Home/ Questions/Q 7050395
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-28T03:08:17+00:00

I need to allow a PHP script on my local web server, to SSH

  • 0

I need to allow a PHP script on my local web server, to SSH to another machine to perform a specified task on some files. My httpd runs as _www with low permissions, so setting up direct passwordless SSH is difficult, not to say ill-advised.

The way I do it now is to have a minimal PHP script that sudo-exec’s (as me) a shell script which is outside of the document root. The shell script in turn calls (as me) the PHP code that does the actual SSH work, and prints its output. Here’s the code.

read_remote_files.php (The script I call from my browser):

exec('sudo -u me -n /home/me/run_php.sh /path/to/my_prog.php', $results);
print $results;

/home/me/run_php.sh (Runs as me, calls whatever it’s given):

php $1 2>&1

sudoers:

_www ALL = (me) NOPASSWD: /home/me/run_php.sh

This all works, as my_prog.php is called as me and can SSH as me. It seems it’s not too insecure since run_php.sh can’t be called directly from a browser (outside document root). The issue I’m having is that my_prog.php isn’t called as an HTTP program so doesn’t have access to the HTTP environment variables (DOCUMENT_ROOT etc).

Two questions:

  1. Am I making this too complicated?
  2. Is there an easy way for my final script to get the HTTP variables?

Thanks!
Andy

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    “I need to allow a PHP script on my local web server, to SSH to another machine to perform a specified task on some files.”

    I think that you are phrasing this in terms of a solution that you have difficulty in getting to work rather than a requirement. Surely what you should be saying is “I want to invoke a task on machine B from a PHP script running under Apache on Machine A.” And then research solutions to this — to which there are many from a simple ‘roll-your-own’ RPC tunnelled over HTTP(S) to using an XMLRPC or SOA framework.

    Two caveats:

    • Do a phpinfo(); on both machines to check what extensions are available and
    • Also check your php.ini setting to make sure that your service provider hasn’t disabled any functions that you expect to use (or do a Q&D script to echo 'disable_functions = ' . ini_get('disable_functions') . "\n"; ...)

    If you browse here and the wider internet you’ll find many examples. Here is one that I use for a similar purpose.

    • 0