Re: RE: Account Creation and Password Change

14/06/03 4:57:52, "Faisal Ashraf" <[email protected]> wrote:

>HI,
>
>Thanks for all your feedback I initially discouraged my company to use
>such system but they were insisting me to do so.  I knew that it's gonna
>be BIG hole and could result with complete own/compromised system. Now I
>gonna put these replies to Management (computer illiterate) that what I
>was saying is right.
>
>Ok I need a suggestion that all my user's need only mailbox no access to
>box we are an small ISP here which mail MTA should I go for? Currently I
>am using sendmail.

I don't know about sendmail, but I have just done this with Postfix (MTA) & 
MySQL (DBM) on 7.2 and it was pretty easy.  The database makes administration
& billing a dream, and really helps system integrity/security.

Coupled with Courier-IMAP you can keep the email users completely independent 
of the system.  And I believe you can also hook in Apache & SqWebMail for 
webadmin & webmail if you want.

Visit the howto's at http://www.postfix.org/docs.html to get started.

James (Stanhope).

>Or I use sendmail with virtusertable ?
>
>Thanks for all again,
>
>
>
>Faisal Ashraf 
>
>
>-----Original Message-----
>From: Rick Warner [mailto:[email protected]] 
>Sent: Thursday, June 12, 2003 10:40 AM
>To: Faisal Ashraf
>Cc: Enigma-List@Redhat. Com
>Subject: Re: Account Creation and Password Change 
>
>
>On Thu, 12 Jun 2003, Faisal Ashraf wrote:
>
>> Hi,
>> 
>> I want to give useradd and password change rights to one user I can't
>> use sudo as it's required for our software which creates mail account 
>> through web.
>> 
>> Is it possible to create an account with useradd and passswd change
>> permission ?
>> 
>> And Thanks Florian La Roche I really forgot about /etc/hosts file :D
>> 
>> Faisal
>
>What you are proposing is extremely dangerous; if I understand correctly
>you want to create an account that will be able, through a web
>interface, to create system accounts.  This falls into the realm of
>remote 
>administration; remote admin is always dangerous, but more so when you
>be allowing folks to elevate themselves to the highest level of
>privilege 
>on the machine.  As someone else pointed out, it is possible to use 
>useradd to create an account with root privilege.  Once someone does
>this they own the machine.  useradd requires root access, and giving
>someone 
>root access for any purpose is difficult to control.  Even with sudo 
>controls useradd is dangerous; a clever person could find a way to
>create 
>an account with root access, then sudo controls can be totally
>subverted. sudo, and other root privilege controls, are only effective
>in limiting 
>damage insofar as you can control not only the commands that people can 
>run but input to those commands; given that users should be unique, you 
>cannot specify a hard and fast command line.   
>
>If I were you I would back the truck up.  First, do you really need to
>create e-mail accounts using a web interface?  Who will be creating
>these accounts?  Who will be auditing this process?  Does the process
>need to complete in real time?  Are the accounts for e-mail only, or do
>the users require other access on the machines?  If the accounts are for
>e-mail only, and no more extensive access is required, I would highly
>recommend using a mail system that can handle "virtual users" (aka, has
>its own user and password system separate from the system
>user/passwords).  Cyrus with SASL comes to mind.  If web form creation
>is needed, I would recommend a highly audited form, with scripts that
>check all input, and have it run over HTTPS with strong authentication.
>I would recommend that the completion not be in real time, but only
>create a 'request' that can be activated by a real person after
>reviewing the request.
>
>Lots of options, but the path you propose is a mine field.  Think 
>carefully of the alternatives before even committing to this road.
>
>- rick warner
>
>
>_______________________________________________
>enigma-list mailing list
>[email protected]
>https://www.redhat.com/mailman/listinfo/enigma-list
>
>