On Mon, 2006-06-05 at 16:45 +0200, Natanael Copa wrote:
> On Mon, 2006-06-05 at 10:28 -0400, Ned Ludd wrote:
> > On Sun, 2006-06-04 at 20:32 +0200, Natanael Copa wrote:
> > > Hi!
> > >
> > > I'm trying to port a LEAF bering based project to gentoo-embedded. There
> > > is a web based UI (using haserl.sourceforge.net) to change password. The
> > > code to change the root password looks something like this:
> > >
> > > newrootpw=$(crypt sN "$root1")
> > > awk '
> > > BEGIN{
> > > FS=":";
> > > OFS=":";
> > > }
> > > /^root:/{
> > > $2="'"$newrootpw"'";
> > > }
> > > {print;}
> > > ' /etc/shadow > /tmp/shadow
> > >
> > > mv /tmp/shadow /etc/shadow
> >
> >
> > Despite all of the security problems with the above I think
> > a ~20 line custom c program for this would be ideal.
>
> I was hoping for a solution without any coding, but yes, I'll probably
> end up with a custom c program. (I think somebody already did actually -
> just to get going)
the vchangepw util might be able to work on system auth.
> about the security problems, any suggestion how to change passwords
> securely from web interface? (https)
I have no idea what auth system you are using so it's hard to say.
But clearly the problem with the above awk script other than the
obvious /tmp race condition is that it would leave the shadow
file as mode 644 vs 600
> --
> Natanael Copa
>
--
Ned Ludd <[EMAIL PROTECTED]>
Gentoo Linux
--
[email protected] mailing list
