topic Re: Script to change users passwords in Operating System - HP-UX

Script to change users passwords

Dadski — Fri, 15 Apr 2011 11:37:58 GMT

All, I am looking for a script that will allow users in a particular group to reset users passwords. I was thinking of using a SETGID on the script, but does anyone have such script?

many thanks

Re: Script to change users passwords

Mel Burslan — Fri, 15 Apr 2011 14:29:57 GMT

Your question is not very clear. Are you trying to give root permissions to a a non-root user to change the password of any user on the system. If this is your intention, please note that, running any script with root privileges by a non-root user is inherently dangerous and open to exploitations that you could never imagine existed. Having said that, why don't you look into using sudo and giving root permissions to run the passwd command to this non-root user. BUt beware, they can change the password for root and gain access to the system without anyone else noticing it, unless you have a bullet-proof auditing system.

Re: Script to change users passwords

Michael Mike Reaser — Fri, 15 Apr 2011 14:57:54 GMT

Bulding off of what Mel has said, you can design a script that reads an "access rights file" that lists the users allowed to invoke "passwd", and for each such user lists the *other* users for whom they're allowed to invoke "passwd". This file should be readable and writeable ONLY by root, and no one else on the system.

Have your script read this file, and if the invoking user "A" doesn't appear in the "access rights file" - or the user "A" doesn't have the right to change the password for user "B" - then exit the script with an error, else perform the "passwd" operation.

Set up this Master Wrapper Script in sudo, and you then not only are allowing non-root users to change the passwords of other users on the system, but you (as root) get to control who gets to change who else's password. Needless to say, you would NOT list "root" in this "access rights file" and thus wouldn't need to worry about someone changing root's password.

Re: Script to change users passwords

Dadski — Mon, 18 Apr 2011 07:42:50 GMT

Cheers Gents, I am aware of the issues with security and will lock the script down, unfortunately sudo is not a supported solution for security within our Infrastructure. I have written the script and will use ACLs or SETGID to run it.

Thanks

All

Re: Script to change users passwords

Dadski — Mon, 18 Apr 2011 07:56:33 GMT

thanks again