Question

I want to make a simple GUI for my server with options like: sudo shutdown -h now.

I have doubts cause while thinking about this, I realized that apache runs as user www, which is quite limited. So html page served via apache will have limited access… is this so?

If yes, how do applications like webmin work?

Thanks.

Answer 1

You can put up a simple web page with for example Python or Ruby using a system call to run such commands, but only for static, prepared commands which you have tested manually and exhaustively and only if you have good security in place already to avoid DOS attacks and vandalism. These points are extremely important because you really don’t want anyone else to have your machine at their disposal. You can easily set up sudo to allow static commands from wwwrun with sudo visudo.

Even so, it’s probably a lot safer to use secure protocols actually designed for secure remote work, such as ssh (together with ssh-copy-id for convenience and security).