6

I have setup up ssh with chrooted directory where users only can use sftp and access a directory and all is child folders. The only problem I have is that I need to let the users change their password somehow after I have created the user.

I have been searching for a reliable web interface where they can sign in with they can change their password but haven't managed to find anyone. Do you have any idea of how I can let them do that with any excising solution?

user68802
  • 203
  • 4
  • 7

2 Answers2

3

I would switch to use SSH key pairs and forgo password authentication altogether.

It's more secure (you can disable password authentication in sshd_config and enjoy having a drastic reduction in brute force attempts in your auth.log) because they can create their own passphrase and if they forget that, they can just create a new key pair and simply email you their public key to append to their user's authorized_keys file.

PuttyGen is very easy to use, Mac and Linux users have ssh-keygen built-in and is essentially two commands to generate the key and output it with cat or whatever so that they can copy/paste (or you could wrap up in a simple bash script or Cocoa or whatever for them).

EDIT

If your users have very little computer knowledge, I don't even think an FTP Server is going to fly. You should move to a Web-based file management system. Pick your scripting language/platform of choice: there are dozens of them out there. PHPfileNavigator's solid, for example.

If for some reason you're stuck with FTP, reset their password for them and send it to them out-of-band (phone call or SMS) or email if the risk/content privacy is low.

gravyface
  • 13,957
  • 19
  • 68
  • 100
  • This is not an option since normal user with very little computer knowledge are going to use this server to upload and download files. It's going to be hard enough to explain how to connect to the server with username and password. – user68802 May 30 '11 at 17:53
  • Then build/use a Web-based system; there are dozens of them out there. – gravyface May 30 '11 at 23:12
0

If your users are in a chroot, they won't be able to access the /etc/passwd file, no matter what command they run.

ChangePassword is what you're looking for. It was last updated in 2005, but it will still work, and the requirements are light.

Fanatic
  • 526
  • 2
  • 6
  • The thought of making system changes through Apache frightens me to be honest, especially through a script that hasn't been updated since 2005. – gravyface May 29 '11 at 20:05
  • Yeah this project seems way to old, but I am going to look at the source code even though I don't think that I am going to get this approved if I would try. – user68802 May 30 '11 at 17:54