yp_passwd.c revision 1.33
1 /* $NetBSD: yp_passwd.c,v 1.33 2009/04/12 23:59:37 lukem Exp $ */ 2 3 /* 4 * Copyright (c) 1988, 1990, 1993, 1994 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 #ifndef lint 34 #if 0 35 static char sccsid[] = "from: @(#)local_passwd.c 8.3 (Berkeley) 4/2/94"; 36 #else 37 __RCSID("$NetBSD: yp_passwd.c,v 1.33 2009/04/12 23:59:37 lukem Exp $"); 38 #endif 39 #endif /* not lint */ 40 41 #ifdef YP 42 43 #include <ctype.h> 44 #include <err.h> 45 #include <errno.h> 46 #include <netdb.h> 47 #include <pwd.h> 48 #include <stdio.h> 49 #include <stdlib.h> 50 #include <string.h> 51 #include <time.h> 52 #include <unistd.h> 53 #include <limits.h> 54 #include <util.h> 55 56 #include <rpc/rpc.h> 57 #include <rpcsvc/yp_prot.h> 58 #include <rpcsvc/ypclnt.h> 59 60 #include "extern.h" 61 62 #define passwd yp_passwd_rec 63 #include <rpcsvc/yppasswd.h> 64 #undef passwd 65 66 #ifndef _PASSWORD_LEN 67 #define _PASSWORD_LEN PASS_MAX 68 #endif 69 70 static uid_t uid; 71 static char *domain; 72 73 static void 74 pwerror(const char *name, int show_err, int eval) 75 { 76 77 if (show_err) 78 warn("%s", name); 79 errx(eval, "NIS passwd database unchanged"); 80 } 81 82 static char * 83 getnewpasswd(struct passwd *pw, char **old_pass) 84 { 85 int tries; 86 const char *p, *t; 87 char *result; 88 static char buf[_PASSWORD_LEN+1]; 89 char salt[_PASSWORD_LEN+1]; 90 char option[LINE_MAX], *key, *opt; 91 92 (void)printf("Changing NIS password for %s.\n", pw->pw_name); 93 94 if (old_pass) { 95 *old_pass = NULL; 96 97 if (pw->pw_passwd[0]) { 98 if (strcmp(crypt(p = getpass("Old password:"), 99 pw->pw_passwd), pw->pw_passwd)) { 100 (void)printf("Sorry.\n"); 101 pwerror(NULL, 0, 1); 102 } 103 } else { 104 p = ""; 105 } 106 107 *old_pass = strdup(p); 108 if (!*old_pass) { 109 (void)printf("not enough core.\n"); 110 pwerror(NULL, 0, 1); 111 } 112 } 113 for (buf[0] = '\0', tries = 0;;) { 114 p = getpass("New password:"); 115 if (!*p) { 116 (void)printf("Password unchanged.\n"); 117 pwerror(NULL, 0, 0); 118 } 119 if (strlen(p) <= 5 && ++tries < 2) { 120 (void)printf("Please enter a longer password.\n"); 121 continue; 122 } 123 for (t = p; *t && islower((unsigned char)*t); ++t); 124 if (!*t && ++tries < 2) { 125 (void)printf("Please don't use an all-lower case " 126 "password.\nUnusual capitalization, " 127 "control characters or digits are " 128 "suggested.\n"); 129 continue; 130 } 131 (void)strlcpy(buf, p, sizeof(buf)); 132 if (!strcmp(buf, getpass("Retype new password:"))) 133 break; 134 (void)printf("Mismatch; try again, EOF to quit.\n"); 135 } 136 137 pw_getpwconf(option, sizeof(option), pw, "ypcipher"); 138 opt = option; 139 key = strsep(&opt, ","); 140 if (pw_gensalt(salt, _PASSWORD_LEN, key, opt) == -1) { 141 warn("Couldn't generate salt"); 142 pwerror(NULL, 0, 0); 143 } 144 result = strdup(crypt(buf, salt)); 145 if (!result) { 146 (void)printf("not enough core.