changing password (without a really login shell)

changing password (without a really login shell)

Post by Michael Ehr » Fri, 28 Feb 1997 04:00:00



Dear all

We have a solaris workstation Sparc 10 (Solaris 2.4)
with some accounts which only should connect to the
workstation to get there email. One guy told me to
use /bin/passwd as login-shell, so that they could
change there passwords.
I dont think that it is a good idea to have such a
suid program as the shell (btw. passwd changing works)
but I dont know another solution. Our mailers are
win** or Mac users which connect over internet-browsers
mail (via popper) and have no ideas about UNIX
Can somebody help me
 Thanx in Advance
   mike

 
 
 

changing password (without a really login shell)

Post by Sylvain Nierve » Fri, 28 Feb 1997 04:00:00



Quote:> I dont think that it is a good idea to have such a
> suid program as the shell (btw. passwd changing works)
> but I dont know another solution. Our mailers are

Did you try to use the "restricted" shell feature
of Solaris (/usr/lib/rsh). You can define a secure area
where you put the binaries needed by the users to change
their password interactively in a telnet session.
If they don't know a word of Unix, it'll be more difficult ;-)
If you want some details on how I configured this restricted
environnement, please e-mail me at my work e-mail address

Quote:> win** or Mac users which connect over internet-browsers
> mail (via popper) and have no ideas about UNIX

There is a poppasswd on the Qualcomm FTP Server
which is used for my POP3 users to change their
password within Eudora (Special, Change Passwd if I remember
well) :
ftp://ftp.qualcomm.com/quest/unix/...

I wonder if the poppassd is a secure daemon, by the way.
Is there anybody aware of any security threats when using
this daemon ?

--
Sylvain Niervze + <URL:http://www.mygale.org/03/sly/> (fciw,uvv)
<URL:http://www.frmug.org/cgi-bin/fciwa.cgi>

 
 
 

changing password (without a really login shell)

Post by Jean Richell » Sat, 01 Mar 1997 04:00:00



Quote:> There is a poppasswd on the Qualcomm FTP Server
> which is used for my POP3 users to change their
> password within Eudora (Special, Change Passwd if I remember
> well) :
> ftp://ftp.qualcomm.com/quest/unix/...

> I wonder if the poppassd is a secure daemon, by the way.
> Is there anybody aware of any security threats when using
> this daemon ?

In fact at ftp://ftp.qualcomm.com/quest/unix/servers/password there are
many "poppasswd". Which one to choose ?

Jean
_____________________________________________________________________________

Unit de Conformation des Macromolcules Biologiques   Tel: +32 (0)2 650 3587
Universit libre de Bruxelles                          FAX: +32 (0)2 648 8954
av. FD Roosevelt 50 - CP160/16, B-1050 Bruxelles, Belgium
_____________________________________________________________________________

 
 
 

1. Password change without shell access?

Greetings:

   We create ftp-only usernames (set the shell to /bin/date) to allow some
departments to publish their own pages to our web server (Solaris 9).  We
would like for them to be able to change their own password, but I'm not sure
how to do this without shell access.  Can anyone offer a suggestion?  TIA...

Jim McCullars
University of Alabama in Huntsville

2. Inter-Process-Communication/Data-Echange/X-Ole

3. password changes without shell

4. Good SB16 Compatibles

5. Tools to change password without ask new password twice time.

6. Connecting to the Internet

7. How to run shell script without login shell?

8. FTP from SCO Openserver

9. User changing login shell? (/etc/shells?)

10. Login without login getting recorded into last login file

11. Really, really slow login with Solaris 2.5

12. rshd and friends - remote logins without password

13. Login as root without giving a password