Re: Editing /etc/passwd as a non-root user

[Chuck Peters <cp@xxxxxxxxxxxxx>]

On Wed, 6 Nov 2002, Haresh Motwani wrote:

> Actually, I need to edit /etc/passwd file thru a gui. The user will be
> asked to enter his username and current pwd along with the new pwd. On
> submit the script will validate the current pwd and then change it. For
> this I need to run a script which will be able to edit my /etc/passwd file.
> Obviously in this case the script would be running as user.

Try usermin, part of the webmin project.  webmin/usermin runs as root and
uses PAM to change the password.  Because it is a fairly mature opensource
project, its likely to have better security that a customized GUI.  That
being said, I don't put things like that on my servers!  Customer
requirments vary...

Depending on the requirements, I would setup some iptables rules so it
would only be accessible from specified IP's.  That would lessen the
chance of a exploit.

Chuck Peters, Systems Administrator, Network Engineer and Linux Tech.
StarrySkies Network, http://StarrySkies.com, publishing science articles
since 1995. http://StarrySkies.Net, an online science community.
http://StarryMessenger.Net, the weekly newsletter of StarrySkies.


>
> At 08:41 AM 11/6/02 -0500, you wrote:
>
>
> >Whoa, why do you need to do this?  it's generally a really bad idea.
> >If you need a user to edit his/her own info via this script, that's what
> >commands like passwd, chfn, and chsh are for.  Otherwise, only root should be
> >running something like this.
> >
> >--Andy
> >
> >
> >On Wed, Nov 06, 2002 at 12:49:43PM +0530, Haresh Motwani wrote:
> > > I need to read and edit /etc/passwd file thru a script which is running as
> > > a user.
> > >
> > > Can suEXEC do it? is there any other way of doing it.
> > >
> > >
> > > -- Attached file included as plaintext by Ecartis --
> > >
> > >
> > > ---
> > > Outgoing mail is certified Virus Free.
> > > Checked by AVG anti-virus system (http://www.grisoft.com).
> > > Version: 6.0.385 / Virus Database: 217 - Release Date: 9/4/02
> > >
> > >
> > > ------------------------------------------------------------------------
> > >      To unsubscribe email security-discuss-request@linuxsecurity.com
> > >          with "unsubscribe" in the subject of the message.
> > >
> >------------------------------------------------------------------------
> >      To unsubscribe email security-discuss-request@linuxsecurity.com
> >          with "unsubscribe" in the subject of the message.
> >
> >
> >---
> >Incoming mail is certified Virus Free.
> >Checked by AVG anti-virus system (http://www.grisoft.com).
> >Version: 6.0.385 / Virus Database: 217 - Release Date: 9/4/02
>
>
> -- Attached file included as plaintext by Ecartis --
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.385 / Virus Database: 217 - Release Date: 9/4/02
>
>
> ------------------------------------------------------------------------
>      To unsubscribe email security-discuss-request@linuxsecurity.com
>          with "unsubscribe" in the subject of the message.
>

------------------------------------------------------------------------
     To unsubscribe email security-discuss-request@linuxsecurity.com
         with "unsubscribe" in the subject of the message.