freebsd-src/usr.sbin/rpc.yppasswdd/yppasswdd_main.c

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

351 lines
8.8 KiB
C
Raw Normal View History

Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
/*
* SPDX-License-Identifier: BSD-4-Clause
*
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
* Copyright (c) 1995, 1996
* Bill Paul <wpaul@ctr.columbia.edu>. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* This product includes software developed by Bill Paul.
* 4. Neither the name of the author nor the names of any co-contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL Bill Paul OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#include <sys/param.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <sys/resource.h>
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
#include <netinet/in.h>
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
#include <err.h>
#include <errno.h>
#include <fcntl.h>
#include <memory.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h> /* getenv, exit */
#include <string.h> /* strcmp */
#include <syslog.h>
#include <unistd.h>
#include <rpc/rpc.h>
#include <rpc/rpc_com.h>
#include <rpc/pmap_clnt.h> /* for pmap_unset */
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
#include <rpcsvc/yp.h>
#include <rpcsvc/ypclnt.h>
#include "yppasswd.h"
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
#include "yppasswdd_extern.h"
#include "yppasswd_private.h"
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
#include "ypxfr_extern.h"
#include "yp_extern.h"
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
#ifndef SIG_PF
#define SIG_PF void(*)(int)
#endif
#ifdef DEBUG
#define RPC_SVC_FG
#endif
#define _RPCSVC_CLOSEDOWN 120
int _rpcpmstart = 0; /* Started by a port monitor ? */
static int _rpcfdtype;
/* Whether Stream or Datagram ? */
/* States a server can be in wrt request */
#define _IDLE 0
#define _SERVED 1
#define _SERVING 2
int debug;
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
static char _localhost[] = "localhost";
static char _passwd_byname[] = "passwd.byname";
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
extern int _rpcsvcstate; /* Set when a request is serviced */
static char _progname[] = "rpc.yppasswdd";
char *progname = _progname;
static char _yp_dir[] = _PATH_YP;
char *yp_dir = _yp_dir;
static char _passfile_default[] = _PATH_YP "master.passwd";
char *passfile_default = _passfile_default;
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
char *passfile;
char *yppasswd_domain = NULL;
int no_chsh = 0;
int no_chfn = 0;
int allow_additions = 0;
int multidomain = 0;
int verbose = 0;
int resvport = 1;
int inplace = 0;
char sockname[] = YP_SOCKNAME;
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
static void
terminate(int sig __unused)
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
{
rpcb_unset(YPPASSWDPROG, YPPASSWDVERS, NULL);
rpcb_unset(MASTER_YPPASSWDPROG, MASTER_YPPASSWDVERS, NULL);
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
unlink(sockname);
exit(0);
}
static void
reload(int sig __unused)
{
load_securenets();
}
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
static void
closedown(int sig __unused)
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
{
if (_rpcsvcstate == _IDLE) {
extern fd_set svc_fdset;
static int size;
int i, openfd;
if (_rpcfdtype == SOCK_DGRAM) {
unlink(sockname);
exit(0);
}
if (size == 0) {
size = getdtablesize();
}
for (i = 0, openfd = 0; i < size && openfd < 2; i++)
if (FD_ISSET(i, &svc_fdset))
openfd++;
if (openfd <= 1) {
unlink(sockname);
exit(0);
}
}
if (_rpcsvcstate == _SERVED)
_rpcsvcstate = _IDLE;
(void) signal(SIGALRM, (SIG_PF) closedown);
(void) alarm(_RPCSVC_CLOSEDOWN/2);
}
static void
usage(void)
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
{
fprintf(stderr, "%s\n%s\n",
"usage: rpc.yppasswdd [-t master.passwd file] [-d domain] [-p path] [-s]",
" [-f] [-m] [-i] [-a] [-v] [-u] [-h]");
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
exit(1);
}
int
main(int argc, char *argv[])
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
{
struct rlimit rlim;
SVCXPRT *transp = NULL;
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
