2 .\" Copyright (c) 2004, Sun Microsystems, Inc. All Rights Reserved
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH RPC.YPPASSWDD 8 "Aug 24, 2004"
8 rpc.yppasswdd, yppasswdd \- server for modifying NIS password file
12 \fB/usr/lib/netsvc/yp/rpc.yppasswdd\fR [\fB-D\fR \fIdirectory\fR]
13 [\fB-nogecos\fR] [\fB-noshell\fR] [\fB-nopw\fR]
14 [\fB-m\fR \fIargument1\fR \fIargument2\fR...]
19 \fB/usr/lib/netsvc/yp/rpc.yppasswdd\fR
20 [\fIpasswordfile\fR [\fIadjunctfile\fR]]
21 [\fB-nogecos\fR] [\fB-noshell\fR] [\fB-nopw\fR]
22 [\fB-m\fR \fIargument1\fR \fIargument2\fR...]
28 \fBrpc.yppasswdd\fR is a server that handles password change requests from
29 \fByppasswd\fR(1). It changes a password entry in the \fBpasswd\fR,
30 \fBshadow\fR, and \fBsecurity/passwd.adjunct\fR files. The \fBpasswd\fR and
31 \fBshadow\fR files provide the basis for the \fBpasswd.byname\fR and
32 \fBpasswd.byuid\fR maps. The \fBpasswd.adjunct\fR file provides the basis for
33 the \fBpasswd.adjunct.byname\fR and \fBpasswd.adjunct.byuid\fR maps. Entries in
34 the \fBpasswd\fR, \fBshadow\fR or \fBpasswd.adjunct\fR files are changed only
35 if the password presented by \fByppasswd\fR(1) matches the encrypted password
36 of the entry. All password files are located in the \fBPWDIR\fR directory.
39 If the \fB-D\fR option is given, the \fBpasswd\fR, \fBshadow,\fR or
40 \fBpasswd.adjunct\fR files are placed under the directory path that is the
44 If the \fB-noshell\fR, \fB-nogecos\fR or \fB-nopw\fR options are given, these
45 fields cannot be changed remotely using \fBchfn\fR, \fBchsh\fR, or
49 If the \fB-m\fR option is given, a \fBmake\fR(1S) is performed in \fB/var/yp\fR
50 after any of the \fBpasswd\fR, \fBshadow\fR, or \fBpasswd.adjunct\fR files are
51 modified. All arguments following the flag are passed to \fBmake\fR.
54 The second of the listed syntaxes is provided only for backward compatibility.
55 If the second syntax is used, the \fBpasswordfile\fR is the full pathname of
56 the password file and \fBadjunctfile\fR is the full pathname of the optional
57 \fBpasswd.adjunct\fR file. If a shadow file is found in the same directory as
58 \fBpasswordfile\fR, the \fBshadowfile\fR is used as described above. Use of
59 this syntax and the discovery of a \fBshadowfile\fR file generates diagnostic
60 output. The daemon, however, starts normally.
63 The first and second syntaxes are mutually exclusive. You cannot specify the
64 full pathname of the \fBpasswd\fR, \fBpasswd.adjunct\fR files and use the
65 \fB-D\fR option at the same time.
68 The daemon is started automatically on the master server of the passwd map by
69 \fBypstart\fR(8), which is invoked at boot time by the
70 \fBsvcs:/network/nis/server:default\fR service.
73 The server does not insist on the presence of a \fBshadow\fR file unless there
74 is no \fB-D\fR option present or the directory named with the \fB-D\fR option
75 is \fB/etc\fR. In addition, a \fBpasswd.adjunct\fR file is not necessary. If
76 the \fB-D\fR option is given, the server attempts to find a
77 \fBpasswd.adjunct\fR file in the \fBsecurity\fR subdirectory of the named
78 directory. For example, in the presence of \fB-D\fR \fB/var/yp\fR the server
79 checks for a \fB/var/yp/security/passwd.adjunct\fR file.
