yp_passwd.c revision 1.32
1 /* $NetBSD: yp_passwd.c,v 1.32 2008/01/25 19:36:12 christos Exp $ */ 2 3 /* 4 * Copyright (c) 1988, 1990, 1993, 1994 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 #ifndef lint 34 #if 0 35 static char sccsid[] = "from: @(#)local_passwd.c 8.3 (Berkeley) 4/2/94"; 36 #else 37 __RCSID("$NetBSD: yp_passwd.c,v 1.32 2008/01/25 19:36:12 christos Exp $"); 38 #endif 39 #endif /* not lint */ 40 41 #ifdef YP 42 43 #include <ctype.h> 44 #include <err.h> 45 #include <errno.h> 46 #include <netdb.h> 47 #include <pwd.h> 48 #include <stdio.h> 49 #include <stdlib.h> 50 #include <string.h> 51 #include <time.h> 52 #include <unistd.h> 53 #include <limits.h> 54 #include <util.h> 55 56 #include <rpc/rpc.h> 57 #include <rpcsvc/yp_prot.h> 58 #include <rpcsvc/ypclnt.h> 59 60 #include "extern.h" 61 62 #define passwd yp_passwd_rec 63 #include <rpcsvc/yppasswd.h> 64 #undef passwd 65 66 #ifndef _PASSWORD_LEN 67 #define _PASSWORD_LEN PASS_MAX 68 #endif 69 70 static uid_t uid; 71 static char *domain; 72 73 static void 74 pwerror(char *name, int err, int eval) 75 { 76 77 if (err) 78 warn("%s", name); 79 errx(eval, "NIS passwd database unchanged"); 80 } 81 82 static char * 83 getnewpasswd(struct passwd *pw, char **old_pass) 84 { 85 int tries; 86 char *p, *t; 87 static char buf[_PASSWORD_LEN+1]; 88 char salt[_PASSWORD_LEN+1]; 89 char option[LINE_MAX], *key, *opt; 90 91 (void)printf("Changing NIS password for %s.\n", pw->pw_name); 92 93 if (old_pass) { 94 *old_pass = NULL; 95 96 if (pw->pw_passwd[0]) { 97 if (strcmp(crypt(p = getpass("Old password:"), 98 pw->pw_passwd), pw->pw_passwd)) { 99 (void)printf("Sorry.\n"); 100 pwerror(NULL, 0, 1); 101 } 102 } else { 103 p = ""; 104 } 105 106 *old_pass = strdup(p); 107 if (!*old_pass) { 108 (void)printf("not enough core.\n"); 109 pwerror(NULL, 0, 1); 110 } 111 } 112 for (buf[0] = '\0', tries = 0;;) { 113 p = getpass("New password:"); 114 if (!*p) { 115 (void)printf("Password unchanged.\n"); 116 pwerror(NULL, 0, 0); 117 } 118 if (strlen(p) <= 5 && ++tries < 2) { 119 (void)printf("Please enter a longer password.\n"); 120 continue; 121 } 122 for (t = p; *t && islower((unsigned char)*t); ++t); 123 if (!*t && ++tries < 2) { 124 (void)printf("Please don't use an all-lower case " 125 "password.\nUnusual capitalization, " 126 "control characters or digits are " 127 "suggested.\n"); 128 continue; 129 } 130 (void)strlcpy(buf, p, sizeof(buf)); 131 if (!strcmp(buf, getpass("Retype new password:"))) 132 break; 133 (void)printf("Mismatch; try again, EOF to quit.\n"); 134 } 135 136 pw_getpwconf(option, sizeof(option), pw, "ypcipher"); 137 opt = option; 138 key = strsep(&opt, ","); 139 if (pw_gensalt(salt, _PASSWORD_LEN, key, opt) == -1) { 140 warn("Couldn't generate salt"); 141 pwerror(NULL, 0, 0); 142 } 143 p = strdup(crypt(buf, salt)); 144 if (!p) { 145 (void)printf("not enough core.