linux - Changing user system passwords with a PHP script -

So I have a PHP script, which needs to change the Linux user password programmatically.

The script is running as www-data (which is the username given to Apache 2). I execute chpasswd with popen , and then fwrite username: password added. This is caused by an error.

Falling down from a shell shell, I try to see what is happening here. Naturally, I suspect that this is some kind of permission problem. Therefore, I change users to www-data and try to execute chpasswd manually:

  # Changing password for jsmith: www.catwd: jsmith (user jsmith) pam_chauthtok () failed, error: authentication token manipulation error chpasswd: (line1, user jesmith) password not changed  

So it shows that PHP is unable to execute the order. The error message is not exactly straightforward, but I think it's a summary that there was a problem (which basically means a Linux permission problem). Therefore, if I route to su , I can successfully change the password via chpasswd .

The problem here is obviously that there are no sudo privileges in apache2 (user www-data ). What is the only way to add www-data to sudo group? Because I did not want to do this. But I do not see any other option here.

More generally speaking - apart from the characteristics of this situation - how can theoretically possible for a web program which can be required to change user passwords to be able to do without sudo privileges? But if the web program has sudo privileges, then this is not a big security problem?

I will be setting up a queue system which runs as root and instead of having PHP Adding PHP to the queue has access to any privilege increase. This will also close some security holes, though Linux users still feel like a bad idea when there is a web interface to change the password.