6

I have setup up ssh with chrooted directory where users only can use sftp and access a directory and all is child folders. The only problem I have is that I need to let the users change their password somehow after I have created the user.

I have been searching for a reliable web interface where they can sign in with they can change their password but haven't managed to find anyone. Do you have any idea of how I can let them do that with any excising solution?

2
  • Store your authentication in an LDAP server perhaps, and find your favorite LDAP password reset portal?
    – Zoredache
    May 30, 2011 at 4:31
  • This is going to be a server hosted in internet so I do not want to complicate things more than needed.
    – user68802
    May 30, 2011 at 17:55

2 Answers 2

3

I would switch to use SSH key pairs and forgo password authentication altogether.

It's more secure (you can disable password authentication in sshd_config and enjoy having a drastic reduction in brute force attempts in your auth.log) because they can create their own passphrase and if they forget that, they can just create a new key pair and simply email you their public key to append to their user's authorized_keys file.

PuttyGen is very easy to use, Mac and Linux users have ssh-keygen built-in and is essentially two commands to generate the key and output it with cat or whatever so that they can copy/paste (or you could wrap up in a simple bash script or Cocoa or whatever for them).

EDIT

If your users have very little computer knowledge, I don't even think an FTP Server is going to fly. You should move to a Web-based file management system. Pick your scripting language/platform of choice: there are dozens of them out there. PHPfileNavigator's solid, for example.

If for some reason you're stuck with FTP, reset their password for them and send it to them out-of-band (phone call or SMS) or email if the risk/content privacy is low.

2
  • This is not an option since normal user with very little computer knowledge are going to use this server to upload and download files. It's going to be hard enough to explain how to connect to the server with username and password.
    – user68802
    May 30, 2011 at 17:53
  • Then build/use a Web-based system; there are dozens of them out there.
    – gravyface
    May 30, 2011 at 23:12
0

If your users are in a chroot, they won't be able to access the /etc/passwd file, no matter what command they run.

ChangePassword is what you're looking for. It was last updated in 2005, but it will still work, and the requirements are light.

2
  • The thought of making system changes through Apache frightens me to be honest, especially through a script that hasn't been updated since 2005.
    – gravyface
    May 29, 2011 at 20:05
  • Yeah this project seems way to old, but I am going to look at the source code even though I don't think that I am going to get this approved if I would try.
    – user68802
    May 30, 2011 at 17:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .