1.\" Copyright (c) 1988, 1990, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)chpass.1 8.2 (Berkeley) 12/30/93 33.\" $FreeBSD: src/usr.bin/chpass/chpass.1,v 1.39 2005/08/02 21:38:02 seanc Exp $ 34.\" $DragonFly: src/usr.bin/chpass/chpass.1,v 1.4 2006/02/17 19:38:58 swildner Exp $ 35.\" 36.Dd December 30, 1993 37.Dt CHPASS 1 38.Os 39.Sh NAME 40.Nm chpass , 41.Nm chfn , 42.Nm chsh , 43.Nm ypchpass , 44.Nm ypchfn , 45.Nm ypchsh 46.Nd add or change user database information 47.Sh SYNOPSIS 48.Nm 49.Op Fl a Ar list 50.Op Fl p Ar encpass 51.Op Fl e Ar expiretime 52.Op Fl s Ar newshell 53.Op user 54.Nm 55.Op Fl oly 56.Op Fl a Ar list 57.Op Fl p Ar encpass 58.Op Fl e Ar expiretime 59.Op Fl s Ar newshell 60.Op Fl d Ar domain 61.Op Fl h Ar host 62.Op user 63.Sh DESCRIPTION 64The 65.Nm 66utility 67allows editing of the user database information associated 68with 69.Ar user 70or, by default, the current user. 71.Pp 72The 73.Nm chfn , 74.Nm chsh , 75.Nm ypchpass , 76.Nm ypchfn 77and 78.Nm ypchsh 79utilities behave identically to 80.Nm . 81(There is only one program.) 82.Pp 83The information is formatted and supplied to an editor for changes. 84.Pp 85Only the information that the user is allowed to change is displayed. 86.Pp 87The options are as follows: 88.Bl -tag -width indent 89.It Fl a 90The super-user is allowed to directly supply a user database 91entry, in the format specified by 92.Xr passwd 5 , 93as an argument. 94This argument must be a colon 95.Pq Dq \&: 96separated list of all the 97user database fields, although they may be empty. 98.It Fl p 99The super-user is allowed to directly supply an encrypted password field, 100in the format used by 101.Xr crypt 3 , 102as an argument. 103.It Fl e Ar expiretime 104Change the account expire time. 105This option is used to set the expire time 106from a script as if it was done in the interactive editor. 107.It Fl s Ar newshell 108Attempt to change the user's shell to 109.Ar newshell . 110.El 111.Pp 112Possible display items are as follows: 113.Pp 114.Bl -tag -width "Other Information:" -compact -offset indent 115.It Login: 116user's login name 117.It Password: 118user's encrypted password 119.It Uid: 120user's login 121.It Gid: 122user's login group 123.It Class: 124user's general classification 125.It Change: 126password change time 127.It Expire: 128account expiration time 129.It Full Name: 130user's real name 131.It Office Location: 132user's office location (1) 133.It Office Phone: 134user's office phone (1) 135.It Home Phone: 136user's home phone (1) 137.It Other Information: 138any locally defined parameters for user (1) 139.It Home Directory: 140user's home directory 141.It Shell: 142user's login shell 143.Pp 144.It NOTE(1) - 145In the actual master.passwd file, these fields are comma-delimited 146fields embedded in the FullName field. 147.El 148.Pp 149The 150.Ar login 151field is the user name used to access the computer account. 152.Pp 153The 154.Ar password 155field contains the encrypted form of the user's password. 156.Pp 157The 158.Ar uid 159field is the number associated with the 160.Ar login 161field. 162Both of these fields should be unique across the system (and often 163across a group of systems) as they control file access. 164.Pp 165While it is possible to have multiple entries with identical login names 166and/or identical user id's, it is usually a mistake to do so. 167Routines 168that manipulate these files will often return only one of the multiple 169entries, and that one by random selection. 170.Pp 171The 172.Ar group 173field is the group that the user will be placed in at login. 174Since 175.Bx 176supports multiple groups (see 177.Xr groups 1 ) 178this field currently has little special meaning. 179This field may be filled in with either a number or a group name (see 180.Xr group 5 ) . 181.Pp 182The 183.Ar class 184field references class descriptions in 185.Pa /etc/login.conf 186and is typically used to initialize the user's system resource limits 187when they login. 188.Pp 189The 190.Ar change 191field is the date by which the password must be changed. 192.Pp 193The 194.Ar expire 195field is the date on which the account expires. 