2 * Copyright (c) 1995, 1996
3 * Bill Paul <wpaul@ctr.columbia.edu>. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by Bill Paul.
16 * 4. Neither the name of the author nor the names of any co-contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
20 * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL Bill Paul OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 static const char rcsid[] =
45 #include <sys/socket.h>
46 #include <netinet/in.h>
47 #include <arpa/inet.h>
54 #include <rpcsvc/yp.h>
55 #include <sys/types.h>
57 #include <sys/param.h>
58 #include <sys/fcntl.h>
59 struct dom_binding {};
60 #include <rpcsvc/ypclnt.h>
61 #include "yppasswdd_extern.h"
63 #include "yppasswd_private.h"
79 while(wait3(&st, WNOHANG, NULL) > 0) ;
81 pid = waitpid(pid, &pstat, 0);
88 void install_reaper(on)
92 signal(SIGCHLD, reaper);
94 signal(SIGCHLD, SIG_DFL);
99 static struct passwd yp_password;
101 static void copy_yp_pass(p, x, m)
105 register char *t, *s = p;
108 yp_password.pw_fields = 0;
110 buf = (char *)realloc(buf, m + 10);
113 /* Turn all colons into NULLs */
114 while (strchr(s, ':')) {
115 s = (strchr(s, ':') + 1);
120 #define EXPAND(e) e = t; while ((*t++ = *p++));
121 EXPAND(yp_password.pw_name);
122 yp_password.pw_fields |= _PWF_NAME;
123 EXPAND(yp_password.pw_passwd);
124 yp_password.pw_fields |= _PWF_PASSWD;
125 yp_password.pw_uid = atoi(p);
126 p += (strlen(p) + 1);
127 yp_password.pw_fields |= _PWF_UID;
128 yp_password.pw_gid = atoi(p);
129 p += (strlen(p) + 1);
130 yp_password.pw_fields |= _PWF_GID;
132 EXPAND(yp_password.pw_class);
133 yp_password.pw_fields |= _PWF_CLASS;
134 yp_password.pw_change = atol(p);
135 p += (strlen(p) + 1);
136 yp_password.pw_fields |= _PWF_CHANGE;
137 yp_password.pw_expire = atol(p);
138 p += (strlen(p) + 1);
139 yp_password.pw_fields |= _PWF_EXPIRE;
141 EXPAND(yp_password.pw_gecos);
142 yp_password.pw_fields |= _PWF_GECOS;
143 EXPAND(yp_password.pw_dir);
144 yp_password.pw_fields |= _PWF_DIR;
145 EXPAND(yp_password.pw_shell);
146 yp_password.pw_fields |= _PWF_SHELL;
151 static int validchars(arg)
156 for (i = 0; i < strlen(arg); i++) {
157 if (iscntrl(arg[i])) {
158 yp_error("string contains a control character");
162 yp_error("string contains a colon");
165 /* Be evil: truncate strings with \n in them silently. */
166 if (arg[i] == '\n') {
174 static int validate_master(opw, npw)
176 struct x_master_passwd *npw;
179 if (npw->pw_name[0] == '+' || npw->pw_name[0] == '-') {
180 yp_error("client tried to modify an NIS entry");
184 if (validchars(npw->pw_shell)) {
185 yp_error("specified shell contains invalid characters");
189 if (validchars(npw->pw_gecos)) {
190 yp_error("specified gecos field contains invalid characters");
194 if (validchars(npw->pw_passwd)) {
195 yp_error("specified password contains invalid characters");
201 static int validate(opw, npw)
203 struct x_passwd *npw;
206 if (npw->pw_name[0] == '+' || npw->pw_name[0] == '-') {
207 yp_error("client tried to modify an NIS entry");
211 if (npw->pw_uid != opw->pw_uid) {
212 yp_error("UID mismatch: client says user %s has UID %d",
213 npw->pw_name, npw->pw_uid);
214 yp_error("database says user %s has UID %d", opw->pw_name,
219 if (npw->pw_gid != opw->pw_gid) {
220 yp_error("GID mismatch: client says user %s has GID %d",
221 npw->pw_name, npw->pw_gid);
222 yp_error("database says user %s has GID %d", opw->pw_name,
228 * Don't allow the user to shoot himself in the foot,
231 if (!ok_shell(npw->pw_shell)) {
232 yp_error("%s is not a valid shell", npw->pw_shell);
236 if (validchars(npw->pw_shell)) {
237 yp_error("specified shell contains invalid characters");
241 if (validchars(npw->pw_gecos)) {
242 yp_error("specified gecos field contains invalid characters");
246 if (validchars(npw->pw_passwd)) {
247 yp_error("specified password contains invalid characters");
255 * In order to have one rpc.yppasswdd support multiple domains,
256 * we have to cheat: we search each directory under /var/yp
257 * and try to match the user in each master.passwd.byname
258 * map that we find. If the user matches (username, uid and gid
259 * all agree), then we use that domain. If we match the user in
260 * more than one database, we must abort.
