Can't change linux user password with php script

Question

I have the following php script for password change: <?php error_reporting(E_ALL); ini_set('display_errors', TRUE); ini_set('display_startup_errors', TRUE); ini_set('display_error', true);

$cmd = 'sudo -u root sh -c \'/usr/bin/echo "username:pass" | sudo /usr/sbin/chpasswd 2>&1\'';
exec($cmd,$output,$return_val);
print_r($output);
echo $return_val;
?>

This script show error in browser:

pam_chauthtok() failed, error: [1] => Authentication token lock busy [2] => chpasswd

But the command

sudo -u root sh -c '/usr/bin/echo "username:pass" | sudo /usr/sbin/chpasswd 2>&1'

work fine. Can please someone give me a tip, why I get in browser the error above?

Filesystem is in rw mode. Files /etc/{passwd,shadow} have a correct permissions

Thank you in advance

I know what you mean. Client needed a solution. I found the solution and warned about the upcoming problems with security — kbu, Jul 27 '21 at 21:11
And the problem was exactly there, because strace showed that the filesystem is in read-only mode — kbu, Jul 27 '21 at 21:12

score 1 · Answer 1 · edited Jul 27 '21 at 23:32

1

The solution was to comment out ProtectSystem=full in php-fpm.service unit:

# Mounts the /usr, /boot, and /etc directories read-only for processes invoked by this unit.
#ProtectSystem=full

edited Jul 27 '21 at 23:32

Michael Hampton

244,070
43
506
972

answered Jul 27 '21 at 20:58

kbu

255
4
14

You may change this to `true` instead, which will allow writing to `/etc` but still prohibit writing to the other named directories. – Michael Hampton Jul 27 '21 at 23:34

score 0 · Answer 2 · answered Jul 25 '21 at 06:54

0

Browser php runs using www-data user

Add permissions for www-data to use sudo through shell using visudo command and append this line

www-data   ALL=(ALL:ALL) ALL

Its' syntax is

user    hosts=(users:groups)    commands

answered Jul 25 '21 at 06:54

Ajay Singh

297
1
3
13

sorry forgot to mention here: I gave already sudo privileges. For testing I have the following line: nginx ALL=(ALL) NOPASSWD: ALL. But that did not help. – kbu Jul 25 '21 at 07:42
The `sudo` access should be limited to only the commands that are needed. – Tero Kilkanen Jul 25 '21 at 07:42
Have you tried the same with www-data instead of nginx? – Ajay Singh Jul 25 '21 at 08:10
www-data user does not exist – kbu Jul 25 '21 at 09:41
Okay. Which OS are you using? Have you verified if on browser returns nginx? – Ajay Singh Jul 25 '21 at 10:04
OpenSUSE 15.2. Yes, exec(...whoami...ls....ping...cat...) work everything – kbu Jul 25 '21 at 10:11

Can't change linux user password with php script

2 Answers2