See merlyn's unintentional object lesson at http://www.lightlink.com/spacenka/fors/

Since I know very little about that I'm not sure how it relates.

If it makes you feel better this is what i'm doing: I'm a webmaster/system admin at a small ISP. This ISP wants users to beable to change their password through a secure web interface. I want to bypass system prompting. I figured out that I can use Net::SSH to connect to the correct systems as root and use echo to pipe the new password to passwd --stdin in one command. I know it might not be the best idea to login as root but I am using SSH with keys and its on our network (never goes outside) so I'm not too worried about it.

What I need is a way to verify that the user is giving me a correct old password. I originally thought of using Net::Telnet but of course that's not nearly as secure and it loses the ability to use a single commmand to change the password (since I would not use root over telnet).

I have authorization to do this, I've been asked to. I'm not worried about my employer suing me. Small companies don't have the money or time for such nonsense

Chris

Some clever or funny quote here.

You might be wasting your time as most password changes are the result of forgetting the password in the first place. Besides you want to hand out as little information as possible when it involves your security.

As to permission, do you have it in writing? The company may not sue you but they can always fire you. And people will tend to believe a company over an ex-employee.

You don't need to "see" the password to verify if the user knows it. See my node below or crypt. I am not a lawyer but I believe this is very different to running crack on a system.

--
my $chainsaw = 'Perl';

Thanks. The Shadow file is what i need (I do have access to it) however I can't seem to find it on CPAN. Know where I can get it?

Chris

Some clever or funny quote here.

Odd. I got it of cpan.. guess was a while ago

I know it was abstracted heavily from Unix::ConfigFile That may have smothing for you..

Looks like the Unix::PasswdFile might handle the shadow as well..
also CfgTie::TieShadow looks like it could make it easier.

as well the author is of Unix::ShadowFile is: Steve Snodgrass, ssnodgra-AT-fore.com
you can try him. if all else fails email me and i will send you the .pm i got

See perlfunc:crypt which has sample code to do exactly what you want. I have used it and it does work.

I would recommend you look into ssh forced commands if you are going to litter (pass-phrase less) keys to roots account around the place (or keys with the pass-phrase embedded in the script). At least that way if someone Ownz the box with the key they can only run the command you allow, although being able to reset passwords is bad enough! Make sure the forced command can only reset the password for allowed accounts- allow by uid range for example. Turn taint mode on for your forced command as well (-wT). Definately do NOT allow roots password to be reset this way! :)

I have used perl with open2 /open3 to the system ssh to send data across the network, open2/3 allows you to talk to stdin/stdout at the same time and passed parameters aren't visible from a local ps. Works well and you don't have to keep two versions of ssh (system & perls) up to date with security fixes.

I still think it is a bad idea though, it sounds like what you really need is NIS or LDAP. Your script then only needs admin privilege to NIS/LDAP and not to root.

Hope this helps

--
my $chainsaw = 'Perl';