are currently implemented:
YPOLDPROC_NULL
YPOLDPROC_DOMAIN
YPOLDPROC_DOMAIN_NONACK
YPOLDPROC_FIRST
YPOLDPROC_NEXT
YPOLDPROC_MATCH
YPOLDPROC_POLL
These are all implemented as wrappers around their v2 counterparts.
The YPOLDPROC_PUSH, PULL and GET procedures are not implemented since
a) I couldn't figure out exactly what to have them do, and b) I
suspect they're used for doing map transfers between master and
slave servers, which we already do using the v2 protocol anyway.
This means we can server NIS v1 clients but can't be a master or
slave with NIS v1-only servers. I think I'll get over it. :)
The -k (sunos_4_kludge) flag and associated code has been removed
since it is no longer needed.
Also tweaked yp_access() to handle both sets of procedures and
updated the man page.
also controlled by /var/yp/securenets).
Add -u flag to turn off the privileged port check done by yp_access();
some commercial systems (IRIX, Solaris 2.x, HP-UX, and probably others)
don't use a reserved port for submitting yppasswd updates. If we always
enforce the check, these client systems will be unable to submit updates
to us.
Document securenets support and -u flag in man page.
Like ypserv, you can compile rpc.yppasswdd to use the tcpwrapper package
instead of securenets if you want to.
in the same was as the SunOS ypserv (same format, described in ypserv man
page). If the user wants tcpwrapper style access control, they can
recompile ypserv to use that instead. This way we get securenets without
having to ship libwrap.a and tcpd.h with core FreeBSD distribution.
If /var/yp/securenets doesn't exist, ypserv allows all connections.
files missing, so these shouldn't hurt. If somebody wanted to use sendmail
8.7 on their machine, they should use a clean dist anyway, not this one.
Submitted by: wollman
stub lockd.
This implements just the protocol, but does not interact with the kernel.
It says "Yes!" to all requests. This is useful if you have people using
tools that do locking for no reason (eg: some PC NFS systems running some
Microsoft products) and will happily report they couldn't lock the file
and merrily proceed anyway. Running this will not change the reliability of
sharing files, it'll just keep it out of everybody's face.
chpass(1) are on the way too.) This version supports all the features
of the old one and adds several new ones:
- Supports real multi-domain operation (optional, can be turned
on with a command-line flag). This means you can actually have
several different domains all served from one NIS server and
allow users in any of the supported domains to change their passwords.
The old yppasswdd only allowed changing passwords in the domain
that was set as the system default domain name on the NIS master
server. The new one can change passwords in any domain by trying
to match the user information passed to it against all the passwd
maps it can find. This is something of a hack, but the yppasswd.x
protocol definiton does not allow for a domain to be passwd as an
argument to rpc.yppasswdd, so the server has no choice but to
grope around for a likely match. Since this method can fail if
the same user exists in two domains, this feature is off by default.
If the feature is turned on and the server becomes confused by
duplicate entries, it will abort the update.
- Does not require NIS client services to be available. NIS servers do
_NOT_ necessarily have to be configured as NIS clients in order to
function: the ypserv, ypxfr and yppush programs I've written recently
will operate fine even if the system domain name isn't set, ypbind isn't
running and there are no magic '+' entries in any of the /etc files.
Now rpc.yppasswdd is the same way. The old yppasswdd would not work
like this because it depended on getpwent(3) and friends to look up
users: this will obviously only work if the system where yppasswdd is
running is configured as an NIS client. The new rpc.yppasswdd doesn't
use getpwent(3) at all: instead it searches through the master.passwd
map databases directly. This also makes it easier for it to handle
multiple domains.
- Allows the superuser on the NIS master server to change any user's
password without requiring password authentication. rpc.yppasswdd
creates a UNIX domain socket (/var/run/ypsock) which it monitors
using the same svc_run() loop used to handle incoming RPC requests.
It also clears all the permission bits for /var/run/ypsock; since
this socket is owned by root, this prevents anyone except root from
successfully connect()ing to it. (Using a UNIX domain socket also
prevents IP spoofing attacks.) By building code into passwd(1) and
chpass(1) to take advantage of this 'trusted' channel, the superuser
can use them to send private requests to rpc.yppasswdd.
- Allows the superuser on the NIS master to use chpass(1) to update _all_
of a user's master.passwd information. The UNIX domain access point
accepts a full master.passwd style structure (along with a domain
name and other information), which allows the superuser to update all
of a user's master.passwd information in the NIS master.passwd maps.
Normal users on NIS clients are still only allowed to change their full
name and shell information with chpass.
- Allows the superuser on the NIS master to _add_ records to the NIS
master.passwd maps using chpass(1). This feature is also switchable
with a command-line flag and is off by default.
went to the multi-directory package scheme since it wasn't designed with
that kind of layout in mind when first written, and the attempts to adapt
it haven't really resulted in an interface that's easy to use. I will make
a stand-alone version of the pkg installer in sysinstall at some point
and drop it into the existing pkg_install directory.
fix return/exit codes in some cases.
Add -S which will delete any old entry first.
Add "auto" in proxy case, so it finds the right interface automatically.
Formerly, there were limits on both the number of files (hard-coded into
the program) and the number of characters (because of the ARG_MAX limit
in exec(2)). In this new version, the filenames are passed to tar through
a pipe, using tar's "-T" option, rather than on the command line.
