SSH registration script

Question

Could anyone write or help me write a bash script that would do the fallowing:

New user connects to my FreeBSD server and log-ins via SSH with certain credentials like 'user registration, pass registration' or something similar. He is welcomed with a banner instructing him what to do next and a script is launched asking the user of his student id. Next, a new user is created with random password and the supplied ID and a mail is sent to [email protected] containing the password (as a method of student verification). After this procedure the student has a new, limited account on my server with supplied ID and a random, changeable password.

The idea is to make a script that often is used in MUD registration or shell accounts creation.

I guess the script would need to be executed on login, store the given credentials in a fields and later pass them to a sudo'ed adduser command. I've got only basic understanding of unix scripting and would appreciate any help.

EDIT:

Ok, so I tried something on my own:

#! /usr/local/bin/bash

clear
echo "--------------------------------------------------"
echo "                                                  "
echo "      Welcome to FreeBSD community server!        "
echo "                                                  "
echo "--------------------------------------------------"
echo
echo To create a new account enter your album number:
read ALBUM


if [ -d "/home/$ALBUM"  ]; then
        echo ""
        echo "User already exists!"
        echo ""
read
exit

else
        PASSWORD=`cat /dev/urandom |tr -cd A-Za-z0-9 | head -c 8`
        echo "Your FreeBSD server password is:

        $PASSWORD

        If you did not request one, ignore this message." | mail -s "Auth Credentials" [email protected]

        echo ""
        echo "Thank you, a new user has been created and a mail containing your password"
        echo "was sent to [email protected]"
        echo ""

        sudo pw useradd $ALBUM -d /home/$ALBUM -s /usr/local/bin/bash -m
        echo $PASSWORD | sudo pw mod user $ALBUM -h 0


read
exit
fi

Ok, thats what I've come up with. Any suggestions? The user the script is ran by is a sodoer with nopasswd for using the pw tool. Also, the script is autoran with 'source'.

Answer 1

You could try to write simple script with which you would replace standard shell for registration user (in /etc/passwd). This script would invoke some simple registration script via sudo (adding new user will require privileged user). Consider security issues of this approach - it's just idea, i haven't tried that.

Answer 2

You must be very careful with checking the input from the user, and with what you use that input for, to avoid any malicious user break into your system. E.g., what if the user manages to embed ":", newlines or backticks into his username?

Also, maybe you should consider running your newuser-script without root privileges. Thus it can't modify /etc/passwd, but would need to email the registration info to you (or something similar).

Consider also running the registration sshd process in a jail or virtual machine environment to minimize the consequences of an intrusion. These are just suggesitions.

Answer 3

For the record, I went with:

    #! /usr/local/bin/bash

clear
echo "--------------------------------------------------"
echo "                                                  "
echo "      Welcome to FreeBSD community server!        "
echo "                                                  "
echo "--------------------------------------------------"
echo
echo To create a new account enter your album number:
read ALBUM


if [ -d "/home/$ALBUM"  ]; then
        echo ""
        echo "User already exists!"
        echo ""
read
exit

else
        PASSWORD=`cat /dev/urandom |tr -cd A-Za-z0-9 | head -c 8`
        echo "Your FreeBSD server password is:

        $PASSWORD

        If you did not request one, ignore this message." | mail -s "Auth Credentials" [email protected]

        echo ""
        echo "Thank you, a new user has been created and a mail containing your password"
        echo "was sent to [email protected]"
        echo ""

        sudo pw useradd $ALBUM -d /home/$ALBUM -s /usr/local/bin/bash -m
        echo $PASSWORD | sudo pw mod user $ALBUM -h 0


read
exit
fi