struct sockaddr_in saddr;
socklen_t asize = sizeof (saddr);
struct netconfig *nconf;
struct sigaction sa;
void *localhandle;
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
int ch;
char *mastername;
char myname[MAXHOSTNAMELEN + 2];
int maxrec = RPC_MAXDATASIZE;
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
debug = 1;
while ((ch = getopt(argc, argv, "t:d:p:sfamuivh")) != -1) {
switch (ch) {
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
case 't':
passfile_default = optarg;
break;
case 'd':
yppasswd_domain = optarg;
break;
case 's':
no_chsh++;
break;
case 'f':
no_chfn++;
break;
case 'p':
yp_dir = optarg;
break;
case 'a':
allow_additions++;
break;
case 'm':
multidomain++;
break;
case 'i':
inplace++;
break;
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
case 'v':
verbose++;
break;
case 'u':
resvport = 0;
break;
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
default:
case 'h':
usage();
break;
}
}
if (yppasswd_domain == NULL) {
if (yp_get_default_domain(&yppasswd_domain)) {
yp_error("no domain specified and system domain \
name isn't set -- aborting");
usage();
}
}
load_securenets();
if (getrpcport(_localhost, YPPROG, YPVERS, IPPROTO_UDP) <= 0) {
1996-10-23 15:42:37 +00:00
yp_error("no ypserv processes registered with local portmap");
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
yp_error("this host is not an NIS server -- aborting");
exit(1);
}
if ((mastername = ypxfr_get_master(yppasswd_domain,
_passwd_byname, _localhost, 0)) == NULL) {
1996-10-23 15:42:37 +00:00
yp_error("can't get name of NIS master server for domain %s",
yppasswd_domain);
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
exit(1);
}
if (gethostname((char *)&myname, sizeof(myname)) == -1) {
yp_error("can't get local hostname: %s", strerror(errno));
exit(1);
}
1999-03-16 01:23:09 +00:00
if (strncasecmp(mastername, (char *)&myname, sizeof(myname))) {
1996-10-23 15:42:37 +00:00
yp_error("master of %s is %s, but we are %s",
"passwd.byname", mastername, myname);
yp_error("this host is not the NIS master server for \
the %s domain -- aborting", yppasswd_domain);
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
exit(1);
}
debug = 0;
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
if (getsockname(0, (struct sockaddr *)&saddr, &asize) == 0) {
socklen_t ssize = sizeof (int);
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
if (saddr.sin_family != AF_INET)
exit(1);
if (getsockopt(0, SOL_SOCKET, SO_TYPE,
(char *)&_rpcfdtype, &ssize) == -1)
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
exit(1);
_rpcpmstart = 1;
}
if (!debug && _rpcpmstart == 0) {
if (daemon(0,0)) {
err(1,"cannot fork");
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
}
}
openlog("rpc.yppasswdd", LOG_PID, LOG_DAEMON);
memset(&sa, 0, sizeof(sa));
sa.sa_flags = SA_NOCLDWAIT;
sigaction(SIGCHLD, &sa, NULL);
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
rpcb_unset(YPPASSWDPROG, YPPASSWDVERS, NULL);
rpcb_unset(MASTER_YPPASSWDPROG, MASTER_YPPASSWDVERS, NULL);
rpc_control(RPC_SVC_CONNMAXREC_SET, &maxrec);
if (svc_create(yppasswdprog_1, YPPASSWDPROG, YPPASSWDVERS, "netpath") == 0) {
yp_error("cannot create yppasswd service.");
exit(1);
}
if (svc_create(master_yppasswdprog_1, MASTER_YPPASSWDPROG,
MASTER_YPPASSWDVERS, "netpath") == 0) {
yp_error("cannot create master_yppasswd service.");
exit(1);
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
}
nconf = NULL;
localhandle = setnetconfig();
while ((nconf = getnetconfig(localhandle)) != NULL) {
if (nconf->nc_protofmly != NULL &&
strcmp(nconf->nc_protofmly, NC_LOOPBACK) == 0)
break;
}
if (nconf == NULL) {
yp_error("getnetconfigent unix: %s", nc_sperror());
exit(1);
}
unlink(sockname);
transp = svcunix_create(RPC_ANYSOCK, 0, 0, sockname);
if (transp == NULL) {
yp_error("cannot create AF_LOCAL service.");
exit(1);
}
if (!svc_reg(transp, MASTER_YPPASSWDPROG, MASTER_YPPASSWDVERS,
master_yppasswdprog_1, nconf)) {
yp_error("unable to register (MASTER_YPPASSWDPROG, \
MASTER_YPPASSWDVERS, unix).");
exit(1);
}
endnetconfig(localhandle);
/* Only root may connect() to the AF_UNIX link. */
if (chmod(sockname, 0))
err(1, "chmod of %s failed", sockname);
