Re: [gentoo-embedded] script that changes password for busybox

[Ned Ludd <solar@gentoo.org>]

On Mon, 2006-06-05 at 16:45 +0200, Natanael Copa wrote:
> On Mon, 2006-06-05 at 10:28 -0400, Ned Ludd wrote:
> > On Sun, 2006-06-04 at 20:32 +0200, Natanael Copa wrote:
> > > Hi!
> > >
> > > I'm trying to port a LEAF bering based project to gentoo-embedded. There
> > > is a web based UI (using haserl.sourceforge.net) to change password. The
> > > code to change the root password looks something like this:
> > >
> > >           newrootpw=$(crypt sN "$root1")
> > >                 awk '
> > >                    BEGIN{
> > >                         FS=":";
> > >                         OFS=":";
> > >                         }
> > >                    /^root:/{
> > >                         $2="'"$newrootpw"'";
> > >                         }
> > >                    {print;}
> > >                 ' /etc/shadow > /tmp/shadow
> > >
> > >                 mv /tmp/shadow /etc/shadow
> > 
> > 
> > Despite all of the security problems with the above I think
> > a ~20 line custom c program for this would be ideal.
> 
> I was hoping for a solution without any coding, but yes, I'll probably
> end up with a custom c program. (I think somebody already did actually -
> just to get going)

the vchangepw util might be able to work on system auth.

> about the security problems, any suggestion how to change passwords
> securely from web interface? (https)

I have no idea what auth system you are using so it's hard to say.

But clearly the problem with the above awk script other than the
obvious /tmp race condition is that it would leave the shadow 
file as mode 644 vs 600

> --
> Natanael Copa
> 
-- 
Ned Ludd <solar@gentoo.org>
Gentoo Linux

-- 
gentoo-embedded@gentoo.org mailing list