CGI programming with shell scripts

Question

I need to pass the content of the textbox into a variable. i.e. whatever typed in the texbox of the html page needs to be pass to a variable. This is because I am calling HTML (CGI as well) inside linux shell programming. I need to manipulate that variable as I want. Do you have any idea to do it?

What I need to do is, I want to get the MAC address as an input from the user. i.e. we should have a HTML page with a text box, that user will be able to input the MAC address. therefore whatever user enters into the text box need to be passed to a variable.

Once we have the variable, this script will automatically add this MAC address into linux firewall to deny the access.

The code should be similar to the following:

!/bin/bash

echo "Content-type: text/html"

echo ""

echo ""

echo "enter the MAC address "

iptables -A INPUT -m mac --mac-source $mac_address -j DROP

service iptables save

service iptables restart

I will save this file (test.cgi) under /var/www/cgi-bin directory and I will run this script from firefox.

So the problem now I have the variable $mac_address. The CGI does not pass the textbox input into variable $mac_address.

Answer 1

Maybe this can help? http://oinkzwurgl.org/bash_cgi

Answer 2

First, read the CGI primer.

You will need an HTML page with code like this:

<form method="get" action="/cgi-bin/my-fw-script.sh">
    <p>Gimme an IP address: <input name="addr"></p>
    <input type="submit">Block IP</input>
</form>

When the user clicks the form's Submit button, your Bash CGI program will be run. (/path/to/cgi-bin/my-fw-script.sh in the above example.) The text input will be in the QUERY_STRING environment variable, in the form variable=value. For simple inputs, you could just call the Bash function eval to turn this into a Bash variable:

#!/bin/sh
eval $QUERY_STRING
echo You asked me to block $addr.

This will only work for a single input field, and will break if there are spaces or other special characters. I imagine the bash_cgi thing someone else recommended will take care of these details for you. Do it like the above example only if this program will stay very simple.

By the way, you almost certainly don't want to be adding MAC addresses to the firewall. That only works for hosts that are on the same LAN as the firewalled box. Packets coming from another LAN, the Internet, etc. will have the MAC address of the LAN's gateway. You should probably be blocking hosts by IP address instead.

Answer 3

The real answer to this question is don't.

Your web server seems to be running with root privileges. That is the first no-no.

Do you really want to allow the whole wide world to be able to tinker with your firewall configuration? You have no control over how your shell script gets invoked, what gets passed to it. You are opening major security holes.

See the WWW Security FAQ on CGI scripts and Writing secure CGI scripts as well as CGI Security : Better Safe than Sorry.