sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
As @danzel mentions in a comment to this answer, make sure the script is not writable by
www-data
or else a bug allowing users to modify somehow means you are giving full access on the OS to anyone who has access to the webpage.
When you open a PHP page in your browser, that script will not run with your user. But instead, it's using the www-data
user.
You need to add the www-data
to the sudoers files to make the sudo command work without a password, not your user.
However, this is very dangerous as you are giving sudo access to your web server, and especially if this is an environment that can be accessed by anyone. If there's another way to execute the script without sudo, that should be your solution.
If not, give access only to that specific script, and not ALL
commands!
www-data ALL=NOPASSWD: /path/to/your/script
The following is probably even worse practice than the previous to set up for a web server user, but I will leave it for your judgement as it's part of the question. When you run sudo -S ...
, the command will be expecting the input from stdin
without the need for a prompt in the terminal. So the command would need to look like one of:
echo $PASSOWRD | sudo -S /path/to/command
sudo -S /path/to/command < password.secret