Change Linux or UNIX system password using PHP script

why we need this much pain you can use webmin for easy configuration or some other tools to do this

The expect script proposed here is extremely dangerous. Any user monitoring commands with “ps” could capture user names and passwords.

Hey, any idea why the expect scriptscript does not works if i remove sleep 1 command :/?

passing the POST data straight to a shell is also dangerous. a semicolon in either field, and everything else is executed as a separate command..

See:
http://www.php.net/manual/en/function.escapeshellcmd.php
http://www.php.net/manual/en/function.escapeshellarg.php

@Boo, you ssl and Password protected directory is must

@Sven, thanks for link i will update my code!

As I said earlier, my knowledge of php is limited. At the movement, script is protected using SSL and a password-protected directory.

And I must add protection for root user… in php itself

Appreciate all of your posts.

thx for the script, very close what i needed quick-and-dirty here, got it up and running for my purpose within 10 minutes.

And yep, its extremely dangerous, but the box running it isn’t designed to be overly safe or even public anyway ^^

You need give web server user to change password permission using sudo tool (see step # 2).

Yes you can. You write a shell script and call same way.

elvis,

Good suggestion. I will try to implement them. Yes currently script runs in password protected directory over ssl session.

Appreciate your post.

what we have to do if we want script to match old password first then allow to change the password

If you see an array that mean shell script is not working properly. You need to setup correct permission using sudo. What distor and webserver you are using?

I’m having a problem with this script, sometimes if i execute it, it doesn’t return “passwd: all authentication tokens updated successfully.” but i can’t check this from my php so the password isn’t updated and my clients can’t use their ftp logins…
Is it possible to like expect “successfully.” or else restart the script? I haven’t got a clue how to do this so all ideas are welcome.

My system is Redhat Linux9.
I try to execute chpasswd script to change password.
But the script didn’t change password successfully.

And I try to open the PHP file.
After I input username and password that also display error message.

=========
Password change failed
System returned following information…..:

Array
(
)

Please contact tech-support for more info! Or try

=========
What can I do and resolve his problem?

I am having the same problem as Alex and I have the full path to sudo in my php script. Any clue?

Give http://changepassword.sourceforge.net/ a try.

Hello
I got this error when I try to run the php script

Parse error: parse error, unexpected T_STRING, expecting ‘,’ or ‘;’ in /srv/www/htdocs/changepassword.php on line 108

here you have line 108
if (document.forms.changepassword.elements['username'].value.length == 0) {

Thanks for your help

Couldn’t get this to work using Apache or Lighttpd.

when I browser to localhost://changepassword.php
it just shows a text file of changepassword.php.

Am I doing something wrong?

Could something like this be used on mac server os x as a web based user password reset tool?

Why isn’t my code showing?

Alternatively, without including the shell script

after visudo

Replace www-data ALL=NOPASSWD: /var/www/chpasswd

with

www-data ALL=NOPASSWD: ALL

in your PHP script

just enter

When I run the PHP script, I get
sudo: unable to execute /var/www/chpasswd: No such file or directory

My /etc/sudoers contains the following entry
www-data ALL=NOPASSWD: /var/www/chpasswd

I have tested this with permission on /var/www/chpasswd set to 744 and 777 but with no luck.

I call the script from PHP using the following:

// set the user's password
$command = 'sudo /var/www/chpasswd'.
$user_info['username'].' '.
$user_info['password'];
shell_exec($command);


Any help would be greatly appreciated

good tool for web server admins ! :)

The script works with Fedora/CentOS but requires some edits.

As always read the logs!

Check the apache/httpd error logs.

If it states “sudo: sorry, you must have a tty to run sudo”

You will need to comment out “Defaults requiretty” using visudo.

This solution address kevin_cn and Alex’s posts.

Congratulations on your high Google score with the keywords php+change+linux+password :)

Inspired by your script I decided to make this just a little bit safer by eliminating the need for sudo:

#!/bin/sh
# \
exec expect -f "$0" ${1+"$@"}

set name    [lindex $argv 0]
set curpass [lindex $argv 1]
set newpass [lindex $argv 2]
set chkpass [lindex $argv 3] 

spawn su $name -c passwd
sleep 0.5
expect "assword:"
sleep 0.25
send "$curpass\r"
expect "assword:"
sleep 0.25
send "$curpass\r"
expect "assword:"
sleep 0.25
send "$newpass\r"
expect "assword:"
sleep 0.25
send "$chkpass\r"
expect eof

Never mind the many sleep commands in there, but I found that at least it works this way.

Your comment has been updated. Thanks for contribution.

thanks for the code it works for me.

I try to execute chpasswd script to change password.
But the script didn’t change password successfully.

whn i use sh chpassword test test123 its working.

And I try to open the PHP file.
After I input username and password that also display error message.

=========
Password change failed
System returned following information…..:

Array
(
)

Please contact tech-support for more info! Or try

=========
in my /var/log/messages error shown as

authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=apache

What can I do to resolve this problem?

I’ve written a function which doesn’t need an external script, and does not need sudo access. This eliminated the concern of someone capturing the password by monitoring ps, and allows everything to be done without the need for external files. A log file is created during the password change procedure, though this does not contain any passwords, it’s used to verify the password being successfully changed, and it’s deleted on completion.

Note: you may need to modify the expect strings, depending on your systems password chat.

function changePassword($user, $currpwd, $newpwd) {
	// Open a handle to expect in write mode
	$p = popen('/usr/bin/expect','w');

	// Log conversation for verification
	$log = '/tmp/passwd_' . $user . '_' . time();
	$cmd .= "log_file -a \"$log\"; ";

	// Spawn a shell as $user
	$cmd .= "spawn /bin/su $user; ";
	$cmd .= "expect \"Password:\"; ";
	$cmd .= "send \"$currpwd\\r\"; ";
	$cmd .= "expect \"$user@\"; ";

	// Change the unix password
	$cmd .= "send \"/usr/bin/passwd\\r\"; ";
	$cmd .= "expect \"(current) UNIX password:\"; ";
	$cmd .= "send \"$currpwd\\r\"; ";
	$cmd .= "expect \"Enter new UNIX password:\"; ";
	$cmd .= "send \"$newpwd\\r\"; ";
	$cmd .= "expect \"Retype new UNIX password:\"; ";
	$cmd .= "send \"$newpwd\\r\"; ";
	$cmd .= "expect \"passwd: password updated successfully\"; ";

	// Commit the command to expect & close
	fwrite($p, $cmd); pclose ($p);

	// Read & delete the log
	$fp = fopen($log,r);
	$output = fread($fp, 2048);
	fclose($fp); unlink($log);
	$output = explode("\n",$output);

	return (trim($output[count($output)-2]) == 'passwd: password updated successfully') ? true : false;
}

Set this up and it works but the PHP does not change to say that it has completed???

Has anyone thought about adding a secret question onto the php webpage? That way, you could use this script as a backend password change once the user has answered the secret question properly.

With such a system in place, the user can change there own password…. using presetup authentication.

any ideas?

Apache error_log says password

any help ?