How To: Use PHP to Change a Bluehost Email Account Password

This is a PHP script I wrote that allows you to incorporate an email password update option into your own webpage styling. Normally, with Bluehost (and FastDomain and HostMonster), your users can only change their email account password by either having the admin login to their cpanel and changing it for them, or by accessing the Bluehost provided webmail interface. Neither are very inviting solutions, especially in a professional environment.

The script works by accessing the shadow file associated with the email account’s domain name. It looks for the username whose password is being changed in the shadow file and, if found, compares the password stored in the shadow file with the password that the user enters as their current password. If those passwords match, it then updates the shadow file with the users’ new password. The password is stored in the shadow file as a Base64 encoded salted MD5 hash which is generated using either the PHP crypt function (if available) or the openssl command line.

This script will work out of the box, however, I recommend using it with the current visual theme of your website otherwise you’re defeating the purpose. The hidden input field named “domain” may be edited so that users only have to enter the name portion (ie: joesnuffy) of their email address without the domain portion. If left un-edited, your users will be required to enter in the domain portion of their email address along with the name portion (ie:

This script will work with Bluehost, FastDomain, HostMonster (all operated by Bluehost) and I’m guessing it will also work with any other host that uses cpanel (unverified).


$message = "";
$found = $valid = false;

if (isset($_POST['username']) && $_POST['username'] != "") {
    $domain_pos = strpos($_POST['username'], "@");
    if ($domain_pos === false) {
        $username = $_POST['username'];
        $domain = $_POST['domain'];
    } else {
        $username = substr($_POST['username'], 0, $domain_pos);
        $domain = substr($_POST['username'], $domain_pos + 1);
    $current_password = $_POST['current_password'];
    $new_password1 = $_POST['new_password1'];
    $new_password2 = $_POST['new_password2'];
    $root = $_SERVER['DOCUMENT_ROOT'];
    $path_elements = explode('/', $root);
    $root = "/{$path_elements[1]}/{$path_elements[2]}"; // for bluehost, extracts homedir ex: /homeN/blueuser may work with other hosts?
    $shadow_file = "$root/etc/$domain/shadow";

    // check if the shadow file exists. if not, either an invalid
    // domain was entered or this may not be a bluehost account...?
    if (file_exists($shadow_file)) {
        // compare the new passwords entered to ensure they match.    
        if ($new_password1 == $new_password2) {
            if (trim($new_password1) != "") {
                // get the contents of the shadow file.
                $shadow = file_get_contents($shadow_file);
                $lines = explode("\n", $shadow);
                // go through each line of shadow file, looking for username entered.
                for ($i = 0; $i < count($lines); $i++) {
                    $elements = explode(":", $lines[$i]);
                    // found the user...
                    if ($elements[0] == $username) {
                        $found = true;
                        $passwd = explode("$", $elements[1]);
                        $salt = $passwd[2]; // get the salt currently used 
                        // crypt the "Current Password" entered by user. Can use either builtin 
                        // php crypt function or command line openssl command.
                        if (CRYPT_MD5 == 1) { // indicates whether or not the crypt command supports MD5.
                            $current = crypt($current_password, '$1$'.$salt.'$');
                        } else {
                            $current = trim(`openssl passwd -1 -salt "$salt" "$current_password"`);
                        // check if the current password entered by the user
                        // matches the password in the shadow file.
                        $valid = ($current == $elements[1]);
                        if ($valid) {
                            // if they match then crypt the new password using the same salt
                            // and modify the line in the shadow file with the new hashed password
                            if (CRYPT_MD5 == 1) {
                                $new = crypt($new_password1, '$1$'.$salt.'$');
                            } else {
                                $new = trim(`openssl passwd -1 -salt "$salt" "$new_password1"`);
                            $elements[1] = $new;
                            $lines[$i] = implode(":", $elements);
                if (!$found) {
                    $message = "The username you entered is not valid.";
                } else if (!$valid) {
                    $message = "The password you entered is not valid.";
                } else {
                    // write the new contents of the shadow back to the shadow file.
                    $shadow = implode("\n", $lines);
                    file_put_contents($shadow_file, $shadow);
                    $message = 'Your password has been updated.';
            } else {
                $message = "Your password cannot be blank.";
        } else {
            $message = "Both new passwords must match.";
    } else {
        $message = "The domain you entered is not valid.";