262 static char *find_domain(pw)
268 char yp_mapdir[MAXPATHLEN + 2];
269 static char domain[YPMAXDOMAIN];
274 yp_error("performing multidomain lookup");
276 if ((dird = opendir(yp_dir)) == NULL) {
277 yp_error("opendir(%s) failed: %s", yp_dir, strerror(errno));
281 while ((dirp = readdir(dird)) != NULL) {
282 snprintf(yp_mapdir, sizeof(yp_mapdir), "%s/%s",
283 yp_dir, dirp->d_name);
284 if (stat(yp_mapdir, &statbuf) < 0) {
285 yp_error("stat(%s) failed: %s", yp_mapdir,
290 if (S_ISDIR(statbuf.st_mode)) {
291 tmp = (char *)dirp->d_name;
292 key.data = pw->pw_name;
293 key.size = strlen(pw->pw_name);
295 if (yp_get_record(tmp,"master.passwd.byname",
296 &key, &data, 0) != YP_TRUE) {
299 *(char *)(data.data + data.size) = '\0';
300 copy_yp_pass(data.data, 1, data.size);
301 if (yp_password.pw_uid == pw->pw_uid &&
302 yp_password.pw_gid == pw->pw_gid) {
304 snprintf(domain, YPMAXDOMAIN, "%s", tmp);
311 yp_error("found same user in two different domains");
314 return((char *)&domain);
317 static int update_inplace(pw, domain)
322 DBT key = { NULL, 0 };
323 DBT data = { NULL, 0 };
324 char pwbuf[YPMAXRECORD];
327 char *maps[] = { "master.passwd.byname", "master.passwd.byuid",
328 "passwd.byname", "passwd.byuid" };
330 char *formats[] = { "%s:%s:%d:%d:%s:%ld:%ld:%s:%s:%s",
331 "%s:%s:%d:%d:%s:%ld:%ld:%s:%s:%s",
332 "%s:%s:%d:%d:%s:%s:%s", "%s:%s:%d:%d:%s:%s:%s" };
334 char *yp_last = "YP_LAST_MODIFIED";
335 char yplastbuf[YPMAXRECORD];
337 snprintf(yplastbuf, sizeof(yplastbuf), "%lu", time(NULL));
339 for (i = 0; i < 4; i++) {
342 snprintf(keybuf, sizeof(keybuf), "%ld", pw->pw_uid);
343 key.data = (char *)&keybuf;
344 key.size = strlen(keybuf);
346 key.data = pw->pw_name;
347 key.size = strlen(pw->pw_name);
351 * XXX The passwd.byname and passwd.byuid maps come in
352 * two flavors: secure and insecure. The secure version
353 * has a '*' in the password field whereas the insecure one
354 * has a real crypted password. The maps will be insecure
355 * if they were built with 'unsecure = TRUE' enabled in
356 * /var/yp/Makefile, but we'd have no way of knowing if
357 * this has been done unless we were to try parsing the
358 * Makefile, which is a disgusting thought. Instead, we
359 * read the records from the maps, skip to the first ':'
360 * in them, and then look at the character immediately
361 * following it. If it's an '*' then the map is 'secure'
362 * and we must not insert a real password into the pw_passwd
363 * field. If it's not an '*', then we put the real crypted
366 if (yp_get_record(domain,maps[i],&key,&data,1) != YP_TRUE) {
367 yp_error("couldn't read %s/%s: %s", domain,
368 maps[i], strerror(errno));
372 if ((ptr = strchr(data.data, ':')) == NULL) {
373 yp_error("no colon in passwd record?!");
378 * XXX Supposing we have more than one user with the same
379 * UID? (Or more than one user with the same name?) We could
380 * end up modifying the wrong record if were not careful.