82 If only a \fBpasswd\fR file exists, then the encrypted password is expected in
83 the second field. If both a \fBpasswd\fR and a \fBpasswd.adjunct\fR file exist,
84 the encrypted password is expected in the second field of the adjunct file with
85 \fI##username\fR in the second field of the \fBpasswd\fR file. If all three
86 files are in use, the encrypted password is expected in the \fBshadow\fR file.
87 Any deviation causes a password update to fail.
90 If you remove or add a \fBshadow\fR or \fBpasswd.adjunct\fR file after
91 \fBrpc.yppasswdd\fR has started, you must stop and restart the daemon to enable
92 it to recognize the change. See \fBypstart\fR(1m) for information on restarting
96 The \fBrpc.yppasswdd\fR daemon considers a shell that has a name that begins
97 with 'r' to be a restricted shell. By default, the daemon does not check
98 whether a shell begins with an '\fBr\fR'. However, you can tell it to do so by
99 uncommenting the \fBcheck_restricted_shell_name=1\fR line in
100 \fB/etc/default/yppasswdd\fR. The result will be to restrict a user's ability
101 to change from his default shell. See \fByppasswdd\fR(4).
104 On start up, \fByppasswdd\fR checks for the existence of a NIS to LDAP (N2L)
105 configuration file, \fB/var/yp/NISLDAPmapping\fR. If the configuration file is
106 present, the daemon runs in N2L mode. If the file is not present,
107 \fByppasswdd\fR runs in traditional, non-N2L mode.
110 In N2L mode, changes are written directly to the Directory Information Tree
111 (DIT). If the changes are written successfully, the NIS map is updated. The NIS
112 source files, \fBpasswd\fR, \fBshadow\fR, and \fBpasswd.adjunct\fR, for
113 example, are not updated. Thus, in N2L mode, the \fB-D\fR option is
114 meaningless. In N2L mode, \fByppasswdd\fR propagates changes by calling
115 \fByppush\fR(8) instead of \fBypmake\fR(8). The \fB-m\fR option is thus
119 During an NIS-to-LDAP transition, the \fByppasswdd\fR daemon uses the
120 N2L-specific map, \fBageing.byname\fR, to read and write password aging
121 information to the DIT. If you are not using password aging, then the
122 \fBageing.byname\fR mapping is ignored.
126 \fBsvcs\fR(1), \fBmake\fR(1S), \fBpasswd\fR(1), \fByppasswd\fR(1),
127 \fBinetd\fR(8), \fBsvcadm\fR(8), \fBypmake\fR(8), \fByppush\fR(8),
128 \fBypstart\fR(8), \fBNISLDAPmapping\fR(4), \fBpasswd\fR(4), \fBshadow\fR(4),
129 \fBypfiles\fR(4), \fByppasswdd\fR(4), \fBypserv\fR(4), \fBattributes\fR(5),
134 If \fBmake\fR has not been installed and the \fB-m\fR option is given, the
135 daemon outputs a warning and proceeds, effectively ignoring the \fB-m\fR flag.
138 When using the \fB-D\fR option, you should make sure that the \fBPWDIR\fR of
139 the \fB/var/yp/Makefile\fR is set accordingly.
142 The second listed syntax is supplied only for backward compatibility and might
143 be removed in a future release of this daemon.
146 The Network Information Service (\fBNIS\fR) was formerly known as Sun Yellow
147 Pages (\fBYP\fR). The functionality of the two remains the same; only the name
148 has changed. The name Yellow Pages is a registered trademark in the United
149 Kingdom of British Telecommunications PLC, and cannot be used without
153 The NIS server service is managed by the service management facility,
154 \fBsmf\fR(5), under the service identifier:
158 svcs:/network/nis/server:default
165 Administrative actions on this service, such as enabling, disabling, or
166 requesting restart, can be performed using \fBsvcadm\fR(8). The service's
167 status can be queried using the \fBsvcs\fR(1) command.