Re: Account Creation and Password Change

On Thu, 12 Jun 2003, Faisal Ashraf wrote:

> Hi,
> 
> I want to give useradd and password change rights to one user I can't
> use sudo as it's required for our software which creates mail account
> through web.
> 
> Is it possible to create an account with useradd and passswd change
> permission ?
> 
> And Thanks Florian La Roche I really forgot about /etc/hosts file :D 
> 
> Faisal 

What you are proposing is extremely dangerous; if I understand correctly
you want to create an account that will be able, through a web interface,
to create system accounts.  This falls into the realm of remote 
administration; remote admin is always dangerous, but more so when you
be allowing folks to elevate themselves to the highest level of privilege 
on the machine.  As someone else pointed out, it is possible to use 
useradd to create an account with root privilege.  Once someone does this
they own the machine.  useradd requires root access, and giving someone 
root access for any purpose is difficult to control.  Even with sudo 
controls useradd is dangerous; a clever person could find a way to create 
an account with root access, then sudo controls can be totally subverted.
sudo, and other root privilege controls, are only effective in limiting 
damage insofar as you can control not only the commands that people can 
run but input to those commands; given that users should be unique, you 
cannot specify a hard and fast command line.   

If I were you I would back the truck up.  First, do you really need to
create e-mail accounts using a web interface?  Who will be creating these
accounts?  Who will be auditing this process?  Does the process need to
complete in real time?  Are the accounts for e-mail only, or do the users
require other access on the machines?  If the accounts are for e-mail
only, and no more extensive access is required, I would highly recommend
using a mail system that can handle "virtual users" (aka, has its own user
and password system separate from the system user/passwords).  Cyrus with
SASL comes to mind.  If web form creation is needed, I would recommend a
highly audited form, with scripts that check all input, and have it run
over HTTPS with strong authentication.  I would recommend that the
completion not be in real time, but only create a 'request' that can be
activated by a real person after reviewing the request.

Lots of options, but the path you propose is a mine field.  Think 
carefully of the alternatives before even committing to this road.

- rick warner