Altering users passwords

[4site]

Happy New Year and all that!

I'd like to write a short PHP script that will allow users to alter
their virtual server password via a secure web form. I had hoped that
I might be able to call the shell passwd command from PHP, something
like this:

exec( "passwd -O $oldpassword -P $newpassword $username" );

but of course that doesn't seem to work.

Is it possible to execute the passwd command silently, ie without the
shell prompting (twice) for New Password? Or should I be looking in
another direction altogether - perhaps by editing the
/usr/local/etc/passwd file instead, yes?

Some advice would be greatly appreciated, thanks.

[Daemon]

Re: Altering users passwords

4site wrote:[color=blue]
> Happy New Year and all that!
>
> I'd like to write a short PHP script that will allow users to alter
> their virtual server password via a secure web form. I had hoped that
> I might be able to call the shell passwd command from PHP, something
> like this:
>
> exec( "passwd -O $oldpassword -P $newpassword $username" );
>
> but of course that doesn't seem to work.
>
> Is it possible to execute the passwd command silently, ie without the
> shell prompting (twice) for New Password? Or should I be looking in
> another direction altogether - perhaps by editing the
> /usr/local/etc/passwd file instead, yes?
>
> Some advice would be greatly appreciated, thanks.
>[/color]

You will need to ensure that you are root, or someone with enough
permission, and second, neither is suggested!

I attempted to do the same in a BASH script, and was strongly suggested
to quitthe attempt! Oh, it may be a better idea to use system('');

[Daemon]

Re: Altering users passwords

4site wrote:[color=blue]
> Happy New Year and all that!
>
> I'd like to write a short PHP script that will allow users to alter
> their virtual server password via a secure web form. I had hoped that
> I might be able to call the shell passwd command from PHP, something
> like this:
>
> exec( "passwd -O $oldpassword -P $newpassword $username" );
>
> but of course that doesn't seem to work.
>
> Is it possible to execute the passwd command silently, ie without the
> shell prompting (twice) for New Password? Or should I be looking in
> another direction altogether - perhaps by editing the
> /usr/local/etc/passwd file instead, yes?
>
> Some advice would be greatly appreciated, thanks.
>[/color]
However...

If you are sure what you are doing is the best, and you entrust PHP. I
would turn the passwd file into a large array! Or use it by line thus
ensure the intregrity of your data in case the file becomes exessivly
big! To parse the lines, use $data = explode($line, ':'); "I think!!"

Besure you limit the access to such a script, to many loads at the
sametime, without locking the file, it may cause the file to become
corrupt indefinitly!

Though, how are you going to give PHP that much power over your system,
as root is the only user with writeable flag! (Or it should be!)

[Colin McKinnon]

Re: Altering users passwords

4site wrote:[color=blue]
>
> I'd like to write a short PHP script that will allow users to alter
> their virtual server password[/color]

WTF is a 'virtual server password'?
[color=blue]
> via a secure web form. I had hoped that
> I might be able to call the shell passwd command from PHP, something
> like this:
>
> exec( "passwd -O $oldpassword -P $newpassword $username" );
>[/color]

OK, I guess you mean the Unix/Linux password, probably via PAM.

To change *any* password, you need to be root to have enough permission -
and you need to keep root well seperated from your web server. It is
possible - but honestly - I just would not go there. If you only want to
allow vaildated users to change their own passwords, then life's a lot
simpler and safer (but still - make sure you understand the implications).

Use proc_open to run su -c passwd $username@local host (or ssh
user@localhost, followed by passwd).

Alternatively write your own porgam in C using the PAM libs and set it to
run setuid root (not recommended).
[color=blue]
> but of course that doesn't seem to work.
>
> Is it possible to execute the passwd command silently, ie without the
> shell prompting (twice) for New Password?[/color]

No. There are variants - don't use them.
[color=blue]
> Or should I be looking in
> another direction altogether - perhaps by editing the
> /usr/local/etc/passwd file instead, yes?
>[/color]

Not a good idea.

C.

[4site]

Re: Altering users passwords


Colin McKinnon wrote:
[snip][color=blue]
> WTF is a 'virtual server password'?[/color]

No need to be offensive!

[snip]
[color=blue]
> OK, I guess you mean the Unix/Linux password, probably via PAM.[/color]

You guessed correctly - but WFT is PAM?

