The
utility allows users to change their NIS passwords and certain
other information using the
yppasswd(1)
and
ypchpass(1)
commands.
The
utility
is an RPC-based server that accepts incoming password change requests,
authenticates them, places the updated information in the
/var/yp/master.passwd
template file and then updates the NIS
master.passwd
and
passwd
maps.
The
utility allows a normal NIS user to change
his or her NIS password, full name (also
known as 'GECOS' field) or shell.
These updates are typically done using
the
yppasswd(1),
ypchfn(1),
ypchsh(1),
or
ypchpass(1)
commands.
(Some administrators do not want users to be able to change their
full name information or shells; the server can be invoked with option flags
that disallow such changes.)
When the server receives an update request,
it compares the address of the client making the request against the
securenets
rules outlined in
/var/yp/securenets
(See the
ypserv(8)
manual page for more information on securenets; the
utility uses the same access control mechanism as
ypserv(8).)
The server then
checks the 'old' password supplied by the user to make sure it is
valid, then performs some sanity checks on the updated information (these
include checking for embedded control characters, colons or invalid shells).
Once it is satisfied that the update request is valid, the server modifies
the template password file (the default is
/var/yp/master.passwd
and then runs the
/usr/libexec/yppwupdate
script to rebuild the NIS maps.
(This script has two arguments passed
to it: the absolute pathname of the password template that was modified
and the name of the domain that is to be updated.
These in turn are
passed to
/var/yp/Makefile )
The
Fx version of
also allows the super-user on the NIS master server to perform more
sophisticated updates on the NIS passwd maps.
The super-user can modify
any field in any user's master.passwd entry in any domain, and can
do so without knowing the user's existing NIS password (when the server
receives a request from the super-user, the password authentication
check is bypassed).
Furthermore, if the server is invoked with the
-a
flag, the super-user can even add new entries to the maps using
ypchpass(1).
Again, this only applies to the super-user on the NIS
master server: none of these special functions can be performed over
the network.
The
utility can only be run on a machine that is an NIS master server.
OPTIONS
The following options are available:
-t master.passwd template file
By default,
assumes that the template file used to generates the
master.passwd
and
passwd
maps for the default domain is called
/var/yp/master.passwd
This default can be overridden by specifying an alternate file name
with the
-t
flag.
Note: if the template file specified with this flag is
/etc/master.passwd
will also automatically invoke
pwd_mkdb8
to rebuild the local password databases in addition to the NIS
maps.
-d domain
The
utility can support multiple domains, however it must
choose one domain as a default.
It will try to use the system default domain name as set by the
domainname(1)
command for this default.
However,
if the system domain name is not
set, a default domain must be specified on
the command line.
If the system default domain is set,
then this option can be used to override it.
-p path
This option can be used to override the default path to
the location of the NIS
map databases.
The compiled-in default path is
/var/yp
-s
Disallow changing of shell information.
-f
Disallow changing of full name ('GECOS') information.
-a
Allow additions to be made to the NIS passwd databases.
The super-user on the
NIS master server is permitted to use the
ypchpass(1)
command to perform unrestricted modifications to any field in a user's
master.passwd
map entry.
When
is started with this flag, it will also allow the super-user to add new
records to the NIS passwd maps, just as is possible when using
chpass(1)
to modify the local password database.
-m
Turn on multi-domain mode.
Even though
ypserv(8)
can handle several simultaneous domains, most implementations of
can only operate on a single NIS domain, which is generally the same as
the system default domain of the NIS master server.
The
Fx
attempts to overcome this problem in spite of the inherent limitations
of the
yppasswd
protocol, which does not allow for a
domain
argument in client requests.
In multi-domain mode,
will search through all the passwd maps of all the domains it
can find under
/var/yp
until it finds an entry that matches the user information specified in
a given update request.
(Matches are determined by checking the username,
UID and GID fields.)
The matched entry and corresponding domain are then
used for the update.
Note that in order for multi-domain mode to work, there have to be
separate template files for each domain.
For example, if a server
supports three domains,
foo
bar
and
baz
there should be three separate master.passwd template files called
/var/yp/foo/master.passwd
/var/yp/bar/master.passwd
and
/var/yp/baz/master.passwd
If
foo
happens to be the system default domain, then its template file can
be either
/var/yp/foo/master.passwd
or
/var/yp/master.passwd
The server will check for the latter file first and then use the former
if it cannot find it.
Multi-domain mode is off by default since it can fail if there are
duplicate or near-duplicate user entries in different domains.
The server
will abort an update request if it finds more than one user entry that
matches its search criteria.
Even so, paranoid administrators
may wish to leave multi-domain mode disabled.
-i
If
is invoked with this flag, it will perform map updates in place.
This
means that instead of just modifying the password template file and
starting a map update, the server will modify the map databases
directly.
This is useful when the password maps are large: if, for
example, the password database has tens of thousands of entries, it
can take several minutes for a map update to complete.
Updating the
maps in place reduces this time to a few seconds.
-v
Turn on verbose logging mode.
The server normally only logs messages
using the
syslog(3)
facility when it encounters an error condition, or when processing
updates for the super-user on the NIS master server.
Running the server
with the
-v
flag will cause it to log informational messages for all updates.
-u
Many commercial
yppasswd(1)
clients do not use a reserved port when sending requests to
.
This is either because the
yppasswd(1)
program is not installed set-uid root, or because the RPC
implementation does not place any emphasis on binding to reserved
ports when establishing client connections for the super-user.
By default,
expects to receive requests from clients using reserved ports; requests
received from non-privileged ports are rejected.
Unfortunately, this
behavior prevents any client systems that to not use privileged
ports from successfully submitting password updates.
Specifying
the
-u
flag to
disables the privileged port check so that it will work with
yppasswd(1)
clients that do not use privileged ports.
This reduces security to
a certain small degree, but it might be necessary in cases where it
is not possible to change the client behavior.
-h
Display the list of flags and options understood by
.
FILES
/usr/libexec/yppwupdate
The script invoked by
to update and push the NIS maps after
an update.
/var/yp/master.passwd
The template password file for the default domain.
/var/yp/[domainname]/[maps]
The NIS maps for a particular NIS domain.
/var/yp/[domainname]/master.passwd
The template password file(s) for non-default domains
(used only in multi-domain mode).
As listed in the yppasswd.x protocol definition, the YPPASSWDPROC_UPDATE
procedure takes two arguments: a V7-style passwd structure containing
updated user information and the user's existing unencrypted (cleartext)
password.
Since
is supposed to handle update requests from remote NIS client machines,
this means that
yppasswd(1)
and similar client programs will in fact be transmitting users' cleartext
passwords over the network.
This is not a problem for password updates since the plaintext password
sent with the update will no longer be valid once the new encrypted password
is put into place, but if the user is only updating his or her 'GECOS'
information or shell, then the cleartext password sent with the update
will still be valid once the update is completed.
If the network is
insecure, this cleartext password could be intercepted and used to
gain unauthorized access to the user's account.
