Creating user WITH password in ubuntu from PHP

Question

I have this PHP code

<?php
error_reporting(E_ALL);
ini_set('display_errors', TRUE);
ini_set('display_startup_errors', TRUE);



if(!empty($_GET) && !empty($_GET['user']) && !empty($_GET['mem']) && !empty($_GET['id']) &&!empty($_GET['k'])) {
    $user = $_GET['user'];
    $mem = $_GET['mem'];
    $id = $_GET['id'];
    $pass = $_GET['k'];
    $fullname=  escapeshellarg($user."-".$id);

    echo $user; 
    echo $mem;
    echo $id; 
    echo $pass;
    echo "<br/>";

    mkdir("/home/servers/".$fullname, 0, true);
    $outputuser = shell_exec("sudo useradd -d /home/$fullname $fullname");
    $outputpass = shell_exec('echo -e '.$pass.'\n'.$pass.'\n" | sudo passwd '.$fullname);

    echo $outputpass;

}


?>

the password isnt working right though. when i run it from the terminal i get

 Enter new UNIX password: Retype new UNIX password: passwd: Authentication token manipulation error

now surely theres a better way of doing this without exposing both useradd AND passwd to not needing passwords in sudo?

miken32 · Accepted Answer · 2020-01-15 23:35:07Z

1

This won't be an answer, but really important warning. Your script may allow user to gain full access to your server, as he may input "../" as a $fullname. Passing user input as an argument without using escapeshellarg() is a suicide.

Resolution to your problem may be creating some crontab task that would create users from database every defined period of time. This way your password won't be exposed.

edited Jan 15, 2020 at 23:35

miken32

42.5k16 gold badges127 silver badges177 bronze badges

answered Nov 22, 2013 at 19:29

Flash Thunder

12.1k10 gold badges55 silver badges103 bronze badges

Sign up to request clarification or add additional context in comments.

9 Comments

James T Over a year ago

I understand this, for a start this is an internal facing Web servers taking known values from an external facing web server, it has no end-user control. This at this point in time is also only a proof of concept type thing, I will add security measures as soon as I get the code working in its raw form.

Flash Thunder Over a year ago

You can add http user permission to use adduser command then, but this is dangerous.

James T Over a year ago

what exactly do you mean?

Flash Thunder Over a year ago

Something like http ALL=NOPASSWD:/usr/sbin/useradd,/bin/mkdir,/bin/ln,/bin/chown,/bin/cp,/bin/sed with visudo

James T Over a year ago

www-data already has access to use useradd and passwd without needing a password on sudo, it is able to create the user but the password changing fails because the passwd returns an error on the "echo -e ".$pass."\n".$pass."\n" | sudo passwd ".$fullname

|

marekful · Accepted Answer · 2013-11-22 19:31:12Z

0

You have to use double quotes in the second shell_exec otherwise PHP doesn't convert escaped characters to control characters.

answered Nov 22, 2013 at 19:31

marekful

15.4k6 gold badges39 silver badges63 bronze badges

1 Comment

James T Over a year ago

right I see, but is there no way to do it without needing that passwd at all? (perhaps using the -p flag in useradd, but i have no idea how to handle the encryption)

Collectives™ on Stack Overflow

Creating user WITH password in ubuntu from PHP

2 Answers 2

9 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

9 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related