Shadow Passwords¶

Using Shadow passwords alongside NIS does not make too much sense, because the supposedly inaccesible passwords now become readable through a simple invocation of ypcat(1).

Shadow support in rpc.yppasswdd does not mean that it offers a very clever solution to this problem, it simply means that it can read and write password entries in the system's shadow file. You have to produce a shadow.byname NIS map to distribute password information to your NIS clients. rpc.yppasswdd will search at first in the /etc/passwd file for the user and password. If it find's the user, but the password is "x" and a /etc/shadow file exists, it will update the password in the shadow map.

Use of the -x option¶

The program should expect to read a single line from stdin, which is formatted as follows:

<username> o:<oldpass> p:<password> s:<shell> g:<gcos>\n

where any of the three fields [p, s, g] may or may not be present.

This program should write "OK\n" to stdout if the operation succeeded. On any other result, rpc.yppasswdd will report failure to the client.

Note that the program specified by the -x option is responsible for doing any NIS make and build, and for doing any necessary validation on the shell and gcos field information supplied. The password passed to the client will be in UNIX crypt() format.

Logging¶

rpc.yppasswdd logs all password update requests to syslogd(8)'s auth facility. The logging information includes the originating host's IP address and the user name and UID contained in the request. The user-supplied password itself is not logged.

Security¶

rpc.yppasswdd should be as secure or insecure as any program relying on simple password authentication. If you feel that this is not enough, you may want to protect rpc.yppasswdd from outside access by using the `securenets' feature of the new portmap(8) version 3. Better still, look at rpasswdd(8).