383 if (strncmp(data.data, pw->pw_name,
384 strlen(pw->pw_name))) {
385 yp_error("warning: found entry for UID %d \
386 in map %s@%s with wrong name (%.*s)", pw->pw_uid, maps[i], domain,
387 ptr - (char *)data.data, data.data);
388 yp_error("there may be more than one user \
389 with the same UID - continuing");
394 * We're really being ultra-paranoid here.
395 * This is generally a 'can't happen' condition.
397 snprintf(pwbuf, sizeof(pwbuf), ":%d:%d:", pw->pw_uid,
399 if (!strstr(data.data, pwbuf)) {
400 yp_error("warning: found entry for user %s \
401 in map %s@%s with wrong UID", pw->pw_name, maps[i], domain);
402 yp_error("there may ne more than one user
403 with the same name - continuing");
409 snprintf(pwbuf, sizeof(pwbuf), formats[i],
410 pw->pw_name, pw->pw_passwd, pw->pw_uid,
411 pw->pw_gid, pw->pw_class, pw->pw_change,
412 pw->pw_expire, pw->pw_gecos, pw->pw_dir,
415 snprintf(pwbuf, sizeof(pwbuf), formats[i],
416 pw->pw_name, *(ptr+1) == '*' ? "*" : pw->pw_passwd,
417 pw->pw_uid, pw->pw_gid, pw->pw_gecos, pw->pw_dir,
421 #define FLAGS O_RDWR|O_CREAT
423 if ((dbp = yp_open_db_rw(domain, maps[i], FLAGS)) == NULL) {
424 yp_error("couldn't open %s/%s r/w: %s",domain,
425 maps[i],strerror(errno));
430 data.size = strlen(pwbuf);
432 if (yp_put_record(dbp, &key, &data, 1) != YP_TRUE) {
433 yp_error("failed to update record in %s/%s", domain,
435 (void)(dbp->close)(dbp);
440 key.size = strlen(yp_last);
441 data.data = (char *)&yplastbuf;
442 data.size = strlen(yplastbuf);
444 if (yp_put_record(dbp, &key, &data, 1) != YP_TRUE) {
445 yp_error("failed to update timestamp in %s/%s", domain,
447 (void)(dbp->close)(dbp);
451 (void)(dbp->close)(dbp);
457 static char *yp_mktmpnam()
459 static char path[MAXPATHLEN];
462 sprintf(path,"%s",passfile);
463 if ((p = strrchr(path, '/')))
467 strcpy(p, "yppwtmp.XXXXXX");
468 return(mktemp(path));
472 yppasswdproc_update_1_svc(yppasswd *argp, struct svc_req *rqstp)
475 struct sockaddr_in *rqhost;
480 int passwd_changed = 0;
481 int shell_changed = 0;
482 int gecos_changed = 0;
483 char *oldshell = NULL;
484 char *oldgecos = NULL;
486 char passfile_buf[MAXPATHLEN + 2];
487 char *domain = yppasswd_domain;
488 static struct sockaddr_in clntaddr;
489 static struct timeval t_saved, t_test;
492 * Normal user updates always use the 'default' master.passwd file.
495 passfile = passfile_default;
498 rqhost = svc_getcaller(rqstp->rq_xprt);
500 gettimeofday(&t_test, NULL);
501 if (!bcmp((char *)rqhost, (char *)&clntaddr,
502 sizeof(struct sockaddr_in)) &&
503 t_test.tv_sec > t_saved.tv_sec &&
504 t_test.tv_sec - t_saved.tv_sec < 300) {
506 bzero((char *)&clntaddr, sizeof(struct sockaddr_in));
507 bzero((char *)&t_saved, sizeof(struct timeval));
511 bcopy((char *)rqhost, (char *)&clntaddr, sizeof(struct sockaddr_in));
512 gettimeofday(&t_saved, NULL);
514 if (yp_access(resvport ? "master.passwd.byname" : NULL, rqstp)) {
515 yp_error("rejected update request from unauthorized host");
516 svcerr_auth(rqstp->rq_xprt, AUTH_BADCRED);
521 * Step one: find the user. (It's kinda pointless to
522 * proceed if the user doesn't exist.) We look for the
523 * user in the master.passwd.byname database, _NOT_ by
524 * using getpwent() and friends! We can't use getpwent()
525 * since the NIS master server is not guaranteed to be
526 * configured as an NIS client.
