iptables permission problem in perl scripts

iptables permission problem in perl scripts

[afshin lamei]

Dear all,
I have a cgi script, which uses some perl scripts in which i'm running
iptables command using "system" function, like this:
myfile.pl:
......
system("iptables -F FORWARD")
......

the cgi file is owned by root/root and is run by user nobody.
myfile.pl is owned by root/root, and I've it setuid (chmod u+s
myfile.pl ; chown root:nobody myfile.pl) to be able to run iptable
commands, but it returns this error:
/////
modprobe: Can't locate module ip_tables.
iptables v1.2.11: can't initialize iptables table `nat': Permission
denied (you must be root) perhaps iptables or your kernel needs to be
upgraded.
/////
what's the solution?
thanks a lot
afshin lame

Re: iptables permission problem in perl scripts

[Gavin Henry]

On Sunday 14 Aug 2005 08:34, afshin lamei wrote:
> Dear all,
> I have a cgi script, which uses some perl scripts in which i'm running
> iptables command using "system" function, like this:
> myfile.pl:
> ......
> system("iptables -F FORWARD")
> ......
>
> the cgi file is owned by root/root and is run by user nobody.
> myfile.pl is owned by root/root, and I've it setuid (chmod u+s
> myfile.pl ; chown root:nobody myfile.pl) to be able to run iptable
> commands, but it returns this error:
> /////
> modprobe: Can't locate module ip_tables.
> iptables v1.2.11: can't initialize iptables table `nat': Permission
> denied (you must be root) perhaps iptables or your kernel needs to be
> upgraded.
> /////
> what's the solution?

Use "sudo"

You can grant apache permission or another user etc.


-- 
Kind Regards,

Gavin Henry.
Open Source. Open Solutions(tm).

http://www.suretecsystems.com/

iptables permission problem in perl scripts

[psihozefir]

maybe run perl executable suid root

Re: iptables permission problem in perl scripts

[Grant Taylor]

psihozefir wrote:
> maybe run perl executable suid root

NO!  Do not do this, this will introduce SO MANY security problems on a modern box.  This is REALLY a BAD idea.  Find some other way to fix your problem.



Grant. . . .

Re: iptables permission problem in perl scripts

[Grant Taylor]

Can we get an ls -l of the files in question?  What is the user that the web server is running as?



Grant. . . .

afshin lamei wrote:
> Dear all,
> I have a cgi script, which uses some perl scripts in which i'm running
> iptables command using "system" function, like this:
> myfile.pl:
> ......
> system("iptables -F FORWARD")
> ......
> 
> the cgi file is owned by root/root and is run by user nobody.
> myfile.pl is owned by root/root, and I've it setuid (chmod u+s
> myfile.pl ; chown root:nobody myfile.pl) to be able to run iptable
> commands, but it returns this error:
> /////
> modprobe: Can't locate module ip_tables.
> iptables v1.2.11: can't initialize iptables table `nat': Permission
> denied (you must be root) perhaps iptables or your kernel needs to be
> upgraded.
> /////
> what's the solution?
> thanks a lot
> afshin lame

Re: iptables permission problem in perl scripts

[Jan Engelhardt]

>the cgi file is owned by root/root and is run by user nobody.
>myfile.pl is owned by root/root, and I've it setuid (chmod u+s
>myfile.pl ; chown root:nobody myfile.pl) to be able to run iptable
>commands, but it returns this error:

To run suid perl scripts, you must
- chmod u+s the script AND
- use "suidperl" AND
- have suidperl being u+s

And it's the biggest security hole as everyone says - does not [yet] reflect 
my opinion, though. So use some sudo magic (as recommended) if possible.


Jan Engelhardt
-- 

Re: iptables permission problem in perl scripts

[/dev/rob0]

On Monday 2005-August-15 00:47, Grant Taylor wrote:
> Can we get an ls -l of the files in question?  What is the user that
> the web server is running as?

The OP said it was "nobody". It's not a file permission issue; it is
the fact that only root can manipulate the kernel's netfilter rules. 
SUID (messy and risky) or sudo(1) (clean and possibly less risky if 
done right) are really the only solutions.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header