?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" ""> 
<html xmlns=""> 
        <meta http-equiv="content-type" content="text/html; charset=UTF-8" /> 
        <title>Change Password</title>
            if ($message != "") {
                $color = $found && $valid ? "green" : "red";
                echo "<span style=\"color:$color;\">$message</span>";
        <form action="" method="post">
            <input type="hidden" name="domain" value="" />
                        <td><label for="username">Username</label></td> 
                        <td><input name="username" id="username" type="text" /></td> 
                        <td><label for="current_password">Current Password</label></td> 
                        <td><input name="current_password" id="current_password" type="password" /></td> 
                        <td><label for="new_password1">New Password</label></td> 
                        <td><input name="new_password1" id="new_password1" type="password" /></td> 
                        <td><label for="new_password2">New Password</label></td> 
                        <td><input name="new_password2" id="new_password2" type="password" /></td> 
                        <td colspan="2" style="text-align:center;">
                            <input type="submit" value="Update Password" />
Thursday, September 29th, 2011 coding, computers, linux, php, technology 1 Comment

Windows 7 as a Wi-Fi Access Point

Ever needed a wireless router but didn’t have one handy? Ever use an ad-hoc wireless network with Internet Connection Sharing to get other devices connected quickly? What if you have say an Android phone with no cell network data connection but really need to connect it to the Internet but don’t have a wireless router handy (Android won’t connect to an ad-hoc network without rooting the device)? Here’s how to setup Windows 7 to act as a Wi-Fi access point (aka infrastructure) for you and anyone else you want to allow to connect. Note: This doesn’t work on Windows 7 Starter Edition as Internet Connection Sharing is not enabled.

  1. Open an elevated command prompt.
  2. Execute the following command, replacing <some_ssid> with an ssid of your choosing and <some_passphrase> with a wpa2 compatible passphrase. If either contain spaces, enclose that portion of the command in quotes:
        netsh wlan set hostednetwork mode=allow <some_ssid> <some_passphrase> persistent
  3. Enable Internet Connection Sharing. See Using ICS (Internet Connection Sharing)
  4. Execute the following command, again using an elevated command prompt:
        netsh wlan start hostednetwork
  5. All done. Your other Wi-Fi devices should now see your wireless network and be able to connect to it.

Note: Using this method to connect an Android device, I could not get T-Mobile Wi-Fi Calling to connect to their service. I’m guessing the double-NAT would’ve caused an issue, although I have been able to connect through a double-NAT before.

Friday, September 23rd, 2011 computers, microsoft, technology, windows No Comments

Vonage Mobile on Android — How to find your SIP information

If you have Vonage Mobile on your Android based smartphone you know that you’re able to make free calls over WiFi. I’m currently in a different country using a satellite Internet connection and the Vonage Mobile app is having trouble staying connected to the WiFi here, so I’m using 3CXPhone setup with the SIP server information for Vonage Mobile which is working much better (I tried using fring, but people I called couldn’t hear me although I could hear them). Here are two methods on how to find your SIP information for Vonage Mobile so that you can use other devices or other Android apps with SIP capabilities.

Using ADB

  1. Install ADB (
  2. Turn on “USB Debugging” on your Android.
    On the device, to go the home screen, press MENU, select Applications > Development, then enable USB debugging.
  3. Connect your phone to your computer.
  4. Open a command prompt (Win+R, type “cmd”, press Enter)
  5. Type in “adb root
  6. Type in “adb shell
  7. Type in “cat /data/data/com.vonage.andrd/shared_prefs/VonageSettings.xml
  8. Your SIP username is where you see SipPrincipal in the xml file. Your SIP password is where you see SipPassword, and the SIP server (or proxy server) is where you see SipDomain.

Using a terminal emulator on your Android (like Better Terminal Emulator) for rooted phones ONLY:

  1. Type in “su
  2. Type in “cat /data/data/com.vonage.andrd/shared_prefs/VonageSettings.xml
  3. Your SIP username is where you see SipPrincipal in the xml file. Your SIP password is where you see SipPassword, and the SIP server (or proxy server) is where you see SipDomain.


Vonage Mobile for Android

3CXPhone for Android (VoIP)


Better Terminal Emulator Pro

Friday, July 30th, 2010 android, technology, voip 1 Comment

Install exFAT FUSE Module for Ubuntu with Read/Write Support

sudo apt-get install subversion scons libfuse-dev gcc
cd ~
svn co exfat-read-only
cd exfat-read-only
sudo scons install
cd ..
rm -rf exfat-read-only
sudo mkdir [mountpoint]
sudo mount -t exfat-fuse [device_path] [mountpoint]

Replace [device_path] with the device path to your exfat partition, for example: /dev/sdb1. Replace [mountpoint] with the path to your mount point, for example: /media/disk

