helping in cgi script that add users to the system

adam_blackice · 04-11-2007, 02:49 PM

hello all ......,

i want to make a cgi program tha make me able to add and delete users

from the system and authenticate them with passwords using perl ....

so how can i think about this cgi script ??,,

i made some stuff that makes me able to access and print the contents

of the /etc/passwd file >>

PHP Code:



$passwd = "/etc/passwd"; 
open(PW,$passwd) or die "Can't open $passwd:$!\n"; 
while (<PW>){ 
        ($name,$passwd,$uid,$gid,$gcos,$dir,$shell) = split(/:/); 
    print; 
} 
close(PW);

and thanx

wjevans_7d1@yahoo.co · 04-12-2007, 08:12 AM

I'm not the best person to answer this question, but it's been just sitting here unanswered, so I'll jump in. And my reaction is:

Waitaminnit, waitaminnit. You're going to allow just anyone in the world to get to this web page and add users to your system? Do you realize the security implications of that?

I mean, there are ways to make this happen, and we can discuss those, but let's consider security first.

adam_blackice · 04-12-2007, 11:15 AM

there is another commercial stuff like webmin and virtualmin that available as open source for all iam wondering why any one donot answer this question ......

by the way thanx for sharing ideas

bigearsbilly · 04-13-2007, 04:13 AM

Quote:

there is another commercial stuff like webmin and virtualmin that available as open source for all iam wondering why any one donot answer this question

maybe because it sounds like a bad idea? (generally speaking, unless you know what you are doing).

well i would probably just qx/useradd blah blah/ or something like that
if i were that way inclined.

you can always look at the webmin source?

adam_blackice · 04-13-2007, 06:40 AM

Quote:

qx/useradd blah blah/

You mean that is perl ? !

by the way i cannot understand the webmin code

so if any one has a good idea just passing a parameters to /etc/passwd ？　

ａｎｄ　ａｎｙ　ｈｅｌｐ　ｗｉｌｌ　ｂｅ　ａｐｐｒｅｃｉａｔｅｄ

bigearsbilly · 04-13-2007, 07:26 AM

yes, that is perl

adam_blackice · 04-13-2007, 10:24 AM

so what it the qx ? ! itis function like system ?

or itis like qw /？

if it like qw what itis job and thanx

haxpor · 04-13-2007, 02:52 PM

You do not want to do it with 'useradd' right? but instead want to do it in the file.
Do it with 'useradd' command, it will finish in 1 step, it do it all for you but
Do it with the file takes more steps but will give more understanding what behind 'useradd' in some way.
So seperate in 2 case here, do it with the files and using command.

1.)The first case (do it with the file):

You can do it but it will involve another file too: '/etc/group' if you want to create user with depand on each group.
You add the new user by write the line with the correct form such as
'test:x:505:500:Test User:/home/test:/bin/bash' to the end of the file.
As i said you must change groupid in the 4th column to what group you have and want this user to be in.

You can create new group as follow,
look in the '/etc/group' file and then add new line like 'testgroup:x:500:' to the file.

Don't forget you must create folder for that user too. By use command 'mkdir /home/test' and change that folder to be owned by that user.

After you add the new user in the file (/etc/passwd) you must use command 'pwconv' to update '/etc/shadow' file telling system that you have added new user. NOTE that this command must execute before creating password is perform.

Almost done, at this point you create password for each user too. You do this by executing the command 'echo passwordfortestuser | passwd test --stdin', this command is benefit for that the process of the script will not be pause and waiting you to enter the password for each user again.

Now I make a sample of code here, as follow.

Code:

#!/usr/bin/perl -w

$newuser = "test";
$userpwd = "testpassword";
$userid = 900;
$usergid = 506; #Assume you already have groupid 506
$comment = "Test User";

open(FILE,'>>/etc/passwd');
$line = "$newuser:x:$userid:$usergid:$comment:/home/$newuser:/bin/bash";
print FILE $line;
close(FILE);

print `pwconv`; #Update /etc/shadow, to tell system that new user is added
print `mkdir /home/$newuser`;  #Make directory for 'test' user
print `chown $userid:$usergid /home/$newuser`; #Change owner
print `chmod 700 /home/$newuser`; #Change permission
print `echo $userpwd | passwd $newuser --stdin`; #Create passwd without prompting again.
print "Add User sucessfully\n";

For adding many users like hundreds or else, modify the code running in the loop with the username change relative to the counter in each round of loop (or something else).

