Save password to temporary file instead of passing to subprocess in adduser

This prevents an attacker from monitoring the running processes and capturing passwords

adduser

@@ -21,7 +21,10 @@ def adduser(username, firstname, lastname, email, password):
     else:
         fullname = f'{firstname} {lastname}'
 
-    hashed_password = check_output(['openssl', 'passwd', '-6', password]).decode('utf-8')[:-1]
+    with open('password', 'w') as f:
+        f.write(password)
+    hashed_password = check_output(['openssl', 'passwd', '-6', '-in', 'password']).decode('utf-8')[:-1]
+    remove('password')
 
     # Construct LDIF
     ldif = f'''dn: uid={username},ou=People,dc=exozy,dc=me