d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Support shadow.byname and shadow.byuid maps, protecting them by

Browse Source 
insisting on privileged port access.

Include /var/yp/Makefile.local if it exists and suggest using
it to override /var/yp/Makefile behaviour.

Approved by:	re (kib)
MFC after:	3 weeks
This commit is contained in:
Brian Somers 2009-06-25 16:15:39 +00:00
parent 2642e635f2
commit 53c405786b
7 changed files with 98 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
share/man/man8/yp.8
View File

@ -28,7 +28,7 @@
.\" from: @(#)yp.8 1.0 (deraadt) 4/26/93
.\" $FreeBSD$
.\"
.Dd April 5, 1993
.Dd June 25, 2009
.Dt YP 8
.Os
.Sh NAME
@ -310,9 +310,15 @@ The
.Tn NIS
.Pa Makefile
.Pq Pa /var/yp/Makefile
will do this automatically if the administrator comments out the
line which says
.Dq Li NOPUSH=true
will do this automatically if the administrator creates
.Pa /var/yp/Makefile.local
and empties the
.Va NOPUSH
variable:
.Bd -literal -offset four
.Li NOPUSH=
.Ed
.Pp
.Va ( NOPUSH
is set to true by default because the default configuration is
for a small network with only one
@ -394,9 +400,11 @@ To help prevent this,
.Fx Ns 's
.Tn NIS
server handles the shadow password maps
.Pa ( master.passwd.byname
.Pa ( master.passwd.byname ,
.Pa master.passwd.byuid ,
.Pa shadow.byname
and
.Pa master.passwd.byuid )
.Pa shadow.byuid )
in a special way: the server will only provide access to these
maps in response to requests that originate on privileged ports.
Since only the super-user is allowed to bind to a privileged port,

1
usr.bin/ypcat/ypcat.c
View File

@ -52,6 +52,7 @@ struct ypalias {
} ypaliases[] = {
{ "passwd", "passwd.byname" },
{ "master.passwd", "master.passwd.byname" },
{ "shadow", "shadow.byname" },
{ "group", "group.byname" },
{ "networks", "networks.byaddr" },
{ "hosts", "hosts.byaddr" },

1
usr.bin/ypmatch/ypmatch.c
View File

@ -52,6 +52,7 @@ struct ypalias {
} ypaliases[] = {
{ "passwd", "passwd.byname" },
{ "master.passwd", "master.passwd.byname" },
{ "shadow", "shadow.byname" },
{ "group", "group.byname" },
{ "networks", "networks.byaddr" },
{ "hosts", "hosts.byname" },

1
usr.bin/ypwhich/ypwhich.c
View File

@ -64,6 +64,7 @@ struct ypalias {
} ypaliases[] = {
{ "passwd", "passwd.byname" },
{ "master.passwd", "master.passwd.byname" },
{ "shadow", "shadow.byname" },
{ "group", "group.byname" },
{ "networks", "networks.byaddr" },
{ "hosts", "hosts.byaddr" },

