如何通过nginx/php执行bash脚本
我的目标是为希望将其站点添加到我的CDN服务()的用户自动生成SSL证书 下面是通过SSH工作的脚本,但当我试图通过php执行它时就不是了如何通过nginx/php执行bash脚本,php,bash,ssl,ssh,Php,Bash,Ssl,Ssh,我的目标是为希望将其站点添加到我的CDN服务()的用户自动生成SSL证书 下面是通过SSH工作的脚本,但当我试图通过php执行它时就不是了 exec("sudo sh /var/autossl $domain 2>&1", $output); 下面是bash脚本: #!/bin/bash domain=$1 # Set up config file. cat > /etc/nginx/sites/$domain.conf <<EOF server {
exec("sudo sh /var/autossl $domain 2>&1", $output);
下面是bash脚本:
#!/bin/bash
domain=$1
# Set up config file.
cat > /etc/nginx/sites/$domain.conf <<EOF
server {
listen 80;
server_name *.$domain;
root /var/www/$domain;
}
EOF
nginx -s reload
#########################################
set -o nounset
set -o errexit
mkdir -p /var/www/$domain
# Set up config file.
mkdir -p /etc/letsencrypt
cat > /etc/letsencrypt/cli.ini <<EOF
# Uncomment to use the staging/testing server - avoids rate limiting.
# server = https://acme-staging.api.letsencrypt.org/directory
# Use a 4096 bit RSA key instead of 2048.
rsa-key-size = 4096
# Set email and domains.
email = admin@hostcloak.com
domains = $domain
# Text interface.
text = True
# No prompts.
non-interactive = True
# Suppress the Terms of Service agreement interaction.
agree-tos = True
# Use the webroot authenticator.
authenticator = webroot
webroot-path = /var/www/$domain
EOF
# Obtain cert.
certbot-auto certonly
# Set up daily cron job.
CRON_SCRIPT="/etc/cron.daily/certbot-renew"
cat > "${CRON_SCRIPT}" <<EOF
#!/bin/bash
#
# Renew the Let's Encrypt certificate if it is time. It won't do anything if
# not.
#
# This reads the standard /etc/letsencrypt/cli.ini.
#
# May or may not have HOME set, and this drops stuff into ~/.local.
export HOME="/root"
# PATH is never what you want it it to be in cron.
export PATH="\${PATH}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
certbot-auto --no-self-upgrade certonly
# If the cert updated, we need to update the services using it. E.g.:
if service --status-all | grep -Fq 'apache2'; then
service apache2 reload
fi
if service --status-all | grep -Fq 'httpd'; then
service httpd reload
fi
if service --status-all | grep -Fq 'nginx'; then
service nginx reload
fi
EOF
chmod a+x "${CRON_SCRIPT}"
#####################################
# Set up config file.
cat > /etc/nginx/sites/$domain.conf <<EOF
server {
listen 80;
server_name *.$domain;
location / {
proxy_set_header x-real-IP \$remote_addr;
proxy_set_header x-forwarded-for \$proxy_add_x_forwarded_for;
proxy_set_header host \$host;
proxy_pass http://google.com;
}
}
server {
listen 443;
server_name *.$domain;
ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem;
ssl on;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;
location / {
proxy_set_header x-real_IP \$remote_addr;
proxy_set_header x-forwarded-for \$proxy_add_x_forwarded_for;
proxy_set_header host \$host;
proxy_pass http://google.com;
}
}
EOF
nginx -s reload
#/bin/bash
域=$1
#设置配置文件。
cat>/etc/nginx/sites/$domain.conf快速回答:在exec
函数中将sh
替换为bash
,或修改脚本以使用sh
说明:想想你在这里想做什么。您正在请求www数据(或您的Web服务器正在运行的任何用户帐户)发出sudo命令。它甚至可能没有su特权。即使是这样,当你第一次尝试使用sudo时会发生什么?你必须输入你的密码
您可以单独禁用密码要求,但我不建议授予www data sudo权限。让你的网站向数据库或其他东西添加请求,每隔几分钟从一个拥有su权限的用户那里作为cron作业进行一次轮询,并让该帐户执行su操作尝试过,但我得到了以下结果:Array([0]=>/usr/local/bin/autossl:line 6:/etc/nginx/sites/yoyyo.com.conf:权限被拒绝[1]=>/usr/local/bin/autossl:line 14:nginx:command not found[2]=>请求以root权限重新运行/usr/local/bin/certbot auto…[3]=>[4]=>我们相信您已经收到了本地系统管理员的常规讲座[5]=>通常归结为以下三件事:[6]=>[7]=>\1)尊重他人的隐私。[8] =>#2)打字前先想一想。[9] 权力越大,责任越大。[10] =>[11]=>sudo:no tty呈现一个…Hmmm,第一个错误可能是因为php/nginx拥有用户的其他特权,第二个原因是nginx命令不在php/nginx-bash的路径中。如何将其添加到php/nginx-bash的路径中?我不知道如何为没有主目录的用户添加,但您可以使用脚本提供nginx命令的完整路径,如/usr/bin/nginx
,或者你可以在系统范围内设置路径,例如在ubuntu中-段落系统范围的环境变量,或者你可以使用导出路径命令在脚本中设置路径。是的,这是一个更好的解决方案,一个简单的文件队列就可以了。是的,我在visudo中为ngixin添加了nopassword,但是,它仍然要求输入密码。我用php exec发布了“whoami”,它给出了nginx,但仍然要求输入密码tho.:(