usr.bin/passwd/yp_passwd.c

   1 /*      $NetBSD: yp_passwd.c,v 1.32 2008/01/25 19:36:12 christos Exp $  */
   2
   3 /*
   4  * Copyright (c) 1988, 1990, 1993, 1994
   5  *      The Regents of the University of California.  All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the University nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #include <sys/cdefs.h>
  33 #ifndef lint
  34 #if 0
  35 static char sccsid[] = "from:  @(#)local_passwd.c    8.3 (Berkeley) 4/2/94";
  36 #else
  37 __RCSID("$NetBSD: yp_passwd.c,v 1.32 2008/01/25 19:36:12 christos Exp $");
  38 #endif
  39 #endif /* not lint */
  40
  41 #ifdef  YP
  42
  43 #include <ctype.h>
  44 #include <err.h>
  45 #include <errno.h>
  46 #include <netdb.h>
  47 #include <pwd.h>
  48 #include <stdio.h>
  49 #include <stdlib.h>
  50 #include <string.h>
  51 #include <time.h>
  52 #include <unistd.h>
  53 #include <limits.h>
  54 #include <util.h>
  55
  56 #include <rpc/rpc.h>
  57 #include <rpcsvc/yp_prot.h>
  58 #include <rpcsvc/ypclnt.h>
  59
  60 #include "extern.h"
  61
  62 #define passwd yp_passwd_rec
  63 #include <rpcsvc/yppasswd.h>
  64 #undef passwd
  65
  66 #ifndef _PASSWORD_LEN
  67 #define _PASSWORD_LEN PASS_MAX
  68 #endif
  69
  70 static uid_t uid;
  71 static char *domain;
  72
  73 static void
  74 pwerror(const char *name, int show_err, int eval)
  75 {
  76
  77         if (show_err)
  78                 warn("%s", name);
  79         errx(eval, "NIS passwd database unchanged");
  80 }
  81
  82 static char *
  83 getnewpasswd(struct passwd *pw, char **old_pass)
  84 {
  85         int tries;
  86         const char *p, *t;
  87         char *result;
  88         static char buf[_PASSWORD_LEN+1];
  89         char salt[_PASSWORD_LEN+1];
  90         char option[LINE_MAX], *key, *opt;
  91
  92         (void)printf("Changing NIS password for %s.\n", pw->pw_name);
  93
  94         if (old_pass) {
  95                 *old_pass = NULL;
  96
  97                 if (pw->pw_passwd[0]) {
  98                         if (strcmp(crypt(p = getpass("Old password:"),
  99                                          pw->pw_passwd),  pw->pw_passwd)) {
 100                                 (void)printf("Sorry.\n");
 101                                 pwerror(NULL, 0, 1);
 102                         }
 103                 } else {
 104                         p = "";
 105                 }
 106
 107                 *old_pass = strdup(p);
 108                 if (!*old_pass) {
 109                         (void)printf("not enough core.\n");
 110                         pwerror(NULL, 0, 1);
 111                 }
 112         }
 113         for (buf[0] = '\0', tries = 0;;) {
 114                 p = getpass("New password:");
 115                 if (!*p) {
 116                         (void)printf("Password unchanged.\n");
 117                         pwerror(NULL, 0, 0);
 118                 }
 119                 if (strlen(p) <= 5 && ++tries < 2) {
 120                         (void)printf("Please enter a longer password.\n");
 121                         continue;
 122                 }
 123                 for (t = p; *t && islower((unsigned char)*t); ++t);
 124                 if (!*t && ++tries < 2) {
 125                         (void)printf("Please don't use an all-lower case "
 126                                      "password.\nUnusual capitalization, "
 127                                      "control characters or digits are "
 128                                      "suggested.\n");
 129                         continue;
 130                 }
 131                 (void)strlcpy(buf, p, sizeof(buf));
 132                 if (!strcmp(buf, getpass("Retype new password:")))
 133                         break;
 134                 (void)printf("Mismatch; try again, EOF to quit.\n");
 135         }
 136
 137         pw_getpwconf(option, sizeof(option), pw, "ypcipher");
 138         opt = option;
 139         key = strsep(&opt, ",");
 140         if (pw_gensalt(salt, _PASSWORD_LEN, key, opt) == -1) {
 141                 warn("Couldn't generate salt");
 142                 pwerror(NULL, 0, 0);
 143         }
 144         result = strdup(crypt(buf, salt));
 145         if (!result) {
 146                 (void)printf("not enough core.\n");
 147                 pwerror(NULL, 0, 0);
 148         }
 149         return (result);
 150 }
 151
 152 static void
 153 makeypp(struct yppasswd *ypp, struct passwd *pw)
 154 {
 155         /* prompt for new password */
 156         ypp->newpw.pw_passwd = getnewpasswd(pw, &ypp->oldpass);
 157
 158         /* tell rpc.yppasswdd */
 159         ypp->newpw.pw_name      = estrdup(pw->pw_name);
 160         ypp->newpw.pw_uid       = pw->pw_uid;
