Change Linux user password with php script

Question

I have a “simple” question: how can I safely change the user password from a PHP script without granting Apache administrator privileges or not introducing other crazy security holes?

Background: CentOS 6, Apache 2.2.13, PHP 5.3.3

I am aware of the pam_chpasswd () command, which is part of the PECL PAM library. However, this function fails if the host process (httpd) does not have access to the / etc / shadow file. (BAD IDEA! Do not know how this library helps if it requires such high privileges ...)

The ideal situation, as far as I see, is for PHP to call the shell script with 'sudo -u [username of the user changing the password] This will lead the user to the script "AS", so he must have permission to change his own password. And sudo will require the user to send their existing password in order to authenticate, thereby preventing one user from changing the password of another user.

But this does not work for some reason ... when opening a process with popen, the process never runs. I have a shell script installed to upload some text to a public file in / tmp. But it never comes to that.

$cmd = "/usr/bin/sudo -S -u$username /file_to_execute.sh"; $handle = popen ($cmd, "w"); // Open the process for writing fwrite ($handle, "$current_password\n"); // Send the user current password to sudo (-S option) fwrite .... (write the username, current password, and new password, so the script can change it) $result = pclose($handle); 

If I access this php script (http: //server/script.php), the function immediately fails, and $ result = 1

If I modify the sudoers (visudo) file and add the line:
$ Default: apache! requiretty

script freezes for about 10 seconds, then crash ($ result = 1)

Any suggestions for this are greatly appreciated!

Answer 1

To achieve the above with regard to security, I would suggest either using expect or adding an Apche user to a group that has write access to the specified file and only the specified file.

We expect that you will need to add your sudo password, because it will listen for a response from the Password: OS, and when it is noticed, it will automatically respond with the sudo password. This will allow you to combine shell_exec() and the family with expect to achieve your results.

I would go the second security route, which would use group permission to write to a file for a group that has write access to that file only.

Example:

 groupadd secure_apache usermod -G secure_apache apache_user chown owner:secure_apache /tmp/file_to_change chmod 740 /tmp/file_to_change 

Answer 2

A safer way to do this is to save the username and password in a file in a special directory and let cron do the job (once per minute)