196.Pp 197Both the 198.Ar change 199and 200.Ar expire 201fields should be entered in the form 202.Dq month day year 203where 204.Ar month 205is the month name (the first three characters are sufficient), 206.Ar day 207is the day of the month, and 208.Ar year 209is the year. 210.Pp 211Five fields are available for storing the user's 212.Ar full name , office location , 213.Ar work 214and 215.Ar home telephone 216numbers and finally 217.Ar other information 218which is a single comma delimited string to represent any additional 219gecos fields (typically used for site specific user information). 220Note that 221.Xr finger 1 222will display the office location and office phone together under the 223heading 224.Ar Office: . 225.Pp 226The user's 227.Ar home directory 228is the full 229.Ux 230path name where the user 231will be placed at login. 232.Pp 233The 234.Ar shell 235field is the command interpreter the user prefers. 236If the 237.Ar shell 238field is empty, the Bourne shell, 239.Pa /bin/sh , 240is assumed. 241When altering a login shell, and not the super-user, the user 242may not change from a non-standard shell or to a non-standard 243shell. 244Non-standard is defined as a shell not found in 245.Pa /etc/shells . 246.Pp 247Once the information has been verified, 248.Nm 249uses 250.Xr pwd_mkdb 8 251to update the user database. 252.Sh ENVIRONMENT 253The 254.Xr vi 1 255editor will be used unless the environment variable 256.Ev EDITOR 257is set to 258an alternate editor. 259When the editor terminates, the information is re-read and used to 260update the user database itself. 261Only the user, or the super-user, may edit the information associated 262with the user. 263.Pp 264See 265.Xr pwd_mkdb 8 266for an explanation of the impact of setting the 267.Ev PW_SCAN_BIG_IDS 268environment variable. 269.Sh NIS INTERACTION 270The 271.Nm 272utility can also be used in conjunction with NIS, however some restrictions 273apply. 274Currently, 275.Nm 276can only make changes to the NIS passwd maps through 277.Xr rpc.yppasswdd 8 , 278which normally only permits changes to a user's password, shell and GECOS 279fields. 280Except when invoked by the super-user on the NIS master server, 281.Nm 282(and, similarly, 283.Xr passwd 1 ) 284cannot use the 285.Xr rpc.yppasswdd 8 286server to change other user information or 287add new records to the NIS passwd maps. 288Furthermore, 289.Xr rpc.yppasswdd 8 290requires password authentication before it will make any 291changes. 292The only user allowed to submit changes without supplying 293a password is the super-user on the NIS master server; all other users, 294including those with root privileges on NIS clients (and NIS slave 295servers) must enter a password. 296(The super-user on the NIS master is allowed to bypass these restrictions 297largely for convenience: a user with root access 298to the NIS master server already has the privileges required to make 299updates to the NIS maps, but editing the map source files by hand can 300be cumbersome. 301.Pp 302Note: these exceptions only apply when the NIS master server is a 303.Fx 304or 305.Dx 306system). 307.Pp 308Consequently, except where noted, the following restrictions apply when 309.Nm 310is used with NIS: 311.Bl -enum -offset indent 312.It 313.Em "Only the shell and GECOS information may be changed" . 314All other 315fields are restricted, even when 316.Nm 317is invoked by the super-user. 318While support for 319changing other fields could be added, this would lead to 320compatibility problems with other NIS-capable systems. 321Even though the super-user may supply data for other fields 322while editing an entry, the extra information (other than the 323password -- see below) will be silently discarded. 324.Pp 325Exception: the super-user on the NIS master server is permitted to 326change any field. 327.Pp 328.It 329.Em "Password authentication is required" . 330The 331.Nm 332utility will prompt for the user's NIS password before effecting 333any changes. 334If the password is invalid, all changes will be 335discarded. 336.Pp 337Exception: the super-user on the NIS master server is allowed to 338submit changes without supplying a password. 339(The super-user may 340choose to turn off this feature using the 341.Fl o 342flag, described below.) 