Re: [TCLUG:19575] Web based password updating

[Clay Fandre <cfandre@maddog.mn-linux.org>]

Luke Francl wrote:
> 
> On Wed, 12 Jul 2000, Clay Fandre wrote:
> 
> > "Seth I. Bernsen" wrote:
> > >
> > > A while back I heard mention of a way to allow users to change their
> > > password via a canned web interface?  Does anybody remember the
> > > details?  Thanks.
> >
> > At Honeywell I created a simple perl CGI web form that did this.
> 
> Be careful with security though. Use SSL, and make sure your script
> doesn't let the user execute arbitrary commands on the machine!
> 
> Did your script at Honeywell switch user to the person who was doing the
> change, then run passwd, or did it edit the password file directly? I'm
> just curious.
> 
> Luke

It was basically a front-end to /usr/local/bin/passwd.
/usr/local/bin/passwd was a perl script that did a LOT more checking
that the default passwd program does. (It is based on the passwd program
in the Programming Perl 1st ed., page 286). This script allows you to
specify other users as a command-line option.

Clay