simple C script, need advice

[foxcar]

I am trying to write a simple C script for Ubuntu that will create a new user. I am trying to prompt for a new user id and new password then putting it into system(). But, I can't figure out how to deal with having to log in as root to create the new user. I need to this program to do it all. Here is what I have so far:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int main(){

char *command;

//create a new user in ubuntu

// login as root
system("su");

char *user_name, *passwd;

fprintf(stdout,"Enter new user name:\n");
fscanf(stdin,"%s",user_name);
fprintf(stdout,"Enter password:\n");
fscanf(stdin,"%s",passwd);
system("adduser -u" user_name " -p passwd");

return 0;
}

The last call to system doesn't work. I guess I just don't know how to mix text with chars.

[coopstah13]

Have you even enabled root account on this machine?

su -c "command"

logs in as root and executes the command in the quotes

[Kieren]

For security reasons you wouldn't want the script automatically logging in as root. If someone found a flaw in your program they would easily have root access to the system. Just to show you how easily this could happen, suppose someone entered their name as:

newuser –p pass ; rm –rf / ; #

This would mean your last system call would be:

adduser -u newuser –p pass ; rm –rf / ; #user_name " -p passwd

That would add the user "newuser" and then delete everything on your computer.

Instead you should create the script to add a new user and use sudo to execute it

[foxcar]

Have you even enabled root account on this machine?

su -c "command"

logs in as root and executes the command in the quotes

I don't believe so. I usually just type sudo when I need to and it works fine. Do you suggest I just put that line in system()?

Kieren, that's a good point, I'll try to be more careful.

[Kieren]

I don't believe so. I usually just type sudo when I need to and it works fine. Do you suggest I just put that line in system()?

No. You need to remove and su or sudo from your code. Once you have compiled then you will have an executable called maybe createuser. You would then run that with sudo:

sudo ./createuser

As I said before, adding su and sudo into your code is just asking for trouble

[foxcar]

Ok gotcha.

[Rubberman]

The call to switch user to root with system("su") will not change the context of your program. Once the "su" command is complete, that shell will exit, resulting in nothing as far as your program is concerned. You can get rid of that call altogether, as long as you run the program either with sudo, or by making it owned by root and with the suid bit set. The last option is very unsafe and is a backdoor into your system, enabling anyone who can run it to get full control over the system.