RE: Account Creation and Password Change

HI,

Thanks for all your feedback I initially discouraged my company to use
such system but they were insisting me to do so.  I knew that it's gonna
be BIG hole and could result with complete own/compromised system. Now I
gonna put these replies to Management (computer illiterate) that what I
was saying is right.

Ok I need a suggestion that all my user's need only mailbox no access to
box we are an small ISP here which mail MTA should I go for? Currently I
am using sendmail.

Or I use sendmail with virtusertable ?

Thanks for all again,



Faisal Ashraf 


-----Original Message-----
From: Rick Warner [mailto:[email protected]] 
Sent: Thursday, June 12, 2003 10:40 AM
To: Faisal Ashraf
Cc: Enigma-List@Redhat. Com
Subject: Re: Account Creation and Password Change 


On Thu, 12 Jun 2003, Faisal Ashraf wrote:

> Hi,
> 
> I want to give useradd and password change rights to one user I can't
> use sudo as it's required for our software which creates mail account 
> through web.
> 
> Is it possible to create an account with useradd and passswd change
> permission ?
> 
> And Thanks Florian La Roche I really forgot about /etc/hosts file :D
> 
> Faisal

What you are proposing is extremely dangerous; if I understand correctly
you want to create an account that will be able, through a web
interface, to create system accounts.  This falls into the realm of
remote 
administration; remote admin is always dangerous, but more so when you
be allowing folks to elevate themselves to the highest level of
privilege 
on the machine.  As someone else pointed out, it is possible to use 
useradd to create an account with root privilege.  Once someone does
this they own the machine.  useradd requires root access, and giving
someone 
root access for any purpose is difficult to control.  Even with sudo 
controls useradd is dangerous; a clever person could find a way to
create 
an account with root access, then sudo controls can be totally
subverted. sudo, and other root privilege controls, are only effective
in limiting 
damage insofar as you can control not only the commands that people can 
run but input to those commands; given that users should be unique, you 
cannot specify a hard and fast command line.   

If I were you I would back the truck up.  First, do you really need to
create e-mail accounts using a web interface?  Who will be creating
these accounts?  Who will be auditing this process?  Does the process
need to complete in real time?  Are the accounts for e-mail only, or do
the users require other access on the machines?  If the accounts are for
e-mail only, and no more extensive access is required, I would highly
recommend using a mail system that can handle "virtual users" (aka, has
its own user and password system separate from the system
user/passwords).  Cyrus with SASL comes to mind.  If web form creation
is needed, I would recommend a highly audited form, with scripts that
check all input, and have it run over HTTPS with strong authentication.
I would recommend that the completion not be in real time, but only
create a 'request' that can be activated by a real person after
reviewing the request.

Lots of options, but the path you propose is a mine field.  Think 
carefully of the alternatives before even committing to this road.

- rick warner