 161         ypp->newpw.pw_gid       = pw->pw_gid;
 162         ypp->newpw.pw_gecos     = estrdup(pw->pw_gecos);
 163         ypp->newpw.pw_dir       = estrdup(pw->pw_dir);
 164         ypp->newpw.pw_shell     = estrdup(pw->pw_shell);
 165 }
 166
 167 static int
 168 ypgetpwnam(const char *nam, struct passwd *pwd)
 169 {
 170         char *val;
 171         int reason, vallen;
 172         int flags;
 173         int ok = 0;
 174
 175         val = NULL;
 176         reason = yp_match(domain, "passwd.byname", nam, (int)strlen(nam),
 177                           &val, &vallen);
 178         if (reason != 0)
 179                 goto out;
 180
 181         flags = _PASSWORD_OLDFMT;
 182         if (pw_scan(val, pwd, &flags) == 0)
 183                 goto out;
 184
 185         ok = 1;
 186 out:
 187         if (val)
 188                 free(val);
 189         return ok;
 190 }
 191
 192 #ifdef USE_PAM
 193
 194 void
 195 pwyp_usage(const char *prefix)
 196 {
 197
 198         (void) fprintf(stderr, "%s %s [-d nis | -y] [user]\n",
 199             prefix, getprogname());
 200 }
 201
 202 void
 203 pwyp_argv0_usage(const char *prefix)
 204 {
 205
 206         (void) fprintf(stderr, "%s %s [user]\n",
 207             prefix, getprogname());
 208 }
 209
 210 void
 211 pwyp_process(const char *username, int argc, char **argv)
 212 {
 213         char *master;
 214         int ch, r, rpcport, status;
 215         struct yppasswd ypp;
 216         struct passwd pwb, *pw;
 217         char pwbuf[1024];
 218         struct timeval tv;
 219         CLIENT *client;
 220
 221         while ((ch = getopt(argc, argv, "y")) != -1) {
 222                 switch (ch) {
 223                 case 'y':
 224                         /*
 225                          * Abosrb the -y that may have gotten us here.
 226                          */
 227                         break;
 228
 229                 default:
 230                         usage();
 231                         /* NOTREACHED */
 232                 }
 233         }
 234
 235         argc -= optind;
 236         argv += optind;
 237
 238         switch (argc) {
 239         case 0:
 240                 /* username already provided */
 241                 break;
 242         case 1:
 243                 username = argv[0];
 244                 break;
 245         default:
 246                 usage();
 247                 /* NOTREACHED */
 248         }
 249
 250         if (_yp_check(NULL) == 0) {
 251                 /* can't use YP. */
 252                 errx(1, "NIS not in use.");
 253         }
 254
 255         uid = getuid();
 256
 257         /*
 258          * Get local domain
 259          */
 260         if ((r = yp_get_default_domain(&domain)) != 0)
 261                 errx(1, "can't get local NIS domain.  Reason: %s",
 262                     yperr_string(r));
 263
 264         /*
 265          * Find the host for the passwd map; it should be running
 266          * the daemon.
 267          */
 268         if ((r = yp_master(domain, "passwd.byname", &master)) != 0)
 269                 errx(1, "can't find the master NIS server.  Reason: %s",
 270                     yperr_string(r));
 271
 272         /*
 273          * Ask the portmapper for the port of the daemon.
 274          */
 275         if ((rpcport = getrpcport(master, YPPASSWDPROG,
 276             YPPASSWDPROC_UPDATE, IPPROTO_UDP)) == 0)
 277                 errx(1, "master NIS server not running yppasswd daemon.\n\t%s\n",
 278                     "Can't change NIS password.");
 279
 280         /*
 281          * Be sure the port is privileged
 282          */
 283         if (rpcport >= IPPORT_RESERVED)
 284                 errx(1, "yppasswd daemon is on an invalid port.");
 285
 286         /* Bail out if this is a local (non-yp) user, */
 287         /* then get user's login identity */
 288         if (!ypgetpwnam(username, pw = &pwb) ||
 289             getpwnam_r(username, &pwb, pwbuf, sizeof(pwbuf), &pw) ||
 290             pw == NULL)
 291                 errx(1, "NIS unknown user %s", username);
 292
 293         if (uid && uid != pw->pw_uid)
 294                 errx(1, "you may only change your own password: %s",
 295                     strerror(EACCES));
 296
 297         makeypp(&ypp, pw);
 298
 299         client = clnt_create(master, YPPASSWDPROG, YPPASSWDVERS, "udp");
 300         if (client == NULL)
 301                 errx(1, "cannot contact yppasswdd on %s:  Reason: %s",
 302                     master, yperr_string(YPERR_YPBIND));
 303
 304         client->cl_auth = authunix_create_default();
 305         tv.tv_sec = 2;
 306         tv.tv_usec = 0;
 307         r = clnt_call(client, YPPASSWDPROC_UPDATE,
