How to change unix passwd

Anon

How can I chnage unix password on www page, using php3 ?
Or where can I find code fro this ?

Thanks

Anon

First, chaning passwords from web-enabled scripts is VERY dangerous!

But you could do it like this:

<?
EXEC(" echo 'new_password ' | passwd --stdin user_name")
?>

Anon

I know, that ist's dangerous, but when I have pop3 users I have to give him a chance to chnage passwd.
So I must to do it.
But I serach to best idea .🙂

0zeh

Anon

Hi Vincent,
I tried your code but it is not working. I think I need to login as 'su' first before exe this php script but how do u do that? Please help.

Vincent wrote:

First, chaning passwords from web-enabled scripts is VERY dangerous!

But you could do it like this:

<?
EXEC(" echo 'new_password ' | passwd --stdin user_name")
?>

Anon

Yup. Only root can change other users' passwords.

You can make an other script that generates a list of users and their new passwords.
Then you can have a script that reads that file and puts the values in the example above and executes it.
If you stick that second script in the crontab of root, it will run as root and update the passwords.

Anon

Vincent,

The passwd command will prompt you twice for entering the new password.

<?
EXEC(" echo 'new_password ' | passwd --stdin user_name")
?>

i tried the above piece of code and i get bad conversation error.

Please help!
Thanks

Dan wrote:

Hi Vincent,
I tried your code but it is not working. I think I need to login as 'su' first before exe this php script but how do u do that? Please help.

Vincent wrote:

First, chaning passwords from web-enabled scripts is VERY dangerous!

But you could do it like this:

<?
EXEC(" echo 'new_password ' | passwd --stdin user_name")
?>

Anon

If you use the --stdin command it won't ask twice for a password, that's the beauty of it.

What platform are you running on?

overlordhu

Hi,

There is some additional info on this article.
First up, I haven't checked the syntax of the above script, but I have a better way to solve the SU->root problem than putting some 'unreliable' scripts into crontab. It's easy to hack them, you know...

You have to install the SUDO package, which is a standard one on most (if not every) *nix box.
Then read the manual how to create /etc/sudoers file.
You can enable your apache user (for example www-data) to execute /usr/bin/passwd then.

If you want further info, contact me.

Best,

OveLord.

[deleted]

"You can enable your apache user (for example www-data) to execute /usr/bin/passwd then"

SUDO is definately NOT the solution if we're talking about changing a un*x user password.

This is a restricted operation that the webserver should most definately NOT be able to do.

overlordhu

Hi,

I know it's a security risk, but not definitely a leak on any system, I think.
If you configure /etc/sudoers according to the manual, and heavily use its features, you can make a quite stable system using SUDO.

BTW do you have any other kind of solution to the problem that can work ?

Best,

OverLord

[deleted]

First of all, I would never ever give password-changing access to a web interface in the first place.

If I had to, the solution I would use is to store all the changes in a textfile, and have a script in the root crontab make the changes. The idea of having a webserver that is capable of changing user's passwords... ieuw...