How to change an HP-UX password within a C progam

[Norman Wojtal]

Because our users never see a shell prompt (they are automatically put into a program) they can't run the passwd program to change their HP-UX password. Is there a way to allow them to change their password from within a C program without having to shell out?

[Christopher Caldwell]

Sure - you'd have to write the C program. The mechanism will depend on whether your system is trusted or untrused.

man 3 crypt
man 3 getprpwent (trusted)
man 3 getpwent (untrusted)

[Norman Wojtal]

The getprpwent functions gets info from the passwd database and crypt can generate a new password but how do I then update the passwd database?

[A. Clay Stephenson]

Actually you need to use the putpwent() function (or its trusted counterpart) to set the passwd entry after calling getpwent() to load the other fields but the other reequirement is that your executable must be a setuid program owned by root. This requires disciplined coding and practices to avoid security problems. If you happen to be an NIS or NIS+ environment, then there is a yppasswd() function that will allow a user to change his passwd from anywhere in the domain without being root.

[Shannon Petry]

You can simply swap strings in /etc/passwd from old to new, as long as you can generate the new password properly.


Attached is a good c program I collected, did not write. It has alot of nice goodies in it, which may help get you pointed in the correct direction.

Regards,
Shannon

[Steven Gillard_2 · Accepted solution]

Most utilities that do this perform a lockf() on /etc/.pwd.lock first, so make sure you do this otherwise you run the risk of race conditions with multiple password changes at the same time.

The following is a list of steps your program would need to do (assuming a non-trusted system):

* open and lockf /etc/.pwd.lock
* open /etc/passwd for reading
* open /etc/ptmp for writing (ensuring permissions are 444!)
* read each line from /etc/passwd and write it to /etc/ptmp until you find the one you're looking for. You could use fgetpwent/putpwent for this, as they take FILE* streams.
* when you find your line, use the crypt() function to replace the password field with the users new password.
* once you get to eof of /etc/passwd, close both files and rename /etc/ptmp to /etc/passwd
* release the lock on /etc/.pwd.lock and you're done.

And make sure there are no bugs in your code or you could find yourself with a broken system :)

Good luck,
Steve

[Christophe MAILHE]

Hi Norman,

If you want to change a user password from a none uncrypted password, try to include the code attached into your C application.

This code is only working for non-trusted system, but you can easily modify it for a trusted one if you want to by replacing calls to function like setpwent or getpwent by the equivalent for trusted systems (setprpwent, getprpwent, ...).

Chris.