92
usr.sbin/ypserv/Makefile.yp
View File

@ -11,33 +11,40 @@
# This Makefile can be modified to support more NIS maps if desired.
#
# If this machine is an NIS master, comment out this next line so
# that changes to the NIS maps can be propagated to the slave servers.
# (By default we assume that we are only serving a small domain with
# only one server.)
# If this machine is an NIS master, reset this variable (NOPUSH=)
# in Makefile.local so that changes to the NIS maps can be propagated to
# the slave servers. (By default we assume that we are only serving a
# small domain with only one server.)
#
NOPUSH = "True"
# If this machine does not wish to generate a linux-style shadow map
# from the master.passwd file, reset this variable (SHADOW=) in
# Makefile.local.
SHADOW = "True"
# If you want to use a FreeBSD NIS server to serve non-FreeBSD clients
# (i.e. clients who expect the password field in the passwd maps to be
# valid) then uncomment this line. This will cause $YPDIR/passwd to
# be generated with valid password fields. This is insecure: FreeBSD
# normally only serves the master.passwd maps (which have real encrypted
# passwords in them) to the superuser on other FreeBSD machines, but
# non-FreeBSD clients (e.g. SunOS, Solaris (without NIS+), IRIX, HP-UX,
# etc...) will only work properly in 'unsecure' mode.
# valid) then set this variable (UNSECURE="True") in Makefile.local.
# This will cause $YPDIR/passwd to be generated with valid password
# fields. This is insecure: FreeBSD normally only serves the
# master.passwd and shadow maps (which have real encrypted passwords
# in them) to the superuser on other FreeBSD machines, but non-FreeBSD
# clients (e.g. SunOS, Solaris (without NIS+), IRIX, HP-UX, etc...)
# will only work properly in 'unsecure' mode.
#
#UNSECURE = "True"
# The following line encodes the YP_INTERDOMAIN key into the hosts.byname
# and hosts.byaddr maps so that ypserv(8) will do DNS lookups to resolve
# hosts not in the current domain. Commenting this line out will disable
# the DNS lookups.
# hosts not in the current domain. Resetting this variable in
# Makefile.local (B=) will disable the DNS lookups.
B=-b
# Normally, the master.passwd.* maps are guarded against access from
# non-privileged users. By commenting out the following line, the YP_SECURE
# key will be removed from these maps, allowing anyone to access them.
# Normally, the master.passwd.* and shadow.* maps are guarded against access
# from non-privileged users. By resetting S in Makefile.local (S=), the
# YP_SECURE key will be removed from these maps, allowing anyone to access
# them.
S=-s
# These are commands which this Makefile needs to properly rebuild the
@ -118,6 +125,17 @@ PUBLICKEY = $(YPSRCDIR)/publickey
NETID = $(YPSRCDIR)/netid
AMDHOST = $(YPSRCDIR)/amd.map
target:
@if [ ! -d $(DOMAIN) ]; then mkdir $(DOMAIN); fi; \
cd $(DOMAIN) ; echo "NIS Map update started on `date` for domain $(DOMAIN)" ; \
make -f ../Makefile all; echo "NIS Map update completed."
# Read overrides. Note, the current directory will be /var/yp/<domain>
# when 'all' is built.
.if exists(${YPDIR}/Makefile.local)
.include "${YPDIR}/Makefile.local"
.endif
# List of maps that are always built.
# If you want to omit some of them, feel free to comment
# them out from this list.
@ -148,6 +166,9 @@ NETGROUP= /dev/null
.if exists($(MASTER))
TARGETS+= passwd master.passwd netid
.if ${SHADOW} == "\"True\""
TARGETS+= shadow
.endif
.else
MASTER= /dev/null
TARGETS+= nopass
@ -171,11 +192,6 @@ TARGETS+= ipnodes
IPNODES= /dev/null
.endif
target:
@if [ ! -d $(DOMAIN) ]; then mkdir $(DOMAIN); fi; \
cd $(DOMAIN) ; echo "NIS Map update started on `date` for domain $(DOMAIN)" ; \
make -f ../Makefile all; echo "NIS Map update completed."
all: $(TARGETS)
ethers: ethers.byname ethers.byaddr
@ -187,6 +203,7 @@ protocols: protocols.bynumber protocols.byname
rpc: rpc.byname rpc.bynumber
services: services.byname
passwd: passwd.byname passwd.byuid
shadow: shadow.byname shadow.byuid
group: group.byname group.bygid
netgrp: netgroup
netid: netid.byname
@ -207,6 +224,10 @@ pushpw:
@$(DBLOAD) -c
@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) master.passwd.byname ; fi
@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) master.passwd.byuid ; fi
.if ${SHADOW} == "\"True\""
@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) shadow.byname ; fi
@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) shadow.byuid ; fi
.endif
@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) passwd.byname ; fi
@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) passwd.byuid ; fi
@ -586,6 +607,36 @@ master.passwd.byuid: $(MASTER)
.endif
shadow.byname: $(MASTER)
@echo "Updating $@..."
.if ${MASTER} == "/dev/null"
@echo "Master.passwd source file not found -- skipping"
.else
@$(AWK) -F: '{ if ($$1 != "" && $$1 !~ "^#.*" && $$1 != "+") \
print $$1"\t"$$1":"$$2":12000:0:99999:7:::" }' $(MASTER) \
| sed 's/\( [^:]*:\)\*:/\1!:/' \
| $(DBLOAD) ${S} -f -i $(PASSWD) -o $(YPMAPDIR)/$@ - $(TMP); \
$(RMV) $(TMP) $@
@$(DBLOAD) -c
@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) $@; fi
@if [ ! $(NOPUSH) ]; then echo "Pushed $@ map." ; fi
.endif
shadow.byuid: $(MASTER)
@echo "Updating $@..."
.if ${MASTER} == "/dev/null"
@echo "Master.passwd source file not found -- skipping"
.else
@$(AWK) -F: '{ if ($$1 != "" && $$1 !~ "^#.*" && $$1 != "+") \
print $$3"\t"$$1":"$$2":12000:0:99999:7:::" }' $(MASTER) \
| sed 's/\( [^:]*:\)\*:/\1!:/' \
| $(DBLOAD) ${S} -f -i $(PASSWD) -o $(YPMAPDIR)/$@ - $(TMP); \
$(RMV) $(TMP) $@
@$(DBLOAD) -c
@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) $@; fi
@if [ ! $(NOPUSH) ]; then echo "Pushed $@ map." ; fi
.endif
amd.map: $(AMDHOST)
@echo "Updating $@..."
@$(AWK) '$$1 !~ "^#.*" { \
@ -604,4 +655,3 @@ amd.map: $(AMDHOST)
@$(DBLOAD) -c
@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) $@; fi
@if [ ! $(NOPUSH) ]; then echo "Pushed $@ map." ; fi

