in reply to get the user id and pwd who logs in to the cgi/perl application
This is a fairly dangerous thing to do, unfortunately. It requires that you either run your Apache as root, so it will be allowed to read passwords from /etc/shadow and then switch to the appropriate user, or else have your script setuid to root, so it will acquire those privileges when it starts. Either way, a tiny bug in your script or in Apache could lead to your entire system being taken over, so unless you are very experienced with secure programming, you should try to avoid these techniques.
A different way to accomplish the same thing is to have a small server running as root and accepting a username, password, and a limited set of commands. Your script would get input from a form, send a command to this server, then interpret and display the results. That can be a little safer, because the server can be very simple and doesn't have to interact with a Web server.
Another way is to send username, password, and command to a local ssh server using Net::SSH; that way the ssh server handles most of the security code, and you just have to worry about getting it the right commands.
|
|---|