Hi: I need to run a shell command from a perl script. I found this: http://kobesearch.cpan.org/...s/perl/Shell.pm.html but I can't seem to get it to work. What I want to do is insert an IP address into ipfw... I want to run: /sbin/ipfw add 25002 deny ip from $ip to any; where $ip is a variable. Any ideas? Thanks! Dave
dave

Big Cartoon DataBase
Big Comic Book DataBase

That package is for, as it says, transparently running commands on the shell. You require the package and import whatever programs you intend to use, and you will be able to use other programs as functions. Shell actually pipes the programs using 'open', e.g.,


Do you really need to be able to run /sbin/ipfw as ipfw? (If you do, you will need to ensure that /sbin is in your search path.)
You could perhaps use something like this (that doesn't invoke a shell to process your command):



Note that 'system' returns the return code of the subprocess (which is also stored in $?) and that a return code of 0 indicates success. Other return codes usually indicate some sort of error, failure, negative result, or some other non-success status. These should be defined in the program's man page.

If you need more control than just system provides (or don't want your program to block), see perlipc in perldoc.

mkp:

Thanks- I think I almost have it!!!

As I think you can see, I want to block certain IP's when they match certian rules... you can probably guess the type. Unfortunately, ipfw seems to only be runable by root. I am getting ipfw: socket: Operation Not Permitted errors.

Currently, I just write the bad IP's to a text file, and have a cron job every minute update them into ipfw. It works, but it probably is not all that good to have an every-minute cron job. SO I was trying to modify the file that writes the ip to a file to put the ip directly into the ipfw blcok.

SO can I have this perl script run as root so it can add to ipfw? Or what ideas do you have to get this sort of thing running?

Thansk!
dave

Big Cartoon DataBase
Big Comic Book DataBase

I see a few possible answers (none of which are really all that great):

You could have the cron job run hourly or daily. Does it really matter if those IP addresses are blocked immediately? (I can't answer that.)

You could have your program run as a user with proper privileges to control the firewall and nothing else. That might require a lot of tinkering and your firewall might not even allow it.

If you have your program run as root (or it's a suid program -- which is disallowed almost universally), you'll want to vigorously follow a couple simple rules: do only what is necessary and make sure nothing can go wrong. This program would do only one or two things (to reduce the likelihood of vulnerabilities), run other programs (as other users) to do real work, test the results of those programs to adhere to strict requirements (instead of testing for possible exploit attempts, test to make sure you are expecting that result -- i.e., if you are expecting an IP address, make sure it really is an IP address), you want to use as few external deps as possible, and you want it to enforce certain requirements.
You'd want it to be owned by root, only readable, writable, and executable by root, etc. Also, the other programs should be owned by their respecive owners and only readable, writable, and executable by them. (And remember to chroot where advantageous.)

Of course, if this program is being invoked by another, you might not be able to get it to run as root in the first place.


If I were to do the last, I'd make it a shell script no greater than 30 or so lines (20 of which would be checking input, verifying ownership and permissions, and the like). But even that really opens up your system to potentially nasty exploits if there are any. So really the second option is the best.


If you decide to make a setuid or setgid script, read perlsec first.

Well, here is what I am doing- my site is being over-run by referal-log spammers. It makes no sense, because my referal logs are not public... but who ever said that spammers are smart? ANyway, they hit every day, from maybe twenty different IP's- usually open proxies.

So I have long had a "honey=pot" script on my site which, when someone hits it, logs the IP, and puts it into an ".htaccess" block. Unfortunately, this still eturns something to the spammers (a 403), and still writes to the logs. So, I figured if I could just add the IP directly to ipfw, POOF- gone!

So, yes I DO want it added to ipfw immediately.

I think the script is fairly secure- it takes NO input from a user. It's only input is environmental variable {%HTTP_IP%} (or whatever). The script is also above the web root, so it is NOT runnable from the Internet. I think that it is pretty secure.
dave

Big Cartoon DataBase
Big Comic Book DataBase

You want the built-in "qx" quote-like operator.

http://perldoc.perl.org/...-%60-%60%60-backtick