I've recently been struggling with ways to make a easy way for my father to both mount and unmount a harddrive on a linux based system. I thought of a way to execute a shell script with PHP. The following is what I came up with:
First I made 2 scripts which will take care of mounting and unmounting the harddrive:
unmount_script.sh:
#!/bin/bash MOUNT="/home/media/externalHardDrive" if grep -qs "$MOUNT" /proc/mounts; then umount "$MOUNT" if [ $? -eq 0 ]; then echo "HardDrive kan veilig worden verwijderd :D" else echo "Er is iets mis gegaan, blijf overal vanaf :(" fi else echo "Er is geen HardDrive gemount op $MOUNT, deze kan daarom niet verwijderd worden!" fi mount_script.sh
#!/bin/bash MOUNT="/home/media/externalHardDrive" if grep -qs "$MOUNT" /proc/mounts; then echo "HardDrive is al gemount op $MOUNT ;)" else mount /dev/sdc1 "$MOUNT" if [ $? -eq 0 ]; then echo "HardDrive is succesvol gemount :D" fi fi These 2 scripts will simply check if /dev/sdc0 is currently mounted and perform their tasks if not.
/etc/sudoers:
# # This file MUST be edited with the 'visudo' command as root. # # Please consider adding local content in /etc/sudoers.d/ instead of # directly modifying this file. # # See the man page for details on how to write a sudoers file. # Defaults env_reset Defaults mail_badpass Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" # Host alias specification # User alias specification # Cmnd alias specification # User privilege specification root ALL=(ALL:ALL) ALL # Allow members of group sudo to execute any command # %sudo ALL=(ALL:ALL) ALL # See sudoers(5) for more information on "#include" directives: #includedir /etc/sudoers.d www-data ALL=(ALL) NOPASSWD: /home/media/mount_script.sh www-data ALL=(ALL) NOPASSWD: /home/media/unmount_script.sh www-data ALL=NOPASSWD: /bin/sh I've eddited /etc/sudoers in a way so only www-data has permissions to use sh to execute the scripts. Other groups and/or users should not have access to any sudo command.
PHP file:
<?php if ((substr($_SERVER['REMOTE_ADDR'],0,10) == "192.168.0.") || ($_SERVER['REMOTE_ADDR'] == "127.0.0.1")) { if(isset($_POST['mount'])) { $output = shell_exec('sudo sh /home/media/mount_script.sh'); } if(isset($_POST['unmount'])) { $output = shell_exec('sudo sh /home/media/unmount_script.sh'); } ?> <html> <head> <title>Control panel</title> </head> <body style="text-align:center;"> <h2>HardDisk Control Panel</h2> <p>Status:</p> <textarea cols="33" rows="10"><?php if(isset($output)) { echo $output; } ?></textarea><br /><br /> <form method="post"> <input type="submit" name="mount" value="mount" /> <input type="submit" name="unmount" value="unmount" /> </form> </body> </html> <?php } ?> In this file I assure that requests made from another ip-range than 192.168.0.* are bieing ignored. If the user is within the 192.168.0.* ip-range I allow the user to execute the script with sudo privileges.
Can somebody please check this configuration for security concerns that I should fix?
I am running all this on a Debian Server