 308             xdr_yppasswd, &ypp, xdr_int, &status, tv);
 309         if (r)
 310                 errx(1, "rpc to yppasswdd failed.");
 311         else if (status)
 312                 printf("Couldn't change NIS password.\n");
 313         else
 314                 printf("The NIS password has been changed on %s, %s\n",
 315                     master, "the master NIS passwd server.");
 316 }
 317
 318 #else /* ! USE_PAM */
 319
 320 static  int yflag;
 321
 322 int
 323 yp_init(progname)
 324         const char *progname;
 325 {
 326         int yppwd;
 327
 328         if (strcmp(progname, "yppasswd") == 0) {
 329                 yppwd = 1;
 330         } else
 331                 yppwd = 0;
 332         yflag = 0;
 333         if (_yp_check(NULL) == 0) {
 334                 /* can't use YP. */
 335                 if (yppwd)
 336                         errx(1, "NIS not in use.");
 337                 return(-1);
 338         }
 339         return (0);
 340 }
 341
 342 int
 343 yp_arg(ch, arg)
 344         char ch;
 345         const char *arg;
 346 {
 347         switch (ch) {
 348         case 'y':
 349                 yflag = 1;
 350                 break;
 351         default:
 352                 return(0);
 353         }
 354         return(1);
 355 }
 356
 357 int
 358 yp_arg_end()
 359 {
 360         if (yflag)
 361                 return (PW_USE_FORCE);
 362         return (PW_USE);
 363 }
 364
 365 void
 366 yp_end()
 367 {
 368         /* NOOP */
 369 }
 370
 371 int
 372 yp_chpw(username)
 373         const char *username;
 374 {
 375         char *master;
 376         int r, rpcport, status;
 377         struct yppasswd ypp;
 378         struct passwd *pw, pwb;
 379         char pwbuf[1024];
 380         struct timeval tv;
 381         CLIENT *client;
 382
 383         uid = getuid();
 384
 385         /*
 386          * Get local domain
 387          */
 388         if ((r = yp_get_default_domain(&domain)) != 0)
 389                 errx(1, "can't get local NIS domain.  Reason: %s",
 390                     yperr_string(r));
 391
 392         /*
 393          * Find the host for the passwd map; it should be running
 394          * the daemon.
 395          */
 396         if ((r = yp_master(domain, "passwd.byname", &master)) != 0) {
 397                 warnx("can't find the master NIS server.  Reason: %s",
 398                     yperr_string(r));
 399                 /* continuation */
 400                 return(-1);
 401         }
 402
 403         /*
 404          * Ask the portmapper for the port of the daemon.
 405          */
 406         if ((rpcport = getrpcport(master, YPPASSWDPROG,
 407             YPPASSWDPROC_UPDATE, IPPROTO_UDP)) == 0) {
 408                 warnx("master NIS server not running yppasswd daemon.\n\t%s\n",
 409                     "Can't change NIS password.");
 410                 /* continuation */
 411                 return(-1);
 412         }
 413
 414         /*
 415          * Be sure the port is privileged
 416          */
 417         if (rpcport >= IPPORT_RESERVED)
 418                 errx(1, "yppasswd daemon is on an invalid port.");
 419
 420         /* Bail out if this is a local (non-yp) user, */
 421         /* then get user's login identity */
 422         if (!ypgetpwnam(username, pw = &pwb) ||
 423             getpwnam_r(username, &pwb, pwbuf, sizeof(pwbuf), &pw) ||
 424             pw == NULL) {
 425                 warnx("NIS unknown user %s", username);
 426                 /* continuation */
 427                 return(-1);
 428         }
 429
 430         if (uid && uid != pw->pw_uid)
 431                 errx(1, "you may only change your own password: %s",
 432                     strerror(EACCES));
 433
 434         makeypp(&ypp, pw);
 435
 436         client = clnt_create(master, YPPASSWDPROG, YPPASSWDVERS, "udp");
 437         if (client == NULL) {
 438                 warnx("cannot contact yppasswdd on %s:  Reason: %s",
 439                     master, yperr_string(YPERR_YPBIND));
 440                 return (YPERR_YPBIND);
 441         }
 442
 443         client->cl_auth = authunix_create_default();
 444         tv.tv_sec = 2;
 445         tv.tv_usec = 0;
 446         r = clnt_call(client, YPPASSWDPROC_UPDATE,
 447             xdr_yppasswd, &ypp, xdr_int, &status, tv);
 448         if (r)
 449                 errx(1, "rpc to yppasswdd failed.");
 450         else if (status)
 451                 printf("Couldn't change NIS password.\n");
 452         else
 453                 printf("The NIS password has been changed on %s, %s\n",
 454                     master, "the master NIS passwd server.");
 455         return(0);
 456 }
 457
 458 #endif /* USE_PAM */
 459
 460 #endif  /* YP */