8
usr.sbin/ypserv/yp_access.c
View File

@ -178,9 +178,9 @@ load_securenets(void)
* yp_access() checks the mapname and client host address and watches for
* the following things:
*
* - If the client is referencing one of the master.passwd.* maps, it must
* be using a privileged port to make its RPC to us. If it is, then we can
* assume that the caller is root and allow the RPC to succeed. If it
* - If the client is referencing one of the master.passwd.* or shadow.* maps,
* it must be using a privileged port to make its RPC to us. If it is, then
* we can assume that the caller is root and allow the RPC to succeed. If it
* isn't access is denied.
*
* - The client's IP address is checked against the securenets rules.
@ -254,7 +254,7 @@ possible spoof attempt from %s:%d",
#ifdef DB_CACHE
if ((yp_testflag((char *)map, (char *)domain, YP_SECURE) ||
#else
if ((strstr(map, "master.passwd.") ||
if ((strstr(map, "master.passwd.") || strstr(map, "shadow.") ||
#endif
(rqstp->rq_prog == YPPROG &&
rqstp->rq_proc == YPPROC_XFR) ||

8
usr.sbin/ypserv/ypserv.8
View File

@ -30,7 +30,7 @@
.\"
.\" $FreeBSD$
.\"
.Dd February 3, 2008
.Dd June 25, 2009
.Dt YPSERV 8
.Os
.Sh NAME
@ -142,7 +142,11 @@ and
.Pa master.passwd.byuid
maps in a special way.
When the server receives a request to access
either of these two maps, it will check the TCP port from which the
either of these two maps (or in fact either of the
.Pa shadow.byname
or
.Pa shadow.byuid
maps), it will check the TCP port from which the
request originated and return an error if the port number is greater
than 1023.
Since only the superuser is allowed to bind to TCP ports