\n"); 146 pwerror(NULL, 0, 0); 147 } 148 return (p); 149 } 150 151 static void 152 makeypp(struct yppasswd *ypp, struct passwd *pw) 153 { 154 /* prompt for new password */ 155 ypp->newpw.pw_passwd = getnewpasswd(pw, &ypp->oldpass); 156 157 /* tell rpc.yppasswdd */ 158 ypp->newpw.pw_name = estrdup(pw->pw_name); 159 ypp->newpw.pw_uid = pw->pw_uid; 160 ypp->newpw.pw_gid = pw->pw_gid; 161 ypp->newpw.pw_gecos = estrdup(pw->pw_gecos); 162 ypp->newpw.pw_dir = estrdup(pw->pw_dir); 163 ypp->newpw.pw_shell = estrdup(pw->pw_shell); 164 } 165 166 static int 167 ypgetpwnam(const char *nam, struct passwd *pwd) 168 { 169 char *val; 170 int reason, vallen; 171 int flags; 172 int ok = 0; 173 174 val = NULL; 175 reason = yp_match(domain, "passwd.byname", nam, (int)strlen(nam), 176 &val, &vallen); 177 if (reason != 0) 178 goto out; 179 180 flags = _PASSWORD_OLDFMT; 181 if (pw_scan(val, pwd, &flags) == 0) 182 goto out; 183 184 ok = 1; 185 out: 186 if (val) 187 free(val); 188 return ok; 189 } 190 191 #ifdef USE_PAM 192 193 void 194 pwyp_usage(const char *prefix) 195 { 196 197 (void) fprintf(stderr, "%s %s [-d nis | -y] [user]\n", 198 prefix, getprogname()); 199 } 200 201 void 202 pwyp_argv0_usage(const char *prefix) 203 { 204 205 (void) fprintf(stderr, "%s %s [user]\n", 206 prefix, getprogname()); 207 } 208 209 void 210 pwyp_process(const char *username, int argc, char **argv) 211 { 212 char *master; 213 int ch, r, rpcport, status; 214 struct yppasswd ypp; 215 struct passwd pwb, *pw; 216 char pwbuf[1024]; 217 struct timeval tv; 218 CLIENT *client; 219 220 while ((ch = getopt(argc, argv, "y")) != -1) { 221 switch (ch) { 222 case 'y': 223 /* 224 * Abosrb the -y that may have gotten us here. 225 */ 226 break; 227 228 default: 229 usage(); 230 /* NOTREACHED */ 231 } 232 } 233 234 argc -= optind; 235 argv += optind; 236 237 switch (argc) { 238 case 0: 239 /* username already provided */ 240 break; 241 case 1: 242 username = argv[0]; 243 break; 244 default: 245 usage(); 246 /* NOTREACHED */ 247 } 248 249 if (_yp_check(NULL) == 0) { 250 /* can't use YP. */ 251 errx(1, "NIS not in use."); 252 } 253 254 uid = getuid(); 255 256 /* 257 * Get local domain 258 */ 259 if ((r = yp_get_default_domain(&domain)) != 0) 260 errx(1, "can't get local NIS domain. Reason: %s", 261 yperr_string(r)); 262 263 /* 264 * Find the host for the passwd map; it should be running 265 * the daemon. 266 */ 267 if ((r = yp_master(domain, "passwd.byname", &master)) != 0) 268 errx(1, "can't find the master NIS server. Reason: %s", 269 yperr_string(r)); 270 271 /* 272 * Ask the portmapper for the port of the daemon. 273 */ 274 if ((rpcport = getrpcport(master, YPPASSWDPROG, 275 YPPASSWDPROC_UPDATE, IPPROTO_UDP)) == 0) 276 errx(1, "master NIS server not running yppasswd daemon.\n\t%s\n", 277 "Can't change NIS password."); 278 279 /* 280 * Be sure the port is privileged 281 */ 282 if (rpcport >= IPPORT_RESERVED) 283 errx(1, "yppasswd daemon is on an invalid port."); 284 285 /* Bail out if this is a local (non-yp) user, */ 286 /* then get user's login identity */ 287 if (!ypgetpwnam(username, pw = &pwb) || 288 getpwnam_r(username, &pwb, pwbuf, sizeof(pwbuf), &pw) || 289 pw == NULL) 290 errx(1, "NIS unknown user %s", username); 291 292 if (uid && uid != pw->pw_uid) 293 errx(1, "you may only change your own password: %s", 294 strerror(EACCES)); 295 296 makeypp(&ypp, pw); 297 298 client = clnt_create(master, YPPASSWDPROG, YPPASSWDVERS, "udp"); 299 if (client == NULL) 300 errx(1, "cannot contact yppasswdd on %s: Reason: %s", 301 master, yperr_string(YPERR_YPBIND)); 302 303 client->cl_auth = authunix_create_default(); 304 tv.tv_sec = 2; 305 tv.tv_usec = 0; 306 r = clnt_call(client, YPPASSWDPROC_UPDATE, 307 xdr_yppasswd, &ypp, xdr_int, &status, tv); 308 if (r) 309 errx(1, "rpc to yppasswdd failed."); 310 else if (status) 311 printf("Couldn't change NIS password.