RPC.YPPASSWDD(8) FreeBSD System Manager's Manual RPC.YPPASSWDD(8)
NAME
rpc.yppasswdd - server for updating NIS passwords
SYNOPSIS
rpc.yppasswdd [-t master.passwd template file] [-d default domain]
[-p path] [-s] [-f] [-a] [-m] [-i] [-v] [-u] [-h]
DESCRIPTION
The rpc.yppasswdd utility allows users to change their NIS passwords and
certain other information using the yppasswd(1) and ypchpass(1) commands.
The rpc.yppasswdd utility is an RPC-based server that accepts incoming
password change requests, authenticates them, places the updated
information in the /var/yp/master.passwd template file and then updates
the NIS master.passwd and passwd maps.
The rpc.yppasswdd utility allows a normal NIS user to change his or her
NIS password, full name (also known as 'GECOS' field) or shell. These
updates are typically done using the yppasswd(1), ypchfn(1), ypchsh(1),
or ypchpass(1) commands. (Some administrators do not want users to be
able to change their full name information or shells; the server can be
invoked with option flags that disallow such changes.) When the server
receives an update request, it compares the address of the client making
the request against the securenets rules outlined in /var/yp/securenets.
(See the ypserv(8) manual page for more information on securenets; the
rpc.yppasswdd utility uses the same access control mechanism as
ypserv(8).)
The server then checks the 'old' password supplied by the user to make
sure it is valid, then performs some sanity checks on the updated
information (these include checking for embedded control characters,
colons or invalid shells). Once it is satisfied that the update request
is valid, the server modifies the template password file (the default is
/var/yp/master.passwd) and then runs the /usr/libexec/yppwupdate script
to rebuild the NIS maps. (This script has two arguments passed to it:
the absolute pathname of the password template that was modified and the
name of the domain that is to be updated. These in turn are passed to
/var/yp/Makefile).
The FreeBSD version of rpc.yppasswdd also allows the super-user on the
NIS master server to perform more sophisticated updates on the NIS passwd
maps. The super-user can modify any field in any user's master.passwd
entry in any domain, and can do so without knowing the user's existing
NIS password (when the server receives a request from the super-user, the
password authentication check is bypassed). Furthermore, if the server
is invoked with the -a flag, the super-user can even add new entries to
the maps using ypchpass(1). Again, this only applies to the super-user
on the NIS master server: none of these special functions can be
performed over the network.
The rpc.yppasswdd utility can only be run on a machine that is an NIS
master server.
OPTIONS
The following options are available:
-t master.passwd template file
By default, rpc.yppasswdd assumes that the template file used to
generates the master.passwd and passwd maps for the default
domain is called /var/yp/master.passwd. This default can be
overridden by specifying an alternate file name with the -t flag.
Note: if the template file specified with this flag is
/etc/master.passwd, rpc.yppasswdd will also automatically invoke
pwd_mkdb(8) to rebuild the local password databases in addition
to the NIS maps.
-d domain
The rpc.yppasswdd utility can support multiple domains, however
it must choose one domain as a default. It will try to use the
system default domain name as set by the domainname(1) command
for this default. However, if the system domain name is not set,
a default domain must be specified on the command line. If the
system default domain is set, then this option can be used to
override it.
-p path
This option can be used to override the default path to the
location of the NIS map databases. The compiled-in default path
is /var/yp.
-s Disallow changing of shell information.
-f Disallow changing of full name ('GECOS') information.
-a Allow additions to be made to the NIS passwd databases. The
super-user on the NIS master server is permitted to use the
ypchpass(1) command to perform unrestricted modifications to any
field in a user's master.passwd map entry. When rpc.yppasswdd is
started with this flag, it will also allow the super-user to add
new records to the NIS passwd maps, just as is possible when
using chpass(1) to modify the local password database.
