Category: | Utility Scripts |
Author/Contact Info | Lacertus |
Description: | I am 'presiding madman' of a Chicago based LUG, and I thought it might be apropos to allow users who've no experience with a *nix shell to be able to create their own account on the public webserver. Essentially, I have created a password protect 'newuser' account, whose information I give out upon a member's registration so they can log in. The password file has no 'shell' per se for this 'newuser' accnt; rather, this script is the shell. Of course, you must be quite careful with something like this, and while I have addressed all the security issues that come to mind, I'm sure this script isn't vulnerability free. Feel free to contact me with questions/suggestions/patches (if yer real cool ;) The script allows for a newuser to create a username and assign a password of their choice; what's more, it logs all newusers, emails, etc, and also emails all this info to the administrator, so you can keep appraised of what's going down. Enjoy! Ciao for Now, Lacertus |
#!/usr/bin/perl -T ###################################################################### +##### ## Created by Pararox ## Rolled on 3/15/03 ## Perl 5.8.0, Slackware Linux ## ## downUnder.pl ## VERSION 1.03.00 ###################################################################### +##### $ENV{PATH}=''; use strict; use Email::Valid; use Term::ReadKey; use Mail::Send; # use constant LOG_FILE => "/home/newuser/downUnder.log"; my ($i, # general iterative value $valid, # basic true/false for input validity checking $make_account, # same as comply really, will merge $comply, # hold answer to yes/no questions $username, # user request for username $full_name, # user's full name $first_name, # user's first name $email, # user's email address $uid, # user's uid (next in '100' group on this system) $max, # for use finding max currently held UID $passwd, # user's request for a password $passwd2, # for password consistency checking $date); # precise time at which user added my $gid=100; # change to suit your system's needs my $shell='/bin/bash'; # user's shell, this is all I have on my box system ("/usr/bin/clear"); print "\nWelcome to the official server of the IIT Linux User's Group\ +n\n"; ###################################################################### +##### ## This could probably be removed. It's just making sure the user ## is ready to proceede with account creation. ###################################################################### +##### $i=0; do { print "Not an option!\n" if $i>0; print "Are you going to make a shell account now? (y/n): "; chomp($make_account = <STDIN>); ++$i; die "\nCiao!\n" if ($make_account eq 'n'); } while ($make_account !~ /^\s*y/i); # while input isn't 'Y|y' system ("/usr/bin/clear"); print <<END_OF_MSG; Ok here's the gig. I'm making this service, and everything associated with a shell account, freely available for your use, to do with as you please. It's my pleasure, and I hope you learn a whole lot. With this, comes responsibility on your part to use these tools in accordance with US laws and general morality. Simply, don't go hacking away at someone else's box, or do anything that will wind me up in jail. I might add as a side note that I log *everything* plus some, so don't do anything over the network that will make me suspicious. Also understand that, while this is my primary server, there are unexpected periods of downtime (generally attributed to the crappy network here at the school, and the strange electricity problems we have every so often). I promise absolute security with regard to your data; I can't promise complete integrity of the disks. There are occassional occurances of data loss, due to my mucking about, or some other such cause. Just bear this in mind. END_OF_MSG ###################################################################### +##### ## Making sure user complies with system rules; this one is importa +nt ## and I think that the above legaliase should be modified to be ## more specific, but for now, it will do ###################################################################### +##### $i=0; do { print "Not an option!\n" if $i>0; print "\nI fully understand/comply and respect the system (y/n): " +; chomp($comply=<STDIN>); ++$i; die "\nCiao!\n" if (($comply eq 'n') || ($comply eq 'N')); } while ($comply !~ /\s*y/i); # while input isn't 'Y|y' ###################################################################### +##### ## Start of the *main* do loop; this loop goes for quite a while ## and only drops into the final stages of the program once the use +r ## has reviewed inputs and agreed to creating the account with the ## given information. ###################################################################### +##### do { system ("/usr/bin/clear"); print "\nOf the following, NOTHING will be public but your usernam +e\n\n"; ################################################################## +# ## Getting user's fullname, for system records ################################################################## +# $i=0; do { print "\nYour full name is required!\n" if $i>0; print "(*) Your actual full name: "; chomp($full_name = <STDIN>); ++$i; } while ($full_name !~ /^\s*(\D+)\s+\D+\b/); # while not 2 distinc +t # non-space boundaries $first_name = $1; # for personalized output :) ################################################################## +# ## Getting user's current email address for system records only. ## Using the Email::Valid mod to make sure the format is valid and ## also that the domain name is valid (yes it runs a DNS query) ################################################################## +# $i=0; $valid=1; # setting to *invalid* status to begin with do { print "\nYour *valid* email address is required!