[snip]
[color=blue]
> If you only want to
> allow vaildated users to change their own passwords, then life's a lot
> simpler and safer[/color]

....than what? And, yes, I do only want to allow this for vaildated
(sic) users.
[color=blue]
> (but still - make sure you understand the implications).[/color]

I know that I need to be careful, thanks :(
[color=blue]
> Use proc_open to run su -c passwd $username@local host (or ssh
> user@localhost, followed by passwd).[/color]

OK, now we're getting somewhere - I'll have a go at using proc_open
when my brain's in gear again tomorrow and I can get my head around
using pipes...
[color=blue]
> Alternatively write your own porgam in C using the PAM libs and set it to
> run setuid root (not recommended).[/color]

I don't know how to write C porgams (sic) !
[snip]

Thanks for your help.

[Steve]

Re: Altering users passwords

On Sun, 01 Jan 2006 20:44:29 +0000, Daemon wrote:
[color=blue]
> 4site wrote:[color=green]
>> Happy New Year and all that!
>>
>> I'd like to write a short PHP script that will allow users to alter
>> their virtual server password via a secure web form. I had hoped that
>> I might be able to call the shell passwd command from PHP, something
>> like this:
>>
>> exec( "passwd -O $oldpassword -P $newpassword $username" );
>>
>> but of course that doesn't seem to work.
>>
>> Is it possible to execute the passwd command silently, ie without the
>> shell prompting (twice) for New Password? Or should I be looking in
>> another direction altogether - perhaps by editing the
>> /usr/local/etc/passwd file instead, yes?
>>
>> Some advice would be greatly appreciated, thanks.
>>[/color]
> However...
>
> If you are sure what you are doing is the best, and you entrust PHP. I
> would turn the passwd file into a large array! Or use it by line thus
> ensure the intregrity of your data in case the file becomes exessivly
> big! To parse the lines, use $data = explode($line, ':'); "I think!!"
>[/color]
Not necessarily. Because the world and his dog need read access to
/etc/passwd, the password itself is usually stored in /etc/shadow.

Steve

[Shelly]

Re: Altering users passwords

Side issue that just occurred to me:

I store the user's password for an app in mysql in md5 encrypted form.
Since php is run on the server, does this mean that the unencrypted
password is actually passed over the net? I assume that it is the
unencryted password that is used in the
passwd -O $oldpassword -P $newpassword $username
command.

Assuming I am correct, wouldn't sending the bare password over the net
pose a security breach? If so, how do all those web apps secure
things?

As another aside in this topic, couldn't the app (not running as root)
simply put a short file into a specified area and a cron job be running
to pick it up and to the root priv things (and then delete the file)?

Shelly


Shelly

[Juha Suni]

Re: Altering users passwords

> I store the user's password for an app in mysql in md5 encrypted form.[color=blue]
> Since php is run on the server, does this mean that the unencrypted
> password is actually passed over the net? I assume that it is the
> unencryted password that is used in the
> passwd -O $oldpassword -P $newpassword $username
> command.
>
> Assuming I am correct, wouldn't sending the bare password over the net
> pose a security breach? If so, how do all those web apps secure
> things?[/color]

By using SSL and thus encrypting all traffic between the client and the
server.

--
Suni

[4site]

Re: Altering users passwords

Shelly wrote:
[color=blue]
> I assume that it is the unencryted password that is used in the
> passwd -O $oldpassword -P $newpassword $username
> command.[/color]

NB I was hoping for a command *like* this - but, of course, it is NOT
the correct syntax for passwd.

[4site]

Re: Altering users passwords

After a little research into proc_open and pipes, I've re-worked a
function written by 'mendoza', found in the online PHP Manual at
http://www.php.net/manual/en/function.proc-open.php.

With some judicious form data error checking, this actually works:

function authenticate($u ser,$old_passwo rd,$password) {
$descriptorspec = array(
0 => array("pipe", "r"),
1 => array("pipe", "w"),
2 => array("file","/tmp/error-output.txt", "a")
);

$process = proc_open("pass wd ".escapeshellar g($user), $descriptorspec ,
$pipes);

if (is_resource($p rocess)) {
fwrite($pipes[0], $old_password." \n");
fwrite($pipes[0], $password."\n") ;
fwrite($pipes[0], $password."\n") ;
fclose($pipes[0]);
fclose($pipes[1]);
$return_value = proc_close($pro cess);
return !$return_value;
}
}

Thanks to Colin for pointing me in the right direction...

[Craig H.]

Re: Altering users passwords

On 02/01/2006 12:44, Shelly wrote:[color=blue]
> Assuming I am correct, wouldn't sending the bare password over the net
> pose a security breach? If so, how do all those web apps secure
> things?[/color]

SSL/TLS