YPPASSWDD(8)

NAME
yppasswdd - NIS password database update server

SYNOPSIS
yppasswdd [-m master password file] [-s] [-f] [-v] [-h]

DESCRIPTION
yppasswdd is the RPC server that lets users change their passwords in the presence of NIS (a.k.a. YP). It must be run on the NIS master server for that NIS domain.

When a yppasswd(1) client contacts the server, it sends the old user password along with the new one. yppasswdd will search the system's NIS password database file for the specified user name, verify that the given (old) password matches, and update the entry. If the user specified does not exist, or if the password, UID or GID doesn't match the information in the password file, the update request is rejected, and an error returned to the client.

After updating the master.passwd file and returning a success notifications to the client, yppasswdd executes the yppwupdate script that updates the NIS server's master.passwd.* and passwd.* maps. This script invokes /var/yp/Makefile to rebuild the NIS password maps (and propagate them to NIS slave servers if there are any in the domain).

OPTIONS
The following options are available with yppasswdd:

- m master password file
    yppasswdd server needs to know the location of the master.passwd file that is to be used to generate updated NIS password maps. This file is normally kept in /var/yp (it must be owned by root and not world readable for security reasons). If you move it somewhere else you'll have to tell yppasswdd using the -m option. The location of this file is also passed to /var/yp/Makefile when time comes to rebuild the NIS password maps. It is recommended, however, that you edit /var/yp/Makefile to reflect the new location as well. When the server is ready to change a password database entry, it will modify master.passwd, then call the yppwupdate script, which will in turn call /var/yp/Makefile.

    Without the -m option, yppasswdd expects to use the local /etc/master.passwd file on the NIS master server as the source for regenerating the password maps (the server will rebuild the local password databases in this case as well).

    This is less secure than using a seperate password database to restrict access to the NIS master server, but the functionality is provided in the event this behavior is desired and security is not paramount (such as might be the case on a closed local network of trusted systems). Note that you will have to edit /var/yp/Makefile to use /etc/master.passwd instead of /var/yp/master.passwd if you want to use yppasswdd in this way.

-s  When invoked with the -s flag, yppasswdd will allow users to change the shell field of their NIS password entry. Without it, yppasswd(1) will appear to succeed when a user tries to change shells, but yppasswdd will not actually alter the password database.

-f  This flag works just like -s, except it applies to the GECOS or "fullname" field of a user's NIS password entry instead of the shell field. Some sites may wish to restrict users' ability to change their shells or full names for security or administrative reasons, which is why these two options are provided.

MISCELLANEOUS

  Logging
yppasswdd logs all password update requests to syslogd(8) auth facility. The logging information includes the originating host's IP address and the user name and UID contained in the request. The user-supplied password itself is not logged.

  Security
Unless I've screwed up completely (as I did with versions prior to version 0.7), yppasswdd should be as secure or insecure as any program relying on simple password authentication. If you feel that this is not enough, you may want to protect yppasswdd from outside access by using the 'securenets' feature of portmap(8) version 3. Better still, use Kerberos.

NOTES

  FreeBSD changes
Unlike the original yppasswdd, the FreeBSD version has no support for John F. Haugh II's shadow password suite. It doesn't need it: 4.4BSD's password database system already implements shadow passwords.

  Using the yppasswdd server with non-FreeBSD clients
FreeBSD's yppasswdd should work equally well with non-FreeBSD client machines provided a few small changes are made to /var/yp/Makefile. FreeBSD's passwd.byname and passwd.byuid maps do not contain actual encrypted passwords (just like FreeBSD's /etc/passwd file): the real encrypted passwords are kept in master.passwd.byname and master.passwd.byuid, which FreeBSD's NIS server will only serve to the superuser on FreeBSD NIS clients (non-privileged users are not permitted to access these maps). Non-FreeBSD clients will not function properly in this situation, since they require the password fields in the passwd.* maps to be valid.

To use yppasswdd with non-FreeBSD clients, you will need to edit /var/yp/Makefile and uncomment the line that says 'UNSECURE=True' and run make(1). This will cause /var/yp/Makefile to generate passwd.* maps with real passwords in them instead of stripping them out as it does normally.

FILES
/usr/sbin/yppasswdd
    The yppasswdd daemon
/usr/libexec/yppwupdate
    The NIS map update script
/var/yp/master.passwd
    NIS password map source file
/etc/master.passwd
    Raw local password database (only used when -m option isn't supplied)

SEE ALSO
passwd(5), passwd(1), portmap(8), yppasswd(1), ypchsh(1), ypchfn(1), ypserv(8), ypcat(8).

COPYRIGHT
yppasswdd is copyright (C) Olaf Kirch. You can use and distribute it under the GNU General Public License Version 2.

AUTHOR(S)
Olaf Kirch, <okir@monad.swb.de>
Charles Lopez, <tjarls@infm.ulst.ac.uk> (shadow support)
Bill Paul, <wpaul@ctr.columbia.edu> (port to FreeBSD, various small changes)