Monday, July 5th, 2010 computers, data, linux, technology, ubuntu 14 Comments

Accessing an IMAP account using SSL (OpenSSL on Gmail)

C:\>openssl s_client -crlf -connect
depth=1 /C=US/O=Google Inc/CN=Google Internet Authority
verify error:num=20:unable to get local issuer certificate
verify return:0
Certificate chain
0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/
i:/C=US/O=Google Inc/CN=Google Internet Authority
1 s:/C=US/O=Google Inc/CN=Google Internet Authority
i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
Server certificate
subject=/C=US/ST=California/L=Mountain View/O=Google Inc/
issuer=/C=US/O=Google Inc/CN=Google Internet Authority
No client certificate CA names sent
SSL handshake has read 1704 bytes and written 300 bytes
New, TLSv1/SSLv3, Cipher is RC4-MD5
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
Protocol : TLSv1
Cipher : RC4-MD5
Session-ID: 059F9016BB7EF76FC1080A02368D4812EF5619D9176C176412A0A8F786C2E71C

Master-Key: EFE3B0BFEAE372829EA6B9B306BEB5BE2F5BBE5D325CF9F01940BB25C8353A16
Key-Arg : None
Start Time: 1264807587
Timeout : 300 (sec)
Verify return code: 20 (unable to get local issuer certificate)
* OK Gimap ready for requests from 31if8927301pzk.40
A01 LOGIN username password
A01 OK username authenticated (Success)
* FLAGS (\Answered \Flagged \Draft \Deleted \Seen)
* OK [PERMANENTFLAGS (\Answered \Flagged \Draft \Deleted \Seen \*)]
* 2636 EXISTS
* OK [UIDNEXT 15043]
A02 OK [READ-WRITE] INBOX selected. (Success)
+ idling
A04 OK IDLE terminated (Success)
* BYE LOGOUT Requested
A05 OK 73 good day (Success)

Friday, January 29th, 2010 computers, google, linux, technology 2 Comments

Convert NRG to ISO using DD

Earlier this week I was on a mission to convert an NRG image file to an ISO image file. I didn’t want to download a program that someone had already written like nrg2iso and instead preferred to use something like the linux dd command or write my own program that could do. I started digging into the NRG file format and found that it’s actually an IFF file. The documentation on how Nero implemented the IFF format into their NRG files isn’t very clear at all and is incorrect so with the information I was able to find I had to reverse engineer the format myself. Here’s how to convert an NRG image to ISO using the dd command (if you’re on windows you can install Cygwin to gain access to the dd command).

An NRG image is a CD-ROM image followed by Nero’s “footer” about the image, it’s cue sheets, cd text, and so on. The last twelve bytes of an NRG image file contain the NER5 header and an offset to the first CUE sheet of the image. Even though this offset is just a pointer to the first CUE sheet, you can use it determine the actual length of the image. Here’s what to do with dd.

  1. First, take the filesize of the NRG file and subtract 12 from it. Here, my NRG is 964,984,988 bytes. So I’m going to use 964984976 for the skip parameter of the dd command like so:
    dd ibs=1 skip=964984976 if=Image.nrg of=footer.dat
  2. That will give you a 12 byte file named footer.dat. Open footer.dat in your favorite HEX Editor (I use UltraEdit-32).
  3. The first four bytes you should see is NER5. The next eight bytes is a 64-bit number that points to the first CUE sheet. Open Calculator. Set it for Scientific view (Programmer view in Windows 7, maybe Windows Vista too?). Change to Hex mode and type in exactly what you see for those eight bytes. My Hex heditor shows 00 00 00 00 39 84 80 00. So in Calculator I type in 39848000 (you can drop all leading zeros since this is a little-endian number).
  4. Now switch back to Decimal mode. The Hex number you typed in will change to a Decimal number (964984832 in my case), this is the offset at which the first CUE sheet exists in the NRG image. It also happens to be (in most cases) the length of the cd image. Since the cd image is the first thing in the NRG file, all you have to do now is extract the contents of the image into your ISO file.
  5. Divide your decimal offset number by 2048. For me, 964984832 / 2048 = 471184. That’s how many blocks (a block being 2048 bytes for us) we’re going to copy from the NRG file to the ISO file. Now just run the DD command:
    dd ibs=2048 count=471184 if=Image.nrg of=Image.iso

That’s it.. now mount your ISO image to a virtual cd/dvd/bd drive like Virtual CloneDrive (or burn it) and make sure it works before deleting your NRG file.

Sunday, October 11th, 2009 computers, data, linux, technology, ubuntu No Comments