530 if ((domain = find_domain(&argp->newpw)) == NULL) {
531 yp_error("multidomain lookup failed - aborting update");
534 yp_error("updating user %s in domain %s",
535 argp->newpw.pw_name, domain);
538 key.data = argp->newpw.pw_name;
539 key.size = strlen(argp->newpw.pw_name);
541 if ((rval=yp_get_record(domain,"master.passwd.byname",
542 &key, &data, 0)) != YP_TRUE) {
543 if (rval == YP_NOKEY) {
544 yp_error("user %s not found in passwd database",
545 argp->newpw.pw_name);
547 yp_error("database access error: %s",
553 /* Nul terminate, please. */
554 *(char *)(data.data + data.size) = '\0';
556 copy_yp_pass(data.data, 1, data.size);
558 /* Step 2: check that the supplied oldpass is valid. */
560 if (strcmp(crypt(argp->oldpass, yp_password.pw_passwd),
561 yp_password.pw_passwd)) {
562 yp_error("rejected change attempt -- bad password");
563 yp_error("client address: %s username: %s",
564 inet_ntoa(rqhost->sin_addr),
565 argp->newpw.pw_name);
569 /* Step 3: validate the arguments passed to us by the client. */
571 if (validate(&yp_password, &argp->newpw)) {
572 yp_error("rejecting change attempt: bad arguments");
573 yp_error("client address: %s username: %s",
574 inet_ntoa(rqhost->sin_addr),
575 argp->newpw.pw_name);
576 svcerr_decode(rqstp->rq_xprt);
580 /* Step 4: update the user's passwd structure. */
582 if (!no_chsh && strcmp(argp->newpw.pw_shell, yp_password.pw_shell)) {
583 oldshell = yp_password.pw_shell;
584 yp_password.pw_shell = argp->newpw.pw_shell;
589 if (!no_chfn && strcmp(argp->newpw.pw_gecos, yp_password.pw_gecos)) {
590 oldgecos = yp_password.pw_gecos;
591 yp_password.pw_gecos = argp->newpw.pw_gecos;
595 if (strcmp(argp->newpw.pw_passwd, yp_password.pw_passwd)) {
596 yp_password.pw_passwd = argp->newpw.pw_passwd;
597 yp_password.pw_change = 0;
602 * If the caller specified a domain other than our 'default'
603 * domain, change the path to master.passwd accordingly.
606 if (strcmp(domain, yppasswd_domain)) {
607 snprintf(passfile_buf, sizeof(passfile_buf),
608 "%s/%s/master.passwd", yp_dir, domain);
609 passfile = (char *)&passfile_buf;
612 /* Step 5: make a new password file with the updated info. */
614 if ((pfd = pw_lock()) < 0) {
617 if ((tfd = pw_tmp()) < 0) {
621 if (pw_copy(pfd, tfd, &yp_password)) {
622 yp_error("failed to created updated password file -- \
623 cleaning up and bailing out");
628 passfile_hold = yp_mktmpnam();
629 rename(passfile, passfile_hold);
630 if (strcmp(passfile, _PATH_MASTERPASSWD)) {
631 rename(tempname, passfile);
633 if (pw_mkdb(argp->newpw.pw_name) < 0) {
634 yp_error("pwd_mkdb failed");
640 if ((rval = update_inplace(&yp_password, domain))) {
641 yp_error("inplace update failed -- rebuilding maps");
645 switch((pid = fork())) {
647 if (inplace && !rval) {
648 execlp(MAP_UPDATE_PATH, MAP_UPDATE, passfile,
649 yppasswd_domain, "pushpw", NULL);
651 execlp(MAP_UPDATE_PATH, MAP_UPDATE, passfile,
652 yppasswd_domain, NULL);
654 yp_error("couldn't exec map update process: %s",
657 rename(passfile_hold, passfile);
661 yp_error("fork() failed: %s", strerror(errno));
663 rename(passfile_hold, passfile);
667 unlink(passfile_hold);
672 yp_error("update completed for user %s (uid %d):",
677 yp_error("password changed");
680 yp_error("gecos changed ('%s' -> '%s')",
681 oldgecos, argp->newpw.pw_gecos);
684 yp_error("shell changed ('%s' -> '%s')",
685 oldshell, argp->newpw.pw_shell);
694 struct cmsgcred cmcred;
698 * Note that this function performs a little less sanity checking
699 * than the last one. Since only the superuser is allowed to use it,
700 * it is assumed that the caller knows what he's doing.
702 int *yppasswdproc_update_master_1_svc(master_yppasswd *argp,
703 struct svc_req *rqstp)
711 char passfile_buf[MAXPATHLEN + 2];
712 struct sockaddr_in *rqhost;
719 * NO AF_INET CONNETCIONS ALLOWED!
