Php script to change Ubuntu user password

Question

I have written a php script to allow users to create accounts for mailing service.

shell_exec("sudo useradd -m ".escapeshellcmd($user_name)." -s /sbin/nologin"." -p ".crypt(escapeshellcmd($user_password),"abcd"));

Now I would like to allow users to change/delete their password/account. I tried using

shell_exec("sudo deluser --remove-all-files -f ".$username);

I have no idea how to implement password changing.

Unfortunately the commands doesn't seem to be working. How can I implement these?

Update: Piece of code to handle password change

case 'change':
  $username = $_POST['value'];
  $newpwd = $_POST['Pwd'];

  // Berry Langerak's code
  $out = shell_exec(
       sprintf(
         "echo '%s:%s' | chpasswd", 
          escapeshellarg($username), 
          escapeshellarg($newpwd)
        )
      );
echo(json_encode($username." password has been updated"));
break;

You can check this stackoverflow.com/questions/127459/…

leticia
– leticia

2014-05-19 12:35:55 +00:00
Commented May 19, 2014 at 12:35 — leticia
– leticia, Commented May 19, 2014 at 12:35
hopefully, your user cannot be called "; rm -rf /*"

Jonas Schäfer
– Jonas Schäfer

2014-05-19 12:51:14 +00:00
Commented May 19, 2014 at 12:51 — Jonas Schäfer
– Jonas Schäfer, Commented May 19, 2014 at 12:51

Berry Langerak · Accepted Answer · 2014-05-20 08:58:04Z

3

Well, in Ubuntu, the command for changing the password of a regular user would be:

passwd $username

But then, the shell is interactive, which might be very annoying for a PHP script. There's a non-interactive alternative though:

echo '$username:$password' | sudo chpasswd

In your PHP script, you could do this:

<?php
$username = 'foo';
$password = 'foo';

$command = sprintf(
    "echo '%s:%s' | sudo chpasswd", 
    escapeshellarg($username), 
    escapeshellarg($password)
);

exec($command, $output, $return);

if ($return === 0) {
   // success.
}
else {
   var_dump($return, $output); // failure.
}

DISCLAIMER: when you're executing this line, do be aware that this command will be visible in .bash_history, and in the process list. You might want to encrypt the password before executing your shell command, and send the -e flag to chpasswd, to mitigate these risks.

EDIT: Forgot the echo statement, added it.

EDIT: Added some debugging to the script.

edited May 20, 2014 at 8:58

answered May 19, 2014 at 12:47

Berry Langerak

18.9k5 gold badges49 silver badges62 bronze badges

Sign up to request clarification or add additional context in comments.

12 Comments

curious_coder Over a year ago

I tried it but unfortunately its not working. Anything I am missing out on?

Berry Langerak Over a year ago

@curious_coder Sorry, I forgot the echo statement, which means the shell tried to execute the string. I've added the echo statement and tested it.

curious_coder Over a year ago

I tried it but I am unable to get it to work. The password remains unchanged. I have added update to the question

curious_coder Over a year ago

Do we need to add sudo?

Berry Langerak Over a year ago

@curious_coder Ah, yes, you need to have permission to actually execute the statement. Using sudo should fix your issue. I'll add some debugging to the script, too.

|

Collectives™ on Stack Overflow

Php script to change Ubuntu user password

1 Answer 1

12 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

12 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related