\n"); 147 pwerror(NULL, 0, 0); 148 } 149 return (result); 150 } 151 152 static void 153 makeypp(struct yppasswd *ypp, struct passwd *pw) 154 { 155 /* prompt for new password */ 156 ypp->newpw.pw_passwd = getnewpasswd(pw, &ypp->oldpass); 157 158 /* tell rpc.yppasswdd */ 159 ypp->newpw.pw_name = estrdup(pw->pw_name); 160 ypp->newpw.pw_uid = pw->pw_uid; 161 ypp->newpw.pw_gid = pw->pw_gid; 162 ypp->newpw.pw_gecos = estrdup(pw->pw_gecos); 163 ypp->newpw.pw_dir = estrdup(pw->pw_dir); 164 ypp->newpw.pw_shell = estrdup(pw->pw_shell); 165 } 166 167 static int 168 ypgetpwnam(const char *nam, struct passwd *pwd) 169 { 170 char *val; 171 int reason, vallen; 172 int flags; 173 int ok = 0; 174 175 val = NULL; 176 reason = yp_match(domain, "passwd.byname", nam, (int)strlen(nam), 177 &val, &vallen); 178 if (reason != 0) 179 goto out; 180 181 flags = _PASSWORD_OLDFMT; 182 if (pw_scan(val, pwd, &flags) == 0) 183 goto out; 184 185 ok = 1; 186 out: 187 if (val) 188 free(val); 189 return ok; 190 } 191 192 #ifdef USE_PAM 193 194 void 195 pwyp_usage(const char *prefix) 196 { 197 198 (void) fprintf(stderr, "%s %s [-d nis | -y] [user]\n", 199 prefix, getprogname()); 200 } 201 202 void 203 pwyp_argv0_usage(const char *prefix) 204 { 205 206 (void) fprintf(stderr, "%s %s [user]\n", 207 prefix, getprogname()); 208 } 209 210 void 211 pwyp_process(const char *username, int argc, char **argv) 212 { 213 char *master; 214 int ch, r, rpcport, status; 215 struct yppasswd ypp; 216 struct passwd pwb, *pw; 217 char pwbuf[1024]; 218 struct timeval tv; 219 CLIENT *client; 220 221 while ((ch = getopt(argc, argv, "y")) != -1) { 222 switch (ch) { 223 case 'y': 224 /* 225 * Abosrb the -y that may have gotten us here. 226 */ 227 break; 228 229 default: 230 usage(); 231 /* NOTREACHED */ 232 } 233 } 234 235 argc -= optind; 236 argv += optind; 237 238 switch (argc) { 239 case 0: 240 /* username already provided */ 241 break; 242 case 1: 243 username = argv[0]; 244 break; 245 default: 246 usage(); 247 /* NOTREACHED */ 248 } 249 250 if (_yp_check(NULL) == 0) { 251 /* can't use YP. */ 252 errx(1, "NIS not in use."); 253 } 254 255 uid = getuid(); 256 257 /* 258 * Get local domain 259 */ 260 if ((r = yp_get_default_domain(&domain)) != 0) 261 errx(1, "can't get local NIS domain. Reason: %s", 262 yperr_string(r)); 263 264 /* 265 * Find the host for the passwd map; it should be running 266 * the daemon. 267 */ 268 if ((r = yp_master(domain, "passwd.byname", &master)) != 0) 269 errx(1, "can't find the master NIS server. Reason: %s", 270 yperr_string(r)); 271 272 /* 273 * Ask the portmapper for the port of the daemon. 274 */ 275 if ((rpcport = getrpcport(master, YPPASSWDPROG, 276 YPPASSWDPROC_UPDATE, IPPROTO_UDP)) == 0) 277 errx(1, "master NIS server not running yppasswd daemon.\n\t%s\n", 278 "Can't change NIS password."); 279 280 /* 281 * Be sure the port is privileged 282 */ 283 if (rpcport >= IPPORT_RESERVED) 284 errx(1, "yppasswd daemon is on an invalid port."); 285 286 /* Bail out if this is a local (non-yp) user, */ 287 /* then get user's login identity */ 288 if (!ypgetpwnam(username, pw = &pwb) || 289 getpwnam_r(username, &pwb, pwbuf, sizeof(pwbuf), &pw) || 290 pw == NULL) 291 errx(1, "NIS unknown user %s", username); 292 293 if (uid && uid != pw->pw_uid) 294 errx(1, "you may only change your own password: %s", 295 strerror(EACCES)); 296 297 makeypp(&ypp, pw); 298 299 client = clnt_create(master, YPPASSWDPROG, YPPASSWDVERS, "udp"); 300 if (client == NULL) 301 errx(1, "cannot contact yppasswdd on %s: Reason: %s", 302 master, yperr_string(YPERR_YPBIND)); 303 304 client->cl_auth = authunix_create_default(); 305 tv.tv_sec = 2; 306 tv.tv_usec = 0; 307 r = clnt_call(client, YPPASSWDPROC_UPDATE, 308 xdr_yppasswd, &ypp, xdr_int, &status, tv); 309 if (r) 310 errx(1, "rpc to yppasswdd failed."); 311 else if (status) 312 printf("Couldn't change NIS password.