I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I have a lot of email-only users with no shell access who need to be able to change their passwords without asking me to do it for them.)
The few answers given didn't really help. I don't want to dump passwords in a file, or do some sort of batch update every x seconds. It needs to be an immediate, thread-safe system which 1) requires that the user verify his existing password, and 2) changes password immediately (no batching).
So I created an executable utility and a small PHP script to accomplish this. I am submitting these here for review, in hopes the community can point out things I did wrong/ways in which this can be vulnerable to attack, and in hopes it will help someone else.
Config info: The 'chpwd' utility is set to run SUID root - required for access to the /etc/shadow file. I can't see any way around this. Note that the actual "change password" code which accesses the /etc/shadow file is copied directly from the source of the 'passwd' utility.
The chpasswd.php script runs with standard permissions on the web server.
Here is the example code:
Thank you in advance for all constructive criticism and suggestions.