Linux Administration Web Scripts

I have read in several places on this board that it is possible using PERL scripting to write a web page to allow a user to change their password via the internet.  Typically in these same posts, most people recommend not offering this solution because it loosens the security of the server up.  Also, in these posts people sometimes recommend using Plesk or CPanel for web administration.  What I can't figure out is how it is determined that these web admin tools are any securer than a web based password administration tool as from everything that I read, both Plesk and CPanel essentially change the web roots file permissions to 777.  I would think that this would loosen security even more than a simple web based password administration script?  Am I correct here or am I missing something?
caplinktechAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

NetworkArchitekCommented:
No, you're completely right. Its more of holding on to "esoteric knowledge," but CPanel is no more secure than any other method.
0
ramazanyichCommented:
you can use webmin to allow change passwords of users:
http://www.webmin.com
0
caplinktechAuthor Commented:
The Webmin concept I believe goes back to my original point in that it is no more secure than a custom coded PERL script and in fact in many ways it is probably much less secure.
0
cyb3rj0hnCommented:
Anytime you allow users passwords to be changed from a web browser you are putting your system at risk, because you are correct you must enable specific files to be world readable and writable by anyone and the script must by run by root or a sudo user. Although it is fairly simple to do, and I have written a script myself to do this, 98% of all systems admins and perl programmers recommend against it. If you have looked at CPANEL, you have probably also seen that it is notorious for being explotable. If you are looking for a recommendation of which is better, I would suggest Plesk over any of them as it has not had any known exploitable holes that I can think of in my experience. I have worked with it in the past, as well as CPANEL, and it (Plesk) is much nicer. The bad part about it is in the Web Hosting business a web based control panel is a must in order to be competitive. My recommendation would be to use Plesk or to do all administration from the system itself by the admin. This is just my.02.

Cheers,
John
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
sniop1Commented:
I would suggest using usermin, which allows users less access to the system to change their passwords. It is more secure than webmin is if you want to allow anyone to use it to modify their passwords. I personally like usermin because it works seemlessly with our NIS authentication and shadow passwords. You can download it from http://www.webmin.com/index6.html
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.