# Password script

**URL:** <https://community.unix.com/t/password-script/147243>\
**Category:** UNIX for Dummies Questions & Answers\
**Created:** [November 13, 2003, 8:13am UTC](https://community.unix.com/t/password-script/147243 "2003-11-13T08:13:38Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Latha\_Nair](https://community.unix.com/letter_avatar/latha_nair/32/6_22734026db12803ebb3e059622ac3534.png) [@Latha\_Nair](https://community.unix.com/u/Latha_Nair)\
**Post date:** [November 13, 2003, 8:13am UTC](https://community.unix.com/t/password-script/147243/1 "2003-11-13T08:13:38Z")

</div>

Is there a simple way to do a script for password changes? I need to let our help desk folks (for example) change user passwords. Currently, I have set them up with root privileges for doing this. I know this is not a good way, but what are my other choices? I was thinking of a script where (thru the script) the help desk folks would get temporaray root privileges, then change somebody's password, and before exiting out of the script have their own privileges back. Can this be done? If I use the 'su' command, then I have to know the user's password before I can change it. This is not always possible.

Just wondering..... 😃

Thanks in advance.  
Latha Nair

---

<div class="post-metadata">

**Author:** ![daveyk69](https://community.unix.com/letter_avatar/daveyk69/32/6_22734026db12803ebb3e059622ac3534.png) [@daveyk69](https://community.unix.com/u/daveyk69)\
**Post date:** [November 13, 2003, 11:09am UTC](https://community.unix.com/t/password-script/147243/2 "2003-11-13T11:09:22Z")

</div>

Hi there, this is possible, if you create your script you then need to set a sid or sticky bit on the script, this will then give the script temporary root privilages on the system, this can be achieved using chmod +s

Hope that helps

---

<div class="post-metadata">

**Author:** ![Latha\_Nair](https://community.unix.com/letter_avatar/latha_nair/32/6_22734026db12803ebb3e059622ac3534.png) [@Latha\_Nair](https://community.unix.com/u/Latha_Nair)\
**Post date:** [November 13, 2003, 11:12am UTC](https://community.unix.com/t/password-script/147243/3 "2003-11-13T11:12:57Z")

</div>

I am a new user, and I do not know how to use what you have explained. I read thru some of the emails in this area, and most everybody advises to use 'expect'. I am checking into that possibility. If you can explain a bit more about your advice, that would be very helpful.

Thank you.  
Latha

---

<div class="post-metadata">

**Author:** ![Jody](https://community.unix.com/letter_avatar/jody/32/6_22734026db12803ebb3e059622ac3534.png) [@Jody](https://community.unix.com/u/Jody)\
**Post date:** [November 14, 2003, 5:14pm UTC](https://community.unix.com/t/password-script/147243/4 "2003-11-14T17:14:45Z")

</div>

Someone please correct me if I am wrong, but I think the way to use this is:

chmod +s \<file in question\>

---

<div class="post-metadata">

**Author:** ![system](https://community.unix.com/uploads/default/original/2X/c/c7e9e16a595259edafe88615719d5c5dcda035c2.png) [@system](https://community.unix.com/u/system)\
**Post date:** [November 14, 2003, 7:12pm UTC](https://community.unix.com/t/password-script/147243/5 "2003-11-14T19:12:21Z")

</div>

New users shouldnt be writing scripts to allow other users to change passwords,, a helpdesk person could change roots pass and ruin the system,,, but if you must, then id say give them sudo access to the passwd command

---

<div class="post-metadata">

**Author:** ![kduffin](https://community.unix.com/user_avatar/community.unix.com/kduffin/32/105_2.png) [@kduffin](https://community.unix.com/u/kduffin)\
**Post date:** [November 17, 2003, 1:40am UTC](https://community.unix.com/t/password-script/147243/6 "2003-11-17T01:40:39Z")

</div>

I wouldn't give them access to the actual passwd program. It would be better to give them access to a wrapper that checks to ensure that they can only change passwords for users, for example.

passwdwrap.sh (used as passwdwrap.sh \<user\>)

```nohighlight
#!/bin/ksh

# some lame metacode....

SET TRAPS FOR EXIT CONDITIONS

if [$1 == "root"]
then
     logger -p local1.error -t PASSWDWRAP "ERROR: unauthrorized root change attempted"
     exit 1;
else
     passwd $1
fi

```

I would be more likely to write such a tool in C to prevent modification etc. I'm sure there are better examples out there, but I hope this gives you something to think about. Not sacrificing security for ease should always be foremost in your thoughts.

Cheers,  
Keith

added code tags for readability --oombera

---

<div class="post-metadata">

**Author:** ![Latha\_Nair](https://community.unix.com/letter_avatar/latha_nair/32/6_22734026db12803ebb3e059622ac3534.png) [@Latha\_Nair](https://community.unix.com/u/Latha_Nair)\
**Post date:** [November 17, 2003, 9:34am UTC](https://community.unix.com/t/password-script/147243/7 "2003-11-17T09:34:43Z")

</div>

Thanks for all who answered.

The whole point of this script is that none of us are very good with UNIX here. I am entrusted with a system that I am trying to learn. I know how to change user passwords thru smit. In order for the help desk folks to change user passwords thru smit, I had to give them root equivalent privileges. That is what I am trying to change by having a script thru which they can have root privileges TEMPORARILY so that they can accomplish the follwoing:

1) Have their regular access to execute the script  
2) The script could provide them with root privileges  
3) Then change the user's password  
4) After the password is changed, the script will set the help  
desk folk's privilege back.  
5) Exit out of the script.

When they exit, they would have their original privilege set again. This is what I am trying to accomplish. Is this possible? If I was not clear earlier, I am sorry.

We have an AIX/UNIX system.

Thank you.  
Latha Nair

---

<div class="post-metadata">

**Author:** ![kduffin](https://community.unix.com/user_avatar/community.unix.com/kduffin/32/105_2.png) [@kduffin](https://community.unix.com/u/kduffin)\
**Post date:** [November 17, 2003, 9:44am UTC](https://community.unix.com/t/password-script/147243/8 "2003-11-17T09:44:44Z")

</div>

If you are using AIX, you really don't need a script. You can grant limited user access to smit for specified operations and keep them from resetting root's password. Just dig a little more into smit.

Cheers,  
Keith

---

<div class="post-metadata">

**Author:** ![Latha\_Nair](https://community.unix.com/letter_avatar/latha_nair/32/6_22734026db12803ebb3e059622ac3534.png) [@Latha\_Nair](https://community.unix.com/u/Latha_Nair)\
**Post date:** [November 18, 2003, 12:37pm UTC](https://community.unix.com/t/password-script/147243/9 "2003-11-18T12:37:16Z")

</div>

I was going thru the 'security and users' portion of smit, and set a particular user's role to 'manage all users' and 'manage all user passwords'. This does not seem to help.

Thanks,