\n"); 312 else 313 printf("The NIS password has been changed on %s, %s\n", 314 master, "the master NIS passwd server."); 315 } 316 317 #else /* ! USE_PAM */ 318 319 static int yflag; 320 321 int 322 yp_init(progname) 323 const char *progname; 324 { 325 int yppwd; 326 327 if (strcmp(progname, "yppasswd") == 0) { 328 yppwd = 1; 329 } else 330 yppwd = 0; 331 yflag = 0; 332 if (_yp_check(NULL) == 0) { 333 /* can't use YP. */ 334 if (yppwd) 335 errx(1, "NIS not in use."); 336 return(-1); 337 } 338 return (0); 339 } 340 341 int 342 yp_arg(ch, arg) 343 char ch; 344 const char *arg; 345 { 346 switch (ch) { 347 case 'y': 348 yflag = 1; 349 break; 350 default: 351 return(0); 352 } 353 return(1); 354 } 355 356 int 357 yp_arg_end() 358 { 359 if (yflag) 360 return (PW_USE_FORCE); 361 return (PW_USE); 362 } 363 364 void 365 yp_end() 366 { 367 /* NOOP */ 368 } 369 370 int 371 yp_chpw(username) 372 const char *username; 373 { 374 char *master; 375 int r, rpcport, status; 376 struct yppasswd ypp; 377 struct passwd *pw, pwb; 378 char pwbuf[1024]; 379 struct timeval tv; 380 CLIENT *client; 381 382 uid = getuid(); 383 384 /* 385 * Get local domain 386 */ 387 if ((r = yp_get_default_domain(&domain)) != 0) 388 errx(1, "can't get local NIS domain. Reason: %s", 389 yperr_string(r)); 390 391 /* 392 * Find the host for the passwd map; it should be running 393 * the daemon. 394 */ 395 if ((r = yp_master(domain, "passwd.byname", &master)) != 0) { 396 warnx("can't find the master NIS server. Reason: %s", 397 yperr_string(r)); 398 /* continuation */ 399 return(-1); 400 } 401 402 /* 403 * Ask the portmapper for the port of the daemon. 404 */ 405 if ((rpcport = getrpcport(master, YPPASSWDPROG, 406 YPPASSWDPROC_UPDATE, IPPROTO_UDP)) == 0) { 407 warnx("master NIS server not running yppasswd daemon.\n\t%s\n", 408 "Can't change NIS password."); 409 /* continuation */ 410 return(-1); 411 } 412 413 /* 414 * Be sure the port is privileged 415 */ 416 if (rpcport >= IPPORT_RESERVED) 417 errx(1, "yppasswd daemon is on an invalid port."); 418 419 /* Bail out if this is a local (non-yp) user, */ 420 /* then get user's login identity */ 421 if (!ypgetpwnam(username, pw = &pwb) || 422 getpwnam_r(username, &pwb, pwbuf, sizeof(pwbuf), &pw) || 423 pw == NULL) { 424 warnx("NIS unknown user %s", username); 425 /* continuation */ 426 return(-1); 427 } 428 429 if (uid && uid != pw->pw_uid) 430 errx(1, "you may only change your own password: %s", 431 strerror(EACCES)); 432 433 makeypp(&ypp, pw); 434 435 client = clnt_create(master, YPPASSWDPROG, YPPASSWDVERS, "udp"); 436 if (client == NULL) { 437 warnx("cannot contact yppasswdd on %s: Reason: %s", 438 master, yperr_string(YPERR_YPBIND)); 439 return (YPERR_YPBIND); 440 } 441 442 client->cl_auth = authunix_create_default(); 443 tv.tv_sec = 2; 444 tv.tv_usec = 0; 445 r = clnt_call(client, YPPASSWDPROC_UPDATE, 446 xdr_yppasswd, &ypp, xdr_int, &status, tv); 447 if (r) 448 errx(1, "rpc to yppasswdd failed."); 449 else if (status) 450 printf("Couldn't change NIS password.\n"); 451 else 452 printf("The NIS password has been changed on %s, %s\n", 453 master, "the master NIS passwd server."); 454 return(0); 455 } 456 457 #endif /* USE_PAM */ 458 459 #endif /* YP */ 460
Indexes created Thu Oct 02 01:09:59 GMT 2025