721 rqhost = svc_getcaller(rqstp->rq_xprt);
722 if (rqhost->sin_family != AF_UNIX) {
723 yp_error("Alert! %s/%d attempted to use superuser-only \
724 procedure!\n", inet_ntoa(rqhost->sin_addr), rqhost->sin_port);
725 svcerr_auth(rqstp->rq_xprt, AUTH_BADCRED);
729 transp = rqstp->rq_xprt;
731 if (transp->xp_verf.oa_length < sizeof(struct cmessage) ||
732 transp->xp_verf.oa_base == NULL ||
733 transp->xp_verf.oa_flavor != AUTH_UNIX) {
734 yp_error("caller didn't send proper credentials");
735 svcerr_auth(rqstp->rq_xprt, AUTH_BADCRED);
739 cm = (struct cmessage *)transp->xp_verf.oa_base;
740 if (cm->cmsg.cmsg_type != SCM_CREDS) {
741 yp_error("caller didn't send proper credentials");
742 svcerr_auth(rqstp->rq_xprt, AUTH_BADCRED);
746 if (cm->cmcred.cmcred_euid) {
747 yp_error("caller euid is %d, expecting 0 -- rejecting request",
748 cm->cmcred.cmcred_euid);
749 svcerr_auth(rqstp->rq_xprt, AUTH_BADCRED);
753 passfile = passfile_default;
755 key.data = argp->newpw.pw_name;
756 key.size = strlen(argp->newpw.pw_name);
759 * The superuser may add entries to the passwd maps if
760 * rpc.yppasswdd is started with the -a flag. Paranoia
761 * prevents me from allowing additions by default.
763 if ((rval = yp_get_record(argp->domain, "master.passwd.byname",
764 &key, &data, 0)) != YP_TRUE) {
765 if (rval == YP_NOKEY) {
766 yp_error("user %s not found in passwd database",
767 argp->newpw.pw_name);
769 yp_error("notice: adding user %s to \
770 master.passwd database for domain %s", argp->newpw.pw_name, argp->domain);
772 yp_error("restart rpc.yppasswdd with the -a flag to \
773 allow additions to be made to the password database");
775 yp_error("database access error: %s",
778 if (!allow_additions)
782 /* Nul terminate, please. */
783 *(char *)(data.data + data.size) = '\0';
785 copy_yp_pass(data.data, 1, data.size);
789 * Perform a small bit of sanity checking.
791 if (validate_master(rval == YP_TRUE ? &yp_password:NULL,&argp->newpw)){
792 yp_error("rejecting update attempt for %s: bad arguments",
793 argp->newpw.pw_name);
798 * If the caller specified a domain other than our 'default'
799 * domain, change the path to master.passwd accordingly.
802 if (strcmp(argp->domain, yppasswd_domain)) {
803 snprintf(passfile_buf, sizeof(passfile_buf),
804 "%s/%s/master.passwd", yp_dir, argp->domain);
805 passfile = (char *)&passfile_buf;
808 if ((pfd = pw_lock()) < 0) {
811 if ((tfd = pw_tmp()) < 0) {
815 if (pw_copy(pfd, tfd, (struct passwd *)&argp->newpw)) {
816 yp_error("failed to created updated password file -- \
817 cleaning up and bailing out");
822 passfile_hold = yp_mktmpnam();
823 rename(passfile, passfile_hold);
824 if (strcmp(passfile, _PATH_MASTERPASSWD)) {
825 rename(tempname, passfile);
827 if (pw_mkdb(argp->newpw.pw_name) < 0) {
828 yp_error("pwd_mkdb failed");
834 if ((rval = update_inplace((struct passwd *)&argp->newpw,
836 yp_error("inplace update failed -- rebuilding maps");
840 switch((pid = fork())) {
842 if (inplace && !rval) {
843 execlp(MAP_UPDATE_PATH, MAP_UPDATE, passfile,
844 argp->domain, "pushpw", NULL);
846 execlp(MAP_UPDATE_PATH, MAP_UPDATE, passfile,
849 yp_error("couldn't exec map update process: %s",
852 rename(passfile_hold, passfile);
856 yp_error("fork() failed: %s", strerror(errno));
858 rename(passfile_hold, passfile);
862 unlink(passfile_hold);
866 yp_error("performed update of user %s (uid %d) domain %s",