rod wrote:
>
> hi all,
> can servlet can add a user to a unix system,
No, it can't, but it can exec a program or shell script that does.
Many unix's have a su1 or sudo command that runs a (single) command
as root, after prompting for a password, you invoke that from
your servlet.
However you need to be _very_ careful about the security aspects of
this...
Don't:
1) put the root password on the command line of a script, it will
turn up in the output of "ps -fu root"
2) don't create a setuid script that creates users (ie without a
password) since any user logged in could invoke it.
3) pass the root password from browser to client unless you are
_sure_ you are using SSL.
Do try and think of a way of getting the result you want without
creating
a real unix user. If you have to, take a look at the way that it is done
in existing programs (like the web interfaces to various linux admin
programs.
> i have root password but
> servlet run on nobody right of web server.
Yup, that's how it should be ;-)
Tim
___________________________________________________________________________
To unsubscribe, send email to [EMAIL PROTECTED] and include in the body
of the message "signoff SERVLET-INTEREST".
Archives: http://archives.java.sun.com/archives/servlet-interest.html
Resources: http://java.sun.com/products/servlet/external-resources.html
LISTSERV Help: http://www.lsoft.com/manuals/user/user.html
