is it possible to add an user with PHP script ?

  • 1
    You should be VERY VERY VERY VERY VERY careful about using this, because unless you secure the location of the PHP script, you'll have a TON of users being able to be created, which is VERY VERY DANGEROUS. – Thomas Ward May 25 '13 at 23:07
  • thanks..., yes, peoples are also said that it's dangerous..., I'm building a webmail and I never make my postfix works with mysql, that's why I want to add unix user with PHP script for account registration. – bagus May 26 '13 at 3:24

About your second question (the one in the Title): To enable creating users via a script run by your web server you would have to give root permissions to the web server - a very dangerous thing.

So while it is certainly possible (there are web based system management apps like webmin) it is a bad idea to do that yourself with some self written script.

NB: I am not saying that using webmin is secure either :-)

| improve this answer | |

You can have your PHP script create a file containing the user info without requiring root access. This info should be encrypted so it's not sitting there naked.

Then you can have a bash script with root access which monitors the directory where the new user info to be created by your PHP script. if a new file exists it decrypts and creates the new user, then deletes the file upon successful user creation (so it's not sitting there after you're done with it). You would want it to be very precise about what data your bash script looks for and accepts. Also be sure to sanitize all fields in the user form to minimize the chance of malicious code injection.

I haven't used it, but inotify looks like it was designed for this purpose. http://www.errr-online.com/index.php/2011/02/25/monitor-a-directory-or-file-for-changes-on-linux-using-inotify/

This way nothing is directly accessing your root area and you can limit the bash script to only run if specific conditions are met such as when a new file is created, passes a hash check created by your script, contains the expected data... Let us know how it goes and hopefully we'll get some more input about the most secure way to do this.

Edit: It looks like the event you may want to use for inotify is IN_CREATE which will act when a file is created in the watched directory. Browse through the manual and I'm sure you'll figure out a way to do this. http://man7.org/linux/man-pages/man7/inotify.7.html

Edit: You could also have a single file the is opened and edited by the PHP script. You definitely have options here, but I can't pretend to know what the best method is.

| improve this answer | |
  • root access might not be required: a root user, could set the useradd permissions, to be a user operable command chmod +sx) I think. Then, if the users were being created in the www user directory / group, it would be much less risky for the system. But yeah it is possible, with exec commands. – j0h Aug 14 '15 at 15:45

Asumming Apache is running under www-data user, execute visudo and add the following line:

www-data ALL=NOPASSWD:/usr/sbin/useradd

Now from your PHP script:

$username = "user1";
$password = "password1";
$cmd = "sudo /usr/sbin/useradd -m -p `openssl passwd -1 $password` $username";

Finally, just a word of precaution, don't ever to this on a production environment without first realizing the security implications on doing so.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.