SuperUser Privileges

[Anon]

Hi Again

Is there a way in PHP to call normally SU level functions given that I actually know the root password because I manage the server.

I want to call the "usermod" command to change a user's /etc/passwd password but I don't want to unprotect the file and then read and write it (very dangerous).

I want to do this so my users can change their own passwords instead of ringing my support desk and getting my staff to do it.

Any ideas?

James

[Anon]

hi james,

try it to solve it with a cron job!
it's afaik the most secure solution for this problem...

cu pete

[Anon]

Thanks

You mean like an old-style transaction processing system from the mainframe days, put it in a queue and let a root based cron run down the list.

Yeah, I guess this could work if I ran the cron every 5 mins for example because I can do all the verification in the form and just stick the crypt version of the password into the transaction file for added security.

Does that sound about right?

I've actually seen the real-time version done on those horrid Cobalt RAQ servers but can't figure out how they've done it without relaxing permissions all over the place - then again it does run on RedHat which is like swiss-cheese for security anyway.

Cheers
James

[Anon]

I seem to remember someone mentioning that they would have another apache installed on a certain port, or only accessible on the machine, not from outside. this apache and php runs as root and you refer any scripts that need to run as root to it. Is this a viable solution? Just for my sake, as I'm curious, what are the pros and cons of this?

---John Holmes...

[Anon]

Hey John

I didn't think of that possibility, realistically, if you observe the RAQ, it actually refers to a site running on Port 81 after you've logged in, as long as you restrict the data that can be passed around and build some form of auth scheme so that you can't bookmark a script or post to it from the outside then any PHP script could shell to a command like "usermod" as it saw fit.

I'll have a go at this and post a reply soon.

James

[Anon]

John

You were right, the cobalt server runs an extra httpd process called "ahttpd" running on port 81 and as you said runs as root.

It uses .htaccess files to protect the access so you can't just post to it to automate it in its current form and if you contact their support, surprise, surprise, they tell you it will invalidate the warranty.

This means that a PHP web server admin system can be built but using true unix native shell commands in the background, which was the whole point of this thread in the first place because that's the project i'm on at work next.

Thanks for the pointer, if you have anything you want to run by me about anything, drop me a mail to "[e-mail]".

Cheers
James