\n"); 313 else 314 printf("The NIS password has been changed on %s, %s\n", 315 master, "the master NIS passwd server."); 316 } 317 318 #else /* ! USE_PAM */ 319 320 static int yflag; 321 322 int 323 yp_init(progname) 324 const char *progname; 325 { 326 int yppwd; 327 328 if (strcmp(progname, "yppasswd") == 0) { 329 yppwd = 1; 330 } else 331 yppwd = 0; 332 yflag = 0; 333 if (_yp_check(NULL) == 0) { 334 /* can't use YP. */ 335 if (yppwd) 336 errx(1, "NIS not in use."); 337 return(-1); 338 } 339 return (0); 340 } 341 342 int 343 yp_arg(ch, arg) 344 char ch; 345 const char *arg; 346 { 347 switch (ch) { 348 case 'y': 349 yflag = 1; 350 break; 351 default: 352 return(0); 353 } 354 return(1); 355 } 356 357 int 358 yp_arg_end() 359 { 360 if (yflag) 361 return (PW_USE_FORCE); 362 return (PW_USE); 363 } 364 365 void 366 yp_end() 367 { 368 /* NOOP */ 369 } 370 371 int 372 yp_chpw(username) 373 const char *username; 374 { 375 char *master; 376 int r, rpcport, status; 377 struct yppasswd ypp; 378 struct passwd *pw, pwb; 379 char pwbuf[1024]; 380 struct timeval tv; 381 CLIENT *client; 382 383 uid = getuid(); 384 385 /* 386 * Get local domain 387 */ 388 if ((r = yp_get_default_domain(&domain)) != 0) 389 errx(1, "can't get local NIS domain. Reason: %s", 390 yperr_string(r)); 391 392 /* 393 * Find the host for the passwd map; it should be running 394 * the daemon. 395 */ 396 if ((r = yp_master(domain, "passwd.byname", &master)) != 0) { 397 warnx("can't find the master NIS server. Reason: %s", 398 yperr_string(r)); 399 /* continuation */ 400 return(-1); 401 } 402 403 /* 404 * Ask the portmapper for the port of the daemon. 405 */ 406 if ((rpcport = getrpcport(master, YPPASSWDPROG, 407 YPPASSWDPROC_UPDATE, IPPROTO_UDP)) == 0) { 408 warnx("master NIS server not running yppasswd daemon.\n\t%s\n", 409 "Can't change NIS password."); 410 /* continuation */ 411 return(-1); 412 } 413 414 /* 415 * Be sure the port is privileged 416 */ 417 if (rpcport >= IPPORT_RESERVED) 418 errx(1, "yppasswd daemon is on an invalid port."); 419 420 /* Bail out if this is a local (non-yp) user, */ 421 /* then get user's login identity */ 422 if (!ypgetpwnam(username, pw = &pwb) || 423 getpwnam_r(username, &pwb, pwbuf, sizeof(pwbuf), &pw) || 424 pw == NULL) { 425 warnx("NIS unknown user %s", username); 426 /* continuation */ 427 return(-1); 428 } 429 430 if (uid && uid != pw->pw_uid) 431 errx(1, "you may only change your own password: %s", 432 strerror(EACCES)); 433 434 makeypp(&ypp, pw); 435 436 client = clnt_create(master, YPPASSWDPROG, YPPASSWDVERS, "udp"); 437 if (client == NULL) { 438 warnx("cannot contact yppasswdd on %s: Reason: %s", 439 master, yperr_string(YPERR_YPBIND)); 440 return (YPERR_YPBIND); 441 } 442 443 client->cl_auth = authunix_create_default(); 444 tv.tv_sec = 2; 445 tv.tv_usec = 0; 446 r = clnt_call(client, YPPASSWDPROC_UPDATE, 447 xdr_yppasswd, &ypp, xdr_int, &status, tv); 448 if (r) 449 errx(1, "rpc to yppasswdd failed."); 450 else if (status) 451 printf("Couldn't change NIS password.\n"); 452 else 453 printf("The NIS password has been changed on %s, %s\n", 454 master, "the master NIS passwd server."); 455 return(0); 456 } 457 458 #endif /* USE_PAM */ 459 460 #endif /* YP */ 461
Indexes created Wed Oct 01 19:09:53 GMT 2025