passwd in a script

[Jim Tropiano_1]

Wrote a sript for our helpdesk to use to add user to the system. I know this is not best practice, but we have the script set as user root and the security of the program set so it will run as root. chmod 4750 'name of script'

The script except when we run the part to add the password. We Permisiion denied. In the script the lines say:

passwd ?{newuser}
passwd -f ?{newuser}

according to the man pages on passwd - A superuser whose effective user ID is 0 is allowed to change password.
I inserted id with the right option and 0 was the uid.

I run the script as root and it works fine. I run as another user I get the error.
Any suggestion????

[Kasper Hedensted]

Hi Jim,

I haven't got the solution to your problem;
But I think you should take a look at using a restricted SAM for your helpdesk. This way you can grant them rights to add users / change passwords / unlock users among other things.

if this is not an option, then take a look at sudo

Cheers,
Kasper

[Simon Hargrave]

Have your script run "id" before the passwd command - verify that the EUID is correctly set.

If it is not set, is the filesystem on which your script is stored mounted with nosuid option? Check /etc/fstab and output of mount command.

[Gavin Clarke]

Our helpdesk do passwords.

sam -r is the way we got it up and running.

[Gavin Clarke]

Yep, I've just added a user as a test using a normal user and sam access that was configured using sam -r.

[Mel Burslan · Accepted solution]

well, this may not be the answer you are looking for but instead of the help desk create a new password for each user, you can set few pre-expired passwords while you are running as root on some dummy accounts. Copy the hashed (encrypted) password strings into a secure file. And instead of running these two passwd commands, you can let the helpdesk rep select from these preset passwords and put their selection (in encrypted form of course) as the initial password to the newuse with command

/usr/sam/lbin/usermod.sam -p "Dx3zsaZS3q22." username

by changing the password hash to your own selected string.

hope this helps

[Tim Nelson]

We have our help desk use restricted SAM to run a script. The script controlls the userids that can be reset or modified. i.e. limit the ids so ids like root or any others specified cannot be changed.

[Jim Tropiano_1]

Thanks for all the responses. I got it to work for waht we needed.


Thanks to all.

[Jim Tropiano_1]

Thanks the script works