d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

The rpc.yppasswdd has an option to not allow shell changes (-s), but is

Browse Source 
always passed a shell by the remote yppasswd. If an NIS client overrides the
shell provided by the ypserv, then yppasswd (pam_unix, actually, afaict)
will pass this new shell to the yppasswdd. If this shell has been set on the
client to a shell which is invalid on the server, a user will never be able
to change their password on the client.

PR:		67142
Submitted by:	russell@rucus.ru.ac.za
Approved by:	bapt (mentor)
Sponsored by:	EuroBSDCon Sweden.
This commit is contained in:
Marcelo Araujo 2015-10-02 08:58:50 +00:00
parent 10b83bb0e9
commit 0bc8063012
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
usr.sbin/rpc.yppasswdd/yppasswdd_server.c
View File

@ -212,12 +212,12 @@ validate(struct passwd *opw, struct x_passwd *npw)
* Don't allow the user to shoot himself in the foot,
* even on purpose.
*/
if (!ok_shell(npw->pw_shell)) {
if (!no_chsh && !ok_shell(npw->pw_shell)) {
yp_error("%s is not a valid shell", npw->pw_shell);
return(1);
}
if (validchars(npw->pw_shell)) {
if (!no_chsh && validchars(npw->pw_shell)) {
yp_error("specified shell contains invalid characters");
return(1);
}