|
Home
| pfodApps/pfodDevices
| WebStringTemplates
| Java/J2EE
| Unix
| Torches
| Superannuation
|
| About
Us
|
|
|
Freebees
|
This series of pages shows ISP's how to set up a webpage to allow users to change their login password. The actual password changing is done by the operating system's own passwd program. A web page collects the user's ID and existing and new passwords and calls a perl CGI program which performs some verification and then calls a modification of Eudora's password changing program to change the change the password and return the results (or error messages) to the user on a webpage.
The following code is available to freely use and modify, provided all copyright notices are maintained, Forward Computing and Control Pty. Ltd. is not liable for any claims for damages etc. arising from use or malfuction of this software and sites using this software acknowledge Forward Computing and Control as the source and provide a link to Forward Computing and Control (http://forward.com.au) and to the Central West Web (http://www.octec.org.au). The positions of these links is left to the discretion of each webmaster
NOTE: The CGI program runs as root as does the C program that calls the operating system's own passwd program. This should set off alarm bells and you should be very careful about where you put these programs and their file permissions.
The C program needs to run as root so it can suid to the user's ID before calling the system passwd program. The CGI program runs as root on our system because Solaris' compilation of Perl 5 would not let me suid to root from within the perl program. A small C wrapper file suid's to root before calling the actual CGI file. It is this wrapper that is actually called by the webpage.
Please check the programs carefully before using them and let me know if you find any security holes. This comment has been recieved.
The following links contain the necessary code to set up the webpage and support programs.
Webpage to collect user's changed password (add your own images)
Perl CGI file to process webpage data and return results
Webpasswd C program to call operating system's own passwd program after first changing user id to the user in question.
Refer to Conditions of Use
The following comment was received from Tim Cross - School of Mathematical
and Computer Sciences
University of New England N.S.W. Australia - EMAIL tcross@turing.une.edu.au
Matt, I was just having a look at your web based password changing program and had a small security concern I thought I'd mention. There may be a potential security risk with passing the old and new passwords on the command line to the poppasswd program. It is fairly easy to find out the command line arguments that have been passed to a program (e.g. ps, /proc etc) and therefore it would be possible for a user to see another users password as it is passed to poppasswd. This may only be a small risk and perhpase not a problem if none of your users get shell accounts, but I thought it was probably worth mentioning.
A possible way of avoiding this might be to have the perl script write
the passwords to a tmp file (only readable by root) and have the poppasswd
program read from that file (pass the name of the file as an argument).
This is a bit of a kludge but would at least avoid passwords being passed
on the command line.
TX
Reply -----------------------------------------------------------------------------
In our case there are no users with shells, but you may wish to make
the changes if you have users with shells.
The problem with a tmp file is either you have to make it unique for each
instance of the CGI program or you have to have file locking and only allow
one user to change their password at a time. A preferable way is to pipe
the input to the poppassswd perl file from the CGI file rather then pass
the user name and passwords in the argument list. This change is left as
an exercise for the implementor.
MPF
Contact Forward Computing and Control by
©Copyright 1996-2020 Forward Computing and Control Pty. Ltd.
ACN 003 669 994