# Allow www-data to run passwd as the target user with the password of the target user.
# Also, do not remember your prior authentication but ask password each time.
Defaults:www-data targetpw, timestamp_timeout=0
www-data ALL=(%emailusers) /usr/bin/passwd

<?php

function password_error($cmd, $err) {
    raise_error(array(
        'code' => 600,
        'type' => 'php',
        'file' => __FILE__, 'line' => __LINE__,
        'message' => "Password plugin: Unable to execute $cmd: error $err"
    ), true, false);

    return PASSWORD_ERROR;
}

class rcube_sudopasswd_password
{
    public function save($currpass, $newpass)
    {
        $username = $_SESSION['username'];

        // Might not be necessary to sanitise..  The plugin prolly does that already
        $cmd = "/usr/bin/sudo -S -u ".escapeshellarg($username)." /usr/bin/passwd";
        $errlogfile = "/tmp/sudopasswd_log.log"; // Change this to something specific to your installation

        $descriptorSpec = array(
                0 => array("pipe", "r"),
                1 => array("pipe", "w"),
                2 => array("file", $errlogfile, "a")
        );
        $proc = proc_open($cmd, $descriptorSpec, $pipes);

        if (is_resource($proc)) {
                // I reckon it's not necessary to sanitise the input when passed this way
                // And for non-abuse-use, the plugin already checks for correctness..
                fwrite($pipes[0], "$currpass\n$currpass\n$newpass\n$newpass\n");
                fclose($pipes[0]);
                fclose($pipes[1]);
                if (proc_close($proc))
                        return password_error($cmd, "could not change pw");

        } else {
                return password_error($cmd, "command execution");
        }

        return PASSWORD_SUCCESS;
    }
}

hallo, I cannot find where i must write this, can you halp me?

# Allow www-data to run passwd as the target user with the password of the target user.
# Also, do not remember your prior authentication but ask password each time.
Defaults:www-data targetpw, timestamp_timeout=0
www-data ALL=(%emailusers) /usr/bin/passwd

- valeriani

Hallo ;-)
That should be put in your sudo configuration file, i.e. /etc/sudoers

I hope that halps

- wili

I don't know if it is because of a new version of PHP or a new  Round cube version, but I had to change your driver to get it to work. I am using Roundcube 0.8.2 and PHP 5.3.3. Here is the modified driver:

<?php


function password_error($cmd, $err) {
        raise_error(array(
                'code' => 600,
                'type' => 'php',
                'file' => __FILE__, 'line' => __LINE__,
                'message' => "Password plugin: Unable to execute $cmd: error $err"
        ), true, false);

    return PASSWORD_ERROR;
}

class rcube_sudopasswd_password
{

public function save($currpass, $newpass)
{
    $username = $_SESSION['username'];

        // Might not be necessary to sanitise..  The plugin prolly does that already
        $cmd = "/usr/bin/sudo -S -u ".escapeshellarg($username)." /usr/bin/passwd";
        $errlogfile = "/tmp/sudopasswd_log.log"; // Change this to something specific to your installation

        $descriptorSpec = array(
                0 => array("pipe", "r"),
                1 => array("pipe", "w"),
                2 => array("file", $errlogfile, "a")
        );
        $proc = proc_open($cmd, $descriptorSpec, $pipes);

        if (is_resource($proc)) {
                // I reckon it's not necessary to sanitise the input when passed this way
                // And for non-abuse-use, the plugin already checks for correctness..
                fwrite($pipes[0], "$currpass\n$currpass\n$newpass\n$newpass\n");
                fclose($pipes[0]);
                fclose($pipes[1]);
                if (proc_close($proc))
                        return password_error($cmd, "could not change pw");

        } else {
                return password_error($cmd, "command execution");
        }

        return PASSWORD_SUCCESS;
}

}

- Chris

Hi Chris,

Thanks for noting this!  I haven't upgraded RoundCube in while and wasn't aware that all drivers changed.  It seems that the new RoundCube wants the drivers encapsulated in classes.

- wili

# sudo visudo
  GNU nano 2.2.6            File: /etc/sudoers.tmp

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
# User privilege specification
root    ALL=(ALL:ALL) ALL
www-data ALL=(ALL)NOPASSWD: /usr/sbin/chpasswd





$cmd = "/usr/bin/sudo /usr/sbin/chpasswd";
        $errlogfile = "/tmp/sudopasswd_log.log";  // Change this to something specific to your installation

        $descriptorSpec = array(
            0 => array("pipe", "r"),
            1 => array("pipe", "w"),
            2 => array("file", $errlogfile, "a")
        );
        $proc = proc_open($cmd, $descriptorSpec, $pipes);

        if (is_resource($proc)) {
            // I reckon it's not necessary to sanitise the input when passed this way
            // And for non-abuse-use, the plugin already checks for correctness..
            fwrite($pipes[0], "$login:$novasenha\n");
            fclose($pipes[0]);
            fclose($pipes[1]);
            if (proc_close($proc))
                $err= " could not change pw";
        } 
        else {
            $err=" command execution";
        }
    }

- Gabriel Yago Moreira

shadow password roundcube not be changed  any problem

- kulbir

Giving SUDO access to apache OR httpd OR www-data is very insecure.

Any script (not just roundcube) running under apache OR httpd can change password of ANY USER. 

All hacker needs is to "inject" a script somehow. Once script is injected, all that is required is simple call to:

sudo -S -u  ANYUSER /usr/bin/passwd

OR (for one of the comment)

sudo /usr/sbin/chpasswd

Bingo password changed!

After password is changed - user's account can be accessed easily!

- AMM

Hi AAM,

It's true that this sudo configuration does not limit its usage to roundcube, however due to the "targetpw" sudoers rule passwords can be only changed if you know the target user's current password.  That was the key idea.  So in order to change users' passwords you would already have to had cracked their plaintext passwords.

- wili