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
if (transp == (SVCXPRT *)NULL) {
yp_error("could not create a handle");
exit(1);
}
if (_rpcpmstart) {
(void) signal(SIGALRM, (SIG_PF) closedown);
(void) alarm(_RPCSVC_CLOSEDOWN/2);
}
/* Unlimited resource limits. */
rlim.rlim_cur = rlim.rlim_max = RLIM_INFINITY;
(void)setrlimit(RLIMIT_CPU, &rlim);
(void)setrlimit(RLIMIT_FSIZE, &rlim);
(void)setrlimit(RLIMIT_STACK, &rlim);
(void)setrlimit(RLIMIT_DATA, &rlim);
(void)setrlimit(RLIMIT_RSS, &rlim);
/* Don't drop core (not really necessary, but GP's). */
rlim.rlim_cur = rlim.rlim_max = 0;
(void)setrlimit(RLIMIT_CORE, &rlim);
/* Turn off signals. */
(void)signal(SIGALRM, SIG_IGN);
(void)signal(SIGHUP, (SIG_PF) reload);
(void)signal(SIGINT, SIG_IGN);
(void)signal(SIGPIPE, SIG_IGN);
(void)signal(SIGQUIT, SIG_IGN);
(void)signal(SIGTERM, (SIG_PF) terminate);
svc_run();
Import new rpc.yppasswdd. (Note: accompanying changes to passwd(1) and chpass(1) are on the way too.) This version supports all the features of the old one and adds several new ones: - Supports real multi-domain operation (optional, can be turned on with a command-line flag). This means you can actually have several different domains all served from one NIS server and allow users in any of the supported domains to change their passwords. The old yppasswdd only allowed changing passwords in the domain that was set as the system default domain name on the NIS master server. The new one can change passwords in any domain by trying to match the user information passed to it against all the passwd maps it can find. This is something of a hack, but the yppasswd.x protocol definiton does not allow for a domain to be passwd as an argument to rpc.yppasswdd, so the server has no choice but to grope around for a likely match. Since this method can fail if the same user exists in two domains, this feature is off by default. If the feature is turned on and the server becomes confused by duplicate entries, it will abort the update. - Does not require NIS client services to be available. NIS servers do _NOT_ necessarily have to be configured as NIS clients in order to function: the ypserv, ypxfr and yppush programs I've written recently will operate fine even if the system domain name isn't set, ypbind isn't running and there are no magic '+' entries in any of the /etc files. Now rpc.yppasswdd is the same way. The old yppasswdd would not work like this because it depended on getpwent(3) and friends to look up users: this will obviously only work if the system where yppasswdd is running is configured as an NIS client. The new rpc.yppasswdd doesn't use getpwent(3) at all: instead it searches through the master.passwd map databases directly. This also makes it easier for it to handle multiple domains. - Allows the superuser on the NIS master server to change any user's password without requiring password authentication. rpc.yppasswdd creates a UNIX domain socket (/var/run/ypsock) which it monitors using the same svc_run() loop used to handle incoming RPC requests. It also clears all the permission bits for /var/run/ypsock; since this socket is owned by root, this prevents anyone except root from successfully connect()ing to it. (Using a UNIX domain socket also prevents IP spoofing attacks.) By building code into passwd(1) and chpass(1) to take advantage of this 'trusted' channel, the superuser can use them to send private requests to rpc.yppasswdd. - Allows the superuser on the NIS master to use chpass(1) to update _all_ of a user's master.passwd information. The UNIX domain access point accepts a full master.passwd style structure (along with a domain name and other information), which allows the superuser to update all of a user's master.passwd information in the NIS master.passwd maps. Normal users on NIS clients are still only allowed to change their full name and shell information with chpass. - Allows the superuser on the NIS master to _add_ records to the NIS master.passwd maps using chpass(1). This feature is also switchable with a command-line flag and is off by default.
1996-02-12 15:09:01 +00:00
yp_error("svc_run returned");
exit(1);
/* NOTREACHED */
}