Hi, forgives for my English, and would like to know as I can make one login of a user way cgi.

I use a Linux Mandrake 8.0

Tanks

---

Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.282 / Virus Database: 150 - Release Date: 25/09/01

Anderson wrote

Hi, forgives for my English, and would like to know as I can make one login of a user way cgi. I use a Linux Mandrake 8.0

Sorry, but i don't understand, what you want.

Do you want to login into a console?
Then you don't need to make a cgi program,
then you can simply start a telnet: <telnet://machine.name>

Or do you want to do something with the privileges of a special user?

Please itry to explain a bit more exactly what you want.

A Simple cgi for authenticate a linux user eg.: root in the web ;o)

Anderson wrote

A Simple cgi for authenticate a linux user eg.: root in the web ;o)

If you want to have root privileges, simply make the CGI program setuid root.
But don't blame me, if someone kills your system!

Or what do you want - I still don't understand.

If you want to have root privileges, simply make the CGI program setuid root. But don't blame me, if someone kills your system!

It is very dangerous to run a cgi script as root.
any hole in the cgi can be an enty point to break your system

I recently made an web-interface to create unix accounts on a server : You have a form that require a the username and a password to create the corresponding account.
This page is protected by a .htaccess (the server is running apache).

When you validate the form, the cgi create a file containing the username and the plain password. (not
very sure, of course but more secure than running cgi as root). Then , the cron daemon execute all ten minutes a program that have the setuid set to root and this program
read the file created by the cgi, verify datas and then create unix accounts.

This method is not 100%secure but it shows you how to avoid cgi running as root.

Perhaps, he want a CGI that verify if the couple User/Password entered in a html form is a valid linux User/Password as defined in his etc/passwd on his box.

Cyril Lamy wrote

When you validate the form, the cgi create a file containing the username and the plain password. (not very sure, of course but more secure than running cgi as root).

If you do this, you might want to have your CGI script encode the password given so no plain passwords will be stored. When the ten-minutely script runs, it will place the appropiate line containing the username and the already encoded password into the shadow password file (be aware to use some kind of locking mechanism while editing the shadow file)

ave
lsp

> > A Simple cgi for authenticate a linux user eg.: root in the web ;o) > > If you want to have root privileges, simply make the CGI program > setuid root.

Is a good idea to run a CGI with root privileges?
By myself use the standard HTTP authentication method instead of CGI! Where do you want use it? If not in an intranet, I suggest use SSL with HTTP auth method!

bye
kako

How to make this authentication in linux, please send me a exemple...

[]´s

Anderson

I just forgot the smiley.

You could make it more secure when you make this:
chmod('filename', 0);
Then only root can read the file.

Very good idea.
Thanks!

You could make it more secure when you make this: chmod('filename', 0);

Thanks, I don't think about this good idea !