Re: system level adduser - repost

On Fri, 16 Jun 2000, John Hogan wrote: > I posted this last night, too late for all you gurus to respond. Here's > what I had to say: > > We're creating a webmail application using U-Wash IMAP. The user fills out > a signup form to get an account. We want to add the user in real time, > giving them access to their account immediately. > > The best idea right now is to loop through the /etc/passwd file, looking > for the existence of a system username. If the selected name is not on the > list, we'd like to add it (probably using 'system()'). > > Would anyone care to comment on the security and procedure of adding system > users from a php script? > I don't think that a too good idea to change passwd from a php program. First of all apache has no right to change passwd because it runs as nobody user. Of course you can do a setuid program for adding users. If you need users only for mail, I suggest using cyrus imap server. With cyrus you don't need to make real users and you can create users from php using admin user/password (wich has nothing to do with root account). Mache