343.It 344.Em "Adding new records to the local password database is discouraged" . 345The 346.Nm 347utility will allow the administrator to add new records to the 348local password database while NIS is enabled, but this can lead to 349some confusion since the new records are appended to the end of 350the master password file, usually after the special NIS '+' entries. 351The administrator should use 352.Xr vipw 8 353to modify the local password 354file when NIS is running. 355.Pp 356The super-user on the NIS master server is permitted to add new records 357to the NIS password maps, provided the 358.Xr rpc.yppasswdd 8 359server has been started with the 360.Fl a 361flag to permitted additions (it refuses them by default). 362The 363.Nm 364utility tries to update the local password database by default; to update the 365NIS maps instead, invoke chpass with the 366.Fl y 367flag. 368.It 369.Em "Password changes are not permitted". 370Users should use 371.Xr passwd 1 372or 373.Xr yppasswd 1 374to change their NIS passwords. 375The super-user is allowed to specify 376a new password (even though the 377.Dq Password: 378field does not show 379up in the editor template, the super-user may add it back by hand), 380but even the super-user must supply the user's original password 381otherwise 382.Xr rpc.yppasswdd 8 383will refuse to update the NIS maps. 384.Pp 385Exception: the super-user on the NIS master server is permitted to 386change a user's NIS password with 387.Nm . 388.El 389.Pp 390There are also a few extra option flags that are available when 391.Nm 392is compiled with NIS support: 393.Bl -tag -width indent 394.It Fl l 395Force 396.Nm 397to modify the local copy of a user's password 398information in the event that a user exists in both 399the local and NIS databases. 400.It Fl y 401Opposite effect of 402.Fl l . 403This flag is largely redundant since 404.Nm 405operates on NIS entries by default if NIS is enabled. 406.It Fl d Ar domain 407Specify a particular NIS domain. 408The 409.Nm 410utility uses the system domain name by default, as set by the 411.Xr domainname 1 412utility. 413The 414.Fl d 415option can be used to override a default, or to specify a domain 416when the system domain name is not set. 417.It Fl h Ar host 418Specify the name or address of an NIS server to query. 419Normally, 420.Nm 421will communicate with the NIS master host specified in the 422.Pa master.passwd 423or 424.Pa passwd 425maps. 426On hosts that have not been configured as NIS clients, there is 427no way for the program to determine this information unless the user 428provides the hostname of a server. 429Note that the specified hostname need 430not be that of the NIS master server; the name of any server, master or 431slave, in a given NIS domain will do. 432.Pp 433When using the 434.Fl d 435option, the hostname defaults to 436.Dq localhost . 437The 438.Fl h 439option can be used in conjunction with the 440.Fl d 441option, in which case the user-specified hostname will override 442the default. 443.Pp 444.It Fl o 445Force the use of RPC-based updates when communicating with 446.Xr rpc.yppasswdd 8 447.Pq Dq old-mode . 448When invoked by the super-user on the NIS master server, 449.Nm 450allows unrestricted changes to the NIS passwd maps using dedicated, 451non-RPC-based mechanism (in this case, a 452.Ux 453domain socket). 454The 455.Fl o 456flag can be used to force 457.Nm 458to use the standard update mechanism instead. 459This option is provided 460mainly for testing purposes. 461.El 462.Sh FILES 463.Bl -tag -width /etc/master.passwd -compact 464.It Pa /etc/master.passwd 465the user database 466.It Pa /etc/passwd 467a Version 7 format password file 468.It Pa /etc/chpass.XXXXXX 469temporary copy of the password file 470.It Pa /etc/shells 471the list of approved shells 472.El 473.Sh SEE ALSO 474.Xr finger 1 , 475.Xr login 1 , 476.Xr passwd 1 , 477.Xr getusershell 3 , 478.Xr login.conf 5 , 479.Xr passwd 5 , 480.Xr pw 8 , 481.Xr pwd_mkdb 8 , 482.Xr vipw 8 483.Rs 484.%A Robert Morris 485and 486.%A Ken Thompson 487.%T "UNIX Password security" 488.Re 489.Sh HISTORY 490The 491.Nm 492utility appeared in 493.Bx 4.3 Reno . 494.Sh BUGS 495User information should (and eventually will) be stored elsewhere. 496