\n" if $i>0; print "(*) Your email address: "; chomp($email = <STDIN>); ++$i; # -address (checks for validity), -mxcheck (DNS check) Email::Valid->address( -address=>$email, -mxcheck=>1) ? ($valid=0) : ($valid=1); } while ($valid); # while Email::Valid comes up as invalid ################################################################## ## Asking for and getting user's requested username for the ## system. Opening the passwd file in order to ensure user ## name requested isn't already taken. ################################################################## $i=0; print "\nThe following items are CASE SENSITIVE!\n"; do { if ($i>0) {print "\nYour username is required!\n";} elsif ($valid==1) {print "\nThat username is taken!\n";} print "(*) Your desired username: "; chomp($username = <STDIN>); ++$i; $valid=0; open PASSWD, "</etc/passwd" or die "Something has gone wrong: $!\n"; while (<PASSWD>) { /#*(\S+):x/; # getting usernames from file if ($username eq $1) {$valid=1; $i=0}; #invalid if match } close PASSWD; } while (($username !~ /^\s*\S+\s*$/) || ($valid==1)); #while blan +k ################################################################## +### ## Getting the user's desired password, which thru a regex mus +t ## be an alphanumeric between 6 and 100 characters in length. ## Using Term::ReadKey to switch stty -echo (which doesn't seem ## to work itself (stty that is), maybe because of do-while? ################################################################## +### $i=0; do { print "\n\nCommon! A *real* password, now (6 or more alphanum +erics)!\n" if ($i>0); print "\n\nPasswords don't match!\n" if ($valid != 0); ++$i; $valid=0; ReadMode 2; # Term:ReadKey (cooked mode,echo off) print "(*) Your account password (won't echo): "; chomp($passwd = <STDIN>); print "\n(!) Retype that password to make certain: "; chomp($passwd2 = <STDIN>); ReadMode 0; # Term:ReadKey (restore original settings) if ($passwd ne $passwd2) { $valid=1; $i=0; } } while ( ($passwd !~ /^\s*\S{6,100}\s*$/) || $valid); $passwd = crypt($passwd, time()); # encrypting for shadow, time() +seeded ###################################################################### +#### ## Outputting what the user has given me, making sure all is well. ## If user doesn't like, start from beginning (I'd like to implemen +t ## function calls for all of these input sections so that user ## can specify one particular area that needs to be amended, but fo +r ## now it'll suffice ###################################################################### +#### print "\n\n----------------------------------------------------------\ +n" . "Ok, $first_name, here is how you'll be entered into the system:\n +" . "Name: $full_name\n" . "Email: $email\n" . "Username: $username\n" . "---------------------------------------------------------\n\n"; $i=0; do { print "\nChoose a valid option to continue!\n" if ($i>0); print "Is this correct? Now is your last chance to bail! (y/n +): "; chomp($comply=<STDIN>); ++$i; } while ($comply !~ /^\s*(y|n)\s*$/i); } while ($comply !~ /^\s*y\s*$/i); ###################################################################### +###### ## Now we are checking for the next available UID on the system; no +w ## on this system UID's start at 100 for users, but this number may ## not be very portable across platforms, should put a DEF at begin +ning ###################################################################### +###### $max=100; open PASSWD, "/etc/passwd"; while (<PASSWD>) { chomp; if (/^#*\S+:x:(1\d\d):/) { $max=$1 if ($max<$1); } } close PASSWD; $uid=($max+1); ###################################################################### +### ## Actually making the system call to useradd, this is it baby! ###################################################################### +### system( '/usr/bin/sudo', '/usr/sbin/useradd', '-u'=> $uid, '-s'=> $shell, '-p'=> $passwd, '-g'=> $gid, '-m'=> $username ); chomp($date=localtime); # setting for log output ###################################################################### +###### ## Sending logged information to system administrator and putting i +nfo ## into a *hardcoded* log file within the 'newuser' ~ ###################################################################### +###### my $msg = new Mail::Send; $msg = new Mail::Send ( Subject =>'New User Added!', To =>'root'); my $fh = $msg->open; print $fh "Attention Administrator!\n\n" . "A new user has recently been added. Information follows:\n\n" . "Date: " . $date . "\nUsername: " . $username . " (UID: " . $uid . ")" . "\nUser: " . $full_name . "\nEmail: " . $email; $fh->close; open Log, ">>/home/newuser/downUnder.log" or warn "Problem writing to log file ($!)"; print Log "$username :: $full_name :: $email - $date\n"; close Log; ###################################################################### +###### ## Terminating message ###################################################################### +###### system("/usr/bin/clear"); print <<END_OF_MSG; OK, your brand spanking new account is ready to roll. You will want to open a secure shell (ssh) connection via either protocol 1 or 2 to this host and then use your newly created username and password to log into the system. Enjoy! And please always remember the following golden rules, and all will be well: #1) Respect the privacy of others. #2) Respect the security and integrity of this machine. #3) Think before you type. Love and Linux! (You will be automagically disconnected in 30 seconds) END_OF_MSG sleep 30; 0; |
|
---|
Replies are listed 'Best First'. | |
---|---|
Re: Anonymous User Add For Linux Shell
by Aristotle (Chancellor) on Mar 31, 2003 at 02:20 UTC | |
Re: Anonymous User Add For Linux Shell
by graff (Chancellor) on Mar 31, 2003 at 00:04 UTC |