Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm looking to create a web automation and administration area that users who have permissions to do system tasks can do them via them web, such as creating/editing users. I thought about making a system that syncs the system and web passwords, and when a user wants to do a specific task that requires root access, ask for their password for sudo and save the password in a session for a certain amount of time.

However, I realize this isn't a good practice, and if someone got access to session information they would be able to get the passwords for the users. So that led me to think about a Central Authentication Service for the system and the web users.

My questions are, is this possible, or has it been done? If so, how would I accomplish setting up this CAS system for web users and system users? How would I allow these CAS users to perform sudo actions? And, what other implications should I consider for this project?

share|improve this question

1 Answer 1

No need to sync the web server and system passwords, you can setup mod-auth-external to delegate user authentication to PAM. However it will only authenticate the user on the webserver (using the systems credentials), not on the system (it's probably safer that way).

For web-based remote administration, you should probably look at plesk, cPanel or Webmin that do exactly that. Be extra careful if you want to reimplement this functionality in your own application: it's a security nightmare.

share|improve this answer
plesk and cPanel are commercial tools. I'm slapping myself for saying this but maybe Webmin would be 'better'. But to clarify: Web Administration Tools are always a bad idea, because you can have a lot of security issues between the user and the system core (Browser, Network Communication, Webserver Implementation, Bugs in the Web Administration Software itself, bugs in the system that are only local exploitable but brought to the web with such tools, and so on). A lot of this tools caused a lot of systems being hijacked the past years and they are not easy to patch. – noggerl Oct 15 '13 at 16:37
@noggerl that was to answer the "has it been done", and the answer is clearly yes. I'll add webmin to the list, and you're definitely right it's a major security risk, so I'll update my answer to convey this as well. – Calimo Oct 15 '13 at 16:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.