hi all,

im going to design a web html form so users can input what username and password they want to make the ftp account, once they enter in a username and password they click on the submit button and it submits it to a bash script and then the bash script will run and finish of making the ftp account

the variables of both the html form and bash script are the same ie user passwd

it doesnt work, what am i doing wrong?

here is my html form page -

<form>
<form action="/scripts/create_user.sh" method="post">
Username:<br>
<input type="text" name="user"><br><br>
Password:<br>
<input type="text" name="passwd"><br><br>
<input type="submit" value="Submit">

</form>

what the form looks like -

https://s12.postimg.org/5rcs8rbb1/ftp_web.png

my bash script -

#!/bin/bash

dir=/sftp
group=sftpusers

echo "$user:$passwd" >> /ftp_details/accounts.csv

useradd -g $group -d $dir/$user -s /sbin/nologin $user
mkdir -p $dir/$user/data
chown root $dir/$user
chmod 755 $dir/$user
chown $user $dir/$user/data
chmod 755 $dir/$user/data
touch $dir/$user/data/WARNING_everything_in_here_will_get_removed_in_14_days_time.txt

cheers,

rob

http://172.17.1.1/create.html ??? what is 172.17.1.1
googled it
http://172.17.1.1/login - Google Plus

if this is what is suppose to be getting your $user and $passwd
that is so backwards : out >> << in

plus you're going to have to parse your file to find the values you need then add them to your vars in your bash script.

Your bash script has to parse the form variables from the QUERY_STRING environment variable.
In addition your bash script needs to be in the /var/www/cgi-bin directory.
Is selinux active? If so you need to permit script execution.

By default useradd requires root privileges. You could setup sudo and add the apache user to the sudoers file to run useradd although it is a bit of a security risk.

You should add some checks to verify the new user does not already exist as well as verify that username and password only contain valid characters.

This is old but does show an example of a bash cgi-bin script.

http://www.yolinux.com/TUTORIALS/BashShellCgi.html

172.17.1.1 is a private IP address (172.16.0.0 - 172.31.255.255)

I have echo and a read commands for both the user and passwd commands

echo "Enter UserName:"
read user

echo "Enter Password:"
read passwd

Not sure I understand how this fits into your web form?

why not add a little flare?

read -p "message" VarName

As I said to someone who wanted to do something similar, this is very dangerous, especially when exposed to everyone on the Internet. Of course such a thing is possible, but you need to think carefully about the wisdom of doing it.

if it helps the useradd comand i run as root when i run the script

i do have some checks in place if the user already exists -

if id $user ; then
echo "$user already exists as you can see above, please re-run the script"
exit
else
echo "$user not in system, ok to continue"
fi

Web html forms run as apache user not root and as stated can not run useradd by default. Again by allowing apache to run useradd your exposing your system to possible exploits. You need to filter the user name and limit length to 32.

luckily in my script i made a check to see if a user already exists as i copied my script in the cgi-bin folder in /var/www and i get this

https://s13.postimg.org/aqqc7fslz/create.png

this is my actual script, the script above i edited as i just wanted the script to add the ftp account and not do the echo/read and if statements as i wanted the html to do that bit

#!/bin/bash

dir=/mnt/sftp
group=sftp_users

echo "Enter UserName:"
read user

if id $user ; then
echo "$user already exists as you can see above, please re-run the script"
exit
else
echo "$user not in system, ok to continue"
fi

echo "Enter Password:"
read passwd
echo "$user:$passwd" >> /ftp_details/accounts.csv

useradd -g $group -d $dir/$user -s /sbin/nologin $user
mkdir -p $dir/$user/data
chown root $dir/$user
chmod 755 $dir/$user
chown $user $dir/$user/data
chmod 755 $dir/$user/data
touch $dir/$user/data/WARNING_everything_in_here_will_get_removed_in_14_days_time.txt

echo $user:$passwd | chpasswd

See the link in post #3.

You need to write a new script to parse the form post inputs and not use read statements. Although you can write the script in just about any language the most common to use for web development is typically php, ruby, perl or python for linux.

thanks michael, mmm may need to learn another programming language other than bash, i thought i could do all this via html intergrating with my bash script

i have read the post you linked, wheres the command to pass the variable from the html to the bash script?

From the link provided it is a bit more involved but no you can not use your script as is.

can i do this via an html form and make a submit button which passes on the users input to the bash script?

We seem to be going around in circles. Read the link. Do some research on cgi , dynamic html programming. Also reread the posts and consider the security implications.