-m Turn on multi-domain mode. Even though ypserv(8) can handle
several simultaneous domains, most implementations of
rpc.yppasswdd can only operate on a single NIS domain, which is
generally the same as the system default domain of the NIS master
server. The FreeBSD rpc.yppasswdd attempts to overcome this
problem in spite of the inherent limitations of the yppasswd
protocol, which does not allow for a domain argument in client
requests. In multi-domain mode, rpc.yppasswdd will search
through all the passwd maps of all the domains it can find under
/var/yp until it finds an entry that matches the user information
specified in a given update request. (Matches are determined by
checking the username, UID and GID fields.) The matched entry
and corresponding domain are then used for the update.
Note that in order for multi-domain mode to work, there have to
be separate template files for each domain. For example, if a
server supports three domains, foo, bar, and baz, there should be
three separate master.passwd template files called
/var/yp/foo/master.passwd, /var/yp/bar/master.passwd, and
/var/yp/baz/master.passwd. If foo happens to be the system
default domain, then its template file can be either
/var/yp/foo/master.passwd or /var/yp/master.passwd. The server
will check for the latter file first and then use the former if
it cannot find it.
Multi-domain mode is off by default since it can fail if there
are duplicate or near-duplicate user entries in different
domains. The server will abort an update request if it finds
more than one user entry that matches its search criteria. Even
so, paranoid administrators may wish to leave multi-domain mode
disabled.
-i If rpc.yppasswdd is invoked with this flag, it will perform map
updates in place. This means that instead of just modifying the
password template file and starting a map update, the server will
modify the map databases directly. This is useful when the
password maps are large: if, for example, the password database
has tens of thousands of entries, it can take several minutes for
a map update to complete. Updating the maps in place reduces
this time to a few seconds.
-v Turn on verbose logging mode. The server normally only logs
messages using the syslog(3) facility when it encounters an error
condition, or when processing updates for the super-user on the
NIS master server. Running the server with the -v flag will
cause it to log informational messages for all updates.
-u Many commercial yppasswd(1) clients do not use a reserved port
when sending requests to rpc.yppasswdd. This is either because
the yppasswd(1) program is not installed set-uid root, or because
the RPC implementation does not place any emphasis on binding to
reserved ports when establishing client connections for the
super-user. By default, rpc.yppasswdd expects to receive
requests from clients using reserved ports; requests received
from non-privileged ports are rejected. Unfortunately, this
behavior prevents any client systems that to not use privileged
ports from successfully submitting password updates. Specifying
the -u flag to rpc.yppasswdd disables the privileged port check
so that it will work with yppasswd(1) clients that do not use
privileged ports. This reduces security to a certain small
degree, but it might be necessary in cases where it is not
possible to change the client behavior.
-h Display the list of flags and options understood by
rpc.yppasswdd.
FILES
/usr/libexec/yppwupdate The script invoked by rpc.yppasswdd to
update and push the NIS maps after an
update.
/var/yp/master.passwd The template password file for the
default domain.
/var/yp/[domainname]/[maps] The NIS maps for a particular NIS
domain.
/var/yp/[domainname]/master.passwd
The template password file(s) for non-
default domains (used only in multi-
domain mode).
SEE ALSO
yp(8), yppush(8), ypserv(8), ypxfr(8)
AUTHORS
Bill Paul <wpaul@ctr.columbia.edu>
BUGS
As listed in the yppasswd.x protocol definition, the YPPASSWDPROC_UPDATE
procedure takes two arguments: a V7-style passwd structure containing
updated user information and the user's existing unencrypted (cleartext)
password. Since rpc.yppasswdd is supposed to handle update requests from
remote NIS client machines, this means that yppasswd(1) and similar
client programs will in fact be transmitting users' cleartext passwords
over the network.
This is not a problem for password updates since the plaintext password
sent with the update will no longer be valid once the new encrypted
password is put into place, but if the user is only updating his or her
'GECOS' information or shell, then the cleartext password sent with the
update will still be valid once the update is completed. If the network
is insecure, this cleartext password could be intercepted and used to
gain unauthorized access to the user's account.
FreeBSD 13.1-RELEASE-p6 February 8, 1996 FreeBSD 13.1-RELEASE-p6
man2web Home...