os.system("echo sudo pi-ws") doesn't ask for password!

This is the place for queries that don't fit in any of the other categories.

os.system("echo sudo pi-ws") doesn't ask for password!

Postby thevdm » Thu Nov 21, 2013 12:16 pm

Hello all,

I am new to Python although having worked with PHP for quite a long time I'm finding it a nice language to work with, basically I am trying to create a script to run on a web server running Debian that can be used to create/edit/delete virtual servers, and modify port numbers etc... more specifically I am writing this script to maintain a web server running on a Raspberry Pi as the lack of power makes visual panels like webmin a little slow (maybe a little ambitious for a first project, but I did 'Hello World' first :roll:)

The code is coming together nicely but one thing that is important is that the script needs to be run as root or using SUDO so I have the following code at the beginning of my script just after the shebang.

This is the top section of the script /usr/local/bin/pi-ws
Code: Select all
import os, sys, colorama
from colorama import Fore

#Check if the script is being run as root or SU
if not 'SUDO_UID'  in os.environ.keys():
    os.system('clear')
    #Let the user know that this script needs to be run as root
    print (Fore.MAGENTA + "Due to the nature of this program it requires root priveliges.\nTry running 'sudo pi-ws_configure'\n")
    #Ask if the user would like to quit to the terminal or attempt to run the script as root
    option = raw_input (Fore.WHITE + "\t1: Run Pi-WS as root\n\t2: Quit to the terminal\n\n>> ")
    if option == "1":
        #Run 'sudo pi-ws'
        os.system("echo sudo pi-ws")
    else:
        #Exit to the terminal
        sys.exit(1)


I would expect that when the user inputs '1' and the script runs 'sudo pi-ws' that the user would be prompted to enter the root password, but they are not, the script just launches with sudo privileges without asking for a password, I have tried closing the terminal on my laptop and opening a new one so the sudo session is cleared, I have also tried copying the script to another server and logging in via putty using a non SU account, but both ways it still runs as root without the need for a password.

Obviously that isn't very secure :? does anybody know what might be causing that?
Last edited by Mekire on Thu Nov 21, 2013 12:29 pm, edited 1 time in total.
Reason: First post lock.
thevdm
 
Posts: 5
Joined: Thu Nov 21, 2013 12:01 pm
Location: Kent, United Kingdom

Re: os.system("echo sudo pi-ws") doesn't ask for password!

Postby Mekire » Thu Nov 21, 2013 12:25 pm

Not sure about your specific problem, but I will say with a fair amount of certainty that os.system is not the answer.

Use of os.system should be considered deprecated and you should use the subprocess module (with call or Popen) instead.

Maybe you can glean some information here:
http://stackoverflow.com/questions/5191878/change-to-sudo-user-within-a-python-script

-Mek
User avatar
Mekire
 
Posts: 987
Joined: Thu Feb 07, 2013 11:33 pm
Location: Amakusa, Japan

Re: os.system("echo sudo pi-ws") doesn't ask for password!

Postby metulburr » Thu Nov 21, 2013 12:35 pm

I would expect that when the user inputs '1' and the script runs 'sudo pi-ws' that the user would be prompted to enter the root password, but they are not

you dont need to be root to run an echo
Code: Select all
        os.system("echo sudo pi-ws")

the script doesn't run
Code: Select all
sudo pi-ws

it is just echoing back the command
New Users, Read This
OS Ubuntu 14.04, Arch Linux, Gentoo, Windows 7/8
https://github.com/metulburr
steam
User avatar
metulburr
 
Posts: 1416
Joined: Thu Feb 07, 2013 4:47 pm
Location: Elmira, NY

Re: os.system("echo sudo pi-ws") doesn't ask for password!

Postby thevdm » Thu Nov 21, 2013 12:36 pm

Thank you for a very quick and helpful response.

I have changed the code to:

Code: Select all
import os, sys, colorama, subrocess, shlex
from colorama import Fore

#Check if the script is being run as root or SU
if not 'SUDO_UID'  in os.environ.keys():
    subprocess.call('clear')
    #Let the user know that this script needs to be run as root
    print (Fore.MAGENTA + "Due to the nature of this program it requires root priveliges.\nTry running 'sudo pi-ws_configure'\n")
    #Ask if the user would like to quit to the terminal or attempt to run the script as root
    option = raw_input (Fore.WHITE + "\t1: Run Pi-WS as root\n\t2: Quit to the terminal\n\n>> ")
    if option == "1":
        #Run 'sudo pi-ws'
        subprocess.call(shlex.split("sudo pi-ws"))
    else:
        #Exit to the terminal
       sys.exit(1)


and it is now working as desired :D

No doubt I'll be back again soon with another problem that google doesn't solve, and once it's complete I will share the script.

Thank you
Jim
thevdm
 
Posts: 5
Joined: Thu Nov 21, 2013 12:01 pm
Location: Kent, United Kingdom


Return to General Coding Help

Who is online

Users browsing this forum: Bing [Bot] and 5 guests