissions. what should I do in order to allow the PHP (apache) to also add users? I've tried adding 'apache' to visudo both as user and as a group:

%apache ALL=(ALL)   NOPASSWD: ALL
 apache    ALL=(ALL)       ALL

it still doesn't work. any ideas? thanks.

Holycow, remove that entry from /etc/sudoers. You're essentially granting Apache full access to your system. — Alpha01
– Alpha01, Commented Jul 31, 2015 at 0:37
While this is an old post, %apache ALL=(ALL) NOPASSWD: ALL borders on criminally insane. — tink
– tink, Commented Jan 30, 2023 at 22:20

SteJ · Accepted Answer · 2015-07-31 01:02:56Z

2

You are attempting to let PHP run arbitary code on a web server as root -- this is extremely inadvisable, as if someone were to find a hole in your code and inject their own, they would literally be able to do anything they liked with your server!

That being said, you can call an external script using exec("command"); or use backticks like:

$command_output = `shell_command`;

For more information see php's exec function

If you really do want to proceed with this, I would suggest storing your script (the one at the top that you'd like to run) and then calling that script with exec(), while only allowing sudo passwordless access to that one script.

Additional:

You might want to try shell_exec instead of exec - this runs your command in a shell, which I think might fix any environment issues you may be having.

edited Jul 31, 2015 at 1:02

answered Jul 31, 2015 at 0:31

SteJ

1,54111 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

user2880391 Over a year ago

thanks. i've just tried the full permissions to PHP to see if it works. and it didn't. about 'exec' - I'm already using it to call the script. the question was how to allow PHP to create a new user.

SteJ Over a year ago

Check what environment exec() is passing on to your script - might be that it is either failing to find your script or failing to set sudo up properly due to missing "presumed" environment variables. I have called useradd from a PHP page using backticks before, so it is possible and I see no reason exec() would be any different -- as I said though, highly inadvisable - No bad reflection on you for wanting to do it anyway, but I have to keep reiterating in case someone comes across this post in 6 months time ;)

SteJ Over a year ago

I've just had one of those "while walking away from my computer" thoughts -- have you tried using shell_exec?

SteJ Over a year ago

it'd be interesting to see what the full output of your shell script was when it runs - any chance you could amend your echo exec("/var/www/html/addUser.sh ".$username." ".$password); to use backticks (exec only reproduces the last line when called with one argument) and post any results in your question?

user2880391 Over a year ago

I get "Failed to add a user! "

|

Collectives™ on Stack Overflow

Linux - create user through PHP

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related