The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Api, Password strengh problem

Discussion in 'cPanel Developers' started by chposter, Mar 21, 2013.

  1. chposter

    chposter Active Member

    Joined:
    May 9, 2011
    Messages:
    39
    Likes Received:
    1
    Trophy Points:
    8
    Hello

    While using PasswdStrength we receive this error if we use root user

    Could not setuid to root at /usr/local/cpanel/Whostmgr/XMLUI/cPanel.pm

    So we need an existing user to check the password Strength .

    Is there a way to check this without an user? For example when creating accounts. Sometimes there are no users in the box, for example.

    Thanks
     
  2. CharlesBoyd

    CharlesBoyd Member

    Joined:
    May 29, 2012
    Messages:
    10
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    The passwdstrength API calls are expected to be run as cPanel user, though it is possible to check passwdstrength as root user with the privilege escalation mechanism provided by the cPanel API.

    Note: I should mention that I think this would not be a good idea and is not an advisable thing to do. Escalating privileges to root for checking password strength of cPanel users provides no advantage, and I would not recommend using API to set/check strength of root password. If you do choose to do this anyway, do *not* use it on a production system until you have thoroughly tested it on a staging server.

    Privilege Escalation with cPanel API Calls

    The reason I recommend against this is simply that when privileges are escalated to root before checking password strength, if your implementation is not very careful and has any security vulnerabilities, then an attacker could use it to leverage a root exploit as an unprivileged local user.

    Programs that setuid() from an unprivileged user to root can be very dangerous.

    Even though your program would only accept a single string (the prospective password) as input, it might be surprising what a malicious user could do with just a string:

    "An innocent looking omission can provide an attacker with just enough leverage to ruin your day."

    http://seclists.org/bugtraq/2000/Sep/214
     
Loading...

Share This Page