2.)Second case (do it with command):
Although you can do man page 'man useradd' to see the parameter and options but I will show it here.

You can perform adding user by execute command 'useradd -g testgroup -s /bin/bash -c "Test User" -d /home/test test'. This will create user test with shell: bash, home-directory: /home/test, comment: Test User, in group: testgroup. It do almost all for you.
Then execute 'echo testpassword | passwd test --stdin'.

Following is the example of code:

Code:

#!/usr/bin/perl -w

#I make explicit declare for clarity
$user = "test";
$pwd = "testpassword";
$group = "testgroup";
$dir = "/home/$user";
$shell = "/bin/bash";
$comment = "Test User";

print `useradd -g $group -s $shell -c $comment -d $dir $user`;
print `echo $pwd | passwd $user`;
print "Add user successfully\n";

Do the system command in `` is for simple use but it will print the result from that command out. You can avoid it by using system() or exec() command instead.

adam_blackice · 04-13-2007, 06:04 PM

THANX MR. HAXPOR you was great

but i want to know ..

Quote:

print `mkdir /home/$newuser`; #Make directory for 'test' user
print `chown $userid:$usergid /home/$newuser`; #Change owner
print `chmod 700 /home/$newuser`; #Change permission

commands like mkdir , chown , chmod how it will be compiled by perl ?

or iam going to use system function ? ... \\

and thanx again

theNbomr · 04-13-2007, 08:02 PM

All of this works iff the web server runs as root (bad idea). Otherwise your CGI script will have to issue each command as

Code:

system( "sudo mkdir $dirName" );
system( "sudo useradd $userName" );
...

and sudo will have to be configured appropriately for the webserver process uid. Strongly recommend to at least use htaccess controls to limit who gets to use this.

--- rod.

adam_blackice · 04-14-2007, 08:41 AM

how it could be done by configure the uid for the root ?

and what about configuring the htaccess ?

theNbomr · 04-14-2007, 11:15 AM

If you are using an Apache web server, the answer to both of these questions is in your Apache documentation. If it is not installed with your web server, it is available online at http://httpd.apache.org/docs/. If you have any intention to run your web server as root, you must read and understand the documentation and all of the implications associated with doing that. This is an issue that affects everyone on the net; don't play fast and loose with things like opening up root access.

--- rod.

wjevans_7d1@yahoo.co · 04-15-2007, 09:27 AM

Quoth theNbomr:

Quote:

If you have any intention to run your web server as root, you must read and understand the documentation and all of the implications associated with doing that. This is an issue that affects everyone on the net; don't play fast and loose with things like opening up root access.

adam_blackice, theNbomr is not saying that this is an issue that affects everyone on the net who tries to run his web server as root.

He is saying that if you run your server as root without understanding and guarding against all your security risks, you affect all of us.

theNbomr, I am not putting words into your mouth, I hope.

theNbomr · 04-15-2007, 02:37 PM

Nope. Thanks for reinforcing my message, though.
--- rod.

bigearsbilly · 04-16-2007, 02:41 AM

FYI from perldoc perlop

Code:

     Quote and Quote-like Operators

     While we usually think of quotes as literal values, in Perl
     they function as operators, providing various kinds of
     interpolating and pattern matching capabilities.  Perl
     provides customary quote characters for these behaviors, but
     also provides a way for you to choose your quote character
     for any of them.  In the following table, a "{}" represents
     any pair of delimiters you choose.

         Customary  Generic        Meaning        Interpolates
             ''       q{}          Literal             no
             ""      qq{}          Literal             yes
             ``      qx{}          Command             yes*
                     qw{}         Word list            no
             //       m{}       Pattern match          yes*
                     qr{}          Pattern             yes*
                      s{}{}      Substitution          yes*
                     tr{}{}    Transliteration         no (but see below)
             <<EOF                 here-doc            yes*
: