1.\" Copyright (c) 1995, 1996 2.\" Bill Paul <wpaul@ctr.columbia.edu>. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by Bill Paul. 15.\" 4. Neither the name of the author nor the names of contributors 16.\" may be used to endorse or promote products derived from this software 17.\" without specific prior written permission. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL Bill Paul OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" $FreeBSD: src/usr.sbin/rpc.yppasswdd/rpc.yppasswdd.8,v 1.25 2005/02/13 23:45:53 ru Exp $ 32.\" $DragonFly: src/usr.sbin/rpc.yppasswdd/rpc.yppasswdd.8,v 1.4 2006/02/17 19:40:24 swildner Exp $ 33.\" 34.Dd February 8, 1996 35.Dt RPC.YPPASSWDD 8 36.Os 37.Sh NAME 38.Nm rpc.yppasswdd 39.Nd "server for updating NIS passwords" 40.Sh SYNOPSIS 41.Nm 42.Op Fl t Ar master.passwd template file 43.Op Fl d Ar default domain 44.Op Fl p Ar path 45.Op Fl s 46.Op Fl f 47.Op Fl a 48.Op Fl m 49.Op Fl i 50.Op Fl v 51.Op Fl u 52.Op Fl h 53.Sh DESCRIPTION 54The 55.Nm 56utility allows users to change their NIS passwords and certain 57other information using the 58.Xr yppasswd 1 59and 60.Xr ypchpass 1 61commands. 62The 63.Nm 64utility 65is an RPC-based server that accepts incoming password change requests, 66authenticates them, places the updated information in the 67.Pa /var/yp/master.passwd 68template file and then updates the NIS 69.Pa master.passwd 70and 71.Pa passwd 72maps. 73.Pp 74The 75.Nm 76utility allows a normal NIS user to change 77his or her NIS password, full name (also 78known as 'GECOS' field) or shell. 79These updates are typically done using 80the 81.Xr yppasswd 1 , 82.Xr ypchfn 1 , 83.Xr ypchsh 1 , 84or 85.Xr ypchpass 1 86commands. 87(Some administrators do not want users to be able to change their 88full name information or shells; the server can be invoked with option flags 89that disallow such changes.) 90When the server receives an update request, 91it compares the address of the client making the request against the 92.Pa securenets 93rules outlined in 94.Pa /var/yp/securenets . 95(See the 96.Xr ypserv 8 97manual page for more information on securenets; the 98.Nm 99utility uses the same access control mechanism as 100.Xr ypserv 8 . ) 101.Pp 102The server then 103checks the 'old' password supplied by the user to make sure it is 104valid, then performs some sanity checks on the updated information (these 105include checking for embedded control characters, colons or invalid shells). 106Once it is satisfied that the update request is valid, the server modifies 107the template password file (the default is 108.Pa /var/yp/master.passwd ) 109and then runs the 110.Pa /usr/libexec/yppwupdate 111script to rebuild the NIS maps. 112(This script has two arguments passed 113to it: the absolute pathname of the password template that was modified 114and the name of the domain that is to be updated. 115These in turn are 116passed to 117.Pa /var/yp/Makefile ) . 118.Pp 119The 120.Dx 121version of 122.Nm 123also allows the super-user on the NIS master server to perform more 124sophisticated updates on the NIS passwd maps. 125The super-user can modify 126any field in any user's master.passwd entry in any domain, and can 127do so without knowing the user's existing NIS password (when the server 128receives a request from the super-user, the password authentication 129check is bypassed). 130Furthermore, if the server is invoked with the 131.Fl a 132flag, the super-user can even add new entries to the maps using 133.Xr ypchpass 1 . 134Again, this only applies to the super-user on the NIS 135master server: none of these special functions can be performed over 136the network. 137.Pp 138The 139.Nm 140utility can only be run on a machine that is an NIS master server. 141.Sh OPTIONS 142The following options are available: 143.Bl -tag -width indent 144.It Fl t Ar master.passwd template file 145By default, 146.Nm 147assumes that the template file used to generates the 148.Pa master.passwd 149and 150.Pa passwd 151maps for the default domain is called 152.Pa /var/yp/master.passwd . 153This default can be overridden by specifying an alternate file name 154with the 155.Fl t 156flag. 157.Pp 158Note: if the template file specified with this flag is 159.Pa /etc/master.passwd , 160.Nm 161will also automatically invoke 162.Xr pwd_mkdb 8 163to rebuild the local password databases in addition to the NIS 164maps. 165.It Fl d Ar domain 166The 167.Nm 168utility can support multiple domains, however it must 169choose one domain as a default. 170It will try to use the system default domain name as set by the 171.Xr domainname 1 172command for this default. 173However, 174if the system domain name is not 175set, a default domain must be specified on 176the command line. 177If the system default domain is set, 178then this option can be used to override it. 179.It Fl p Ar path 180This option can be used to override the default path to 181the location of the NIS 182map databases. 183The compiled-in default path is 184.Pa /var/yp . 185.It Fl s 186Disallow changing of shell information. 187.It Fl f 188Disallow changing of full name ('GECOS') information. 189.It Fl a 190Allow additions to be made to the NIS passwd databases. 191The super-user on the 192NIS master server is permitted to use the 193.Xr ypchpass 1 194command to perform unrestricted modifications to any field in a user's 195.Pa master.passwd 196map entry. 197When 198.Nm 199is started with this flag, it will also allow the super-user to add new 200records to the NIS passwd maps, just as is possible when using 201.Xr chpass 1 202to modify the local password database. 203.It Fl m 204Turn on multi-domain mode. 205Even though 206.Xr ypserv 8 207can handle several simultaneous domains, most implementations of 208.Nm 209can only operate on a single NIS domain, which is generally the same as 210the system default domain of the NIS master server. 211The 212.Dx 213.Nm 214attempts to overcome this problem in spite of the inherent limitations 215of the 216.Pa yppasswd 217protocol, which does not allow for a 218.Pa domain 219argument in client requests. 220In multi-domain mode, 221.Nm 222will search through all the passwd maps of all the domains it 223can find under 224.Pa /var/yp 225until it finds an entry that matches the user information specified in 226a given update request. 227(Matches are determined by checking the username, 228UID and GID fields.) 229The matched entry and corresponding domain are then 230used for the update. 231.Pp 232Note that in order for multi-domain mode to work, there have to be 233separate template files for each domain. 234For example, if a server 235supports three domains, 236.Pa foo , 237.Pa bar , 238and 239.Pa baz , 240there should be three separate master.passwd template files called 241.Pa /var/yp/foo/master.passwd , 242.Pa /var/yp/bar/master.passwd , 243and 244.Pa /var/yp/baz/master.passwd . 245If 246.Pa foo 247happens to be the system default domain, then its template file can 248be either 249.Pa /var/yp/foo/master.passwd 250or 251.Pa /var/yp/master.passwd . 252The server will check for the latter file first and then use the former 253if it cannot find it. 254.Pp 255Multi-domain mode is off by default since it can fail if there are 256duplicate or near-duplicate user entries in different domains. 257The server 258will abort an update request if it finds more than one user entry that 259matches its search criteria. 260Even so, paranoid administrators 261may wish to leave multi-domain mode disabled. 262.It Fl i 263If 264.Nm 265is invoked with this flag, it will perform map updates in place. 266This 267means that instead of just modifying the password template file and 268starting a map update, the server will modify the map databases 269directly. 270This is useful when the password maps are large: if, for 271example, the password database has tens of thousands of entries, it 272can take several minutes for a map update to complete. 273Updating the 274maps in place reduces this time to a few seconds. 275.It Fl v 276Turn on verbose logging mode. 277The server normally only logs messages 278using the 279.Xr syslog 3 280facility when it encounters an error condition, or when processing 281updates for the super-user on the NIS master server. 282Running the server 283with the 284.Fl v 285flag will cause it to log informational messages for all updates. 286.It Fl u 287Many commercial 288.Xr yppasswd 1 289clients do not use a reserved port when sending requests to 290.Nm . 291This is either because the 292.Xr yppasswd 1 293program is not installed set-uid root, or because the RPC 294implementation does not place any emphasis on binding to reserved 295ports when establishing client connections for the super-user. 296By default, 297.Nm 298expects to receive requests from clients using reserved ports; requests 299received from non-privileged ports are rejected. 300Unfortunately, this 301behavior prevents any client systems that to not use privileged 302ports from successfully submitting password updates. 303Specifying 304the 305.Fl u 306flag to 307.Nm 308disables the privileged port check so that it will work with 309.Xr yppasswd 1 310clients that do not use privileged ports. 311This reduces security to 312a certain small degree, but it might be necessary in cases where it 313is not possible to change the client behavior. 314.It Fl h 315Display the list of flags and options understood by 316.Nm . 317.El 318.Sh FILES 319.Bl -tag -width Pa -compact 320.It Pa /usr/libexec/yppwupdate 321The script invoked by 322.Nm 323to update and push the NIS maps after 324an update. 325.It Pa /var/yp/master.passwd 326The template password file for the default domain. 327.It Pa /var/yp/[domainname]/[maps] 328The NIS maps for a particular NIS domain. 329.It Pa /var/yp/[domainname]/master.passwd 330The template password file(s) for non-default domains 331(used only in multi-domain mode). 332.El 333.Sh SEE ALSO 334.Xr yp 8 , 335.Xr yppush 8 , 336.Xr ypserv 8 , 337.Xr ypxfr 8 338.Sh AUTHORS 339.An Bill Paul Aq wpaul@ctr.columbia.edu 340.Sh BUGS 341As listed in the yppasswd.x protocol definition, the YPPASSWDPROC_UPDATE 342procedure takes two arguments: a V7-style passwd structure containing 343updated user information and the user's existing unencrypted (cleartext) 344password. 345Since 346.Nm 347is supposed to handle update requests from remote NIS client machines, 348this means that 349.Xr yppasswd 1 350and similar client programs will in fact be transmitting users' cleartext 351passwords over the network. 352.Pp 353This is not a problem for password updates since the plaintext password 354sent with the update will no longer be valid once the new encrypted password 355is put into place, but if the user is only updating his or her 'GECOS' 356information or shell, then the cleartext password sent with the update 357will still be valid once the update is completed. 358If the network is 359insecure, this cleartext password could be intercepted and used to 360gain unauthorized access to the user's account. 361