Re: Execl For Adding a User
From: Sachin Doshi (ssdas4eva_at_yahoo.com)
Date: 08/25/04
- Next message: Ara.T.Howard: "nfs client side application level 'hung lock' detection"
- Previous message: Torgny Lyon: "Re: how to do aliasing in sh shell"
- In reply to: joe durusau: "Re: Execl For Adding a User"
- Next in thread: Chuck Dillon: "Re: Execl For Adding a User"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: 24 Aug 2004 15:14:43 -0700
Joe, I appreciate the response.
As a point of reference, I am trying to give users SFTP only account
on the server. They will be chrooted and not have shell access (thus
no C/C++ compiler).
The user will transmit their password to me using public/private key
SSL. I then use the unix crypt function to encryt their password and
then use that result as an input value in useradd (-p).
I don't think that this is terribly insecure even in a networked
environment since the server only has sftp users ( and root can't
shell in either ).
Appreciate any input,
-Sachin
joe durusau <joe.durusau@lmco.com> wrote in message news:<412B2D96.C25576C6@lmco.com>...
> Sachin Doshi wrote:
>
> > Hi, new to the board - and new to unix programming. I am trying to
> > add a system user within C. Ran into a couple of posts on how to do
> > this. One of the guys suggested forking and then issuing an execl in
> > the child process that runs /usr/sbin/useradd.
> >
> > I did this, and had some interesting results. The first time the code
> > is run within my daemon code, it works fine - the user is added. The
> > daemon continues to run and waits for another request. Then on any
> > subsequent attempts to add a user, I get the error message, "Unable to
> > lock password file." The etc/passwd.lock file does indeed have the
> > PID of the previous child process. Is there a reason that the first
> > execl never released the lock?
> >
> > As a hack to fix this, I started using the system() call to do the
> > same thing and it works fine. I just wanted to make sure that this
> > was safe because I was told that there may be some security issues
> > when using a system() call.
> >
> > --Thanks in advance,
> > Sachin
>
> The larger issue is "How do you propose to set the password of the
> new user?" All of the tricks I know of are horribly insecure. There are
> situations, for instance in schools, that need to add thousands of users
> at once, in which the security issue can be handled by taking the network
> down, loading a program off a CD or some such, then erasing it when the
> mass changes are over. I would suggest that anything on a networked
> machine that adds users is very dangerous, and I would hesitate to allow
> it.
>
> Speaking only for myself,
>
> Joe Durusau
- Next message: Ara.T.Howard: "nfs client side application level 'hung lock' detection"
- Previous message: Torgny Lyon: "Re: how to do aliasing in sh shell"
- In reply to: joe durusau: "Re: Execl For Adding a User"
- Next in thread: Chuck Dillon: "Re: Execl For Adding a User"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
