My shop uses a web interface to change user passwords on our ftp server (solaris 7). We use a perl program running suid root in the background to process work orders that are created by the web interface script. Just have the web interface write username and encrypted password to a file in a certian directory, and have the background process check that directory every few minutes. The bg process uses a temp file and careful file locking to make changes to /etc/shadow. If anyone has questions on the details, post back here and I'll do my best to answer them.