chpass/chpass.1

   1 .\" Copyright (c) 1988, 1990, 1993
   2 .\"     The Regents of the University of California.  All rights reserved.
   3 .\"
   4 .\" Redistribution and use in source and binary forms, with or without
   5 .\" modification, are permitted provided that the following conditions
   6 .\" are met:
   7 .\" 1. Redistributions of source code must retain the above copyright
   8 .\"    notice, this list of conditions and the following disclaimer.
   9 .\" 2. Redistributions in binary form must reproduce the above copyright
  10 .\"    notice, this list of conditions and the following disclaimer in the
  11 .\"    documentation and/or other materials provided with the distribution.
  12 .\" 3. All advertising materials mentioning features or use of this software
  13 .\"    must display the following acknowledgement:
  14 .\"     This product includes software developed by the University of
  15 .\"     California, Berkeley and its contributors.
  16 .\" 4. Neither the name of the University nor the names of its contributors
  17 .\"    may be used to endorse or promote products derived from this software
  18 .\"    without specific prior written permission.
  19 .\"
  20 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30 .\" SUCH DAMAGE.
  31 .\"
  32 .\"     @(#)chpass.1    8.2 (Berkeley) 12/30/93
  33 .\" $FreeBSD$
  34 .\"
  35 .Dd December 30, 1993
  36 .Dt CHPASS 1
  37 .Os
  38 .Sh NAME
  39 .Nm chpass, chfn, chsh, ypchpass, ypchfn, ypchsh
  40 .Nd add or change user database information
  41 .Sh SYNOPSIS
  42 .Nm chpass
  43 .Op Fl a Ar list
  44 .Op Fl p Ar encpass
  45 .Op Fl s Ar newshell
  46 .Op user
  47 .Sh DESCRIPTION
  48 The
  49 .Nm chpass
  50 program
  51 allows editing of the user database information associated
  52 with
  53 .Ar user
  54 or, by default, the current user.
  55 The information is formatted and supplied to an editor for changes.
  56 .Pp
  57 Only the information that the user is allowed to change is displayed.
  58 .Pp
  59 The options are as follows:
  60 .Bl -tag -width flag
  61 .It Fl a
  62 The super-user is allowed to directly supply a user database
  63 entry, in the format specified by
  64 .Xr passwd 5 ,
  65 as an argument.
  66 This argument must be a colon
  67 .Pq Dq :
  68 separated list of all the
  69 user database fields, although they may be empty.
  70 .It Fl p
  71 The super-user is allowed to directly supply an encrypted password field,
  72 in the format used by
  73 .Xr crypt 3 ,
  74 as an argument.
  75 .It Fl s
  76 The
  77 .Fl s
  78 option attempts to change the user's shell to
  79 .Ar newshell .
  80 .El
  81 .Pp
  82 Possible display items are as follows:
  83 .Pp
  84 .Bl -tag -width "Other Information:" -compact -offset indent
  85 .It Login:
  86 user's login name
  87 .It Password:
  88 user's encrypted password
  89 .It Uid:
  90 user's login
  91 .It Gid:
  92 user's login group
  93 .It Class:
  94 user's general classification
  95 .It Change:
  96 password change time
  97 .It Expire:
  98 account expiration time
  99 .It Full Name:
 100 user's real name
 101 .It Office Location:
 102 user's office location (1)
 103 .It Office Phone:
 104 user's office phone (1)
 105 .It Home Phone:
 106 user's home phone (1)
 107 .It Other Information:
 108 any locally defined parameters for user (1)
 109 .It Home Directory:
 110 user's home directory
 111 .It Shell:
 112 user's login shell
 113 .Pp
 114 .It NOTE(1) -
 115 In the actual master.passwd file, these fields are comma-delimited
 116 fields embedded in the FullName field.
 117 .El
 118 .Pp
 119 The
 120 .Ar login
 121 field is the user name used to access the computer account.
 122 .Pp
 123 The
 124 .Ar password
 125 field contains the encrypted form of the user's password.
 126 .Pp
 127 The
 128 .Ar uid
 129 field is the number associated with the
 130 .Ar login
 131 field.
 132 Both of these fields should be unique across the system (and often
 133 across a group of systems) as they control file access.
 134 .Pp
 135 While it is possible to have multiple entries with identical login names
 136 and/or identical user id's, it is usually a mistake to do so.  Routines
 137 that manipulate these files will often return only one of the multiple
 138 entries, and that one by random selection.
 139 .Pp
 140 The
 141 .Ar group
 142 field is the group that the user will be placed in at login.
 143 Since BSD supports multiple groups (see
 144 .Xr groups 1 )
 145 this field currently has little special meaning.
 146 This field may be filled in with either a number or a group name (see
 147 .Xr group 5 ) .
 148 .Pp
 149 The
 150 .Ar class
 151 field references class descriptions in
 152 .Ar /etc/login.conf
 153 and is typically used to initialize the user's system resource limits
 154 when they login.
 155 .Pp
 156 The
 157 .Ar change
 158 field is the date by which the password must be changed.
 159 .Pp
 160 The
 161 .Ar expire
 162 field is the date on which the account expires.
 163 .Pp
 164 Both the
 165 .Ar change
 166 and
 167 .Ar expire
 168 fields should be entered in the form
 169 .Dq month day year
 170 where
 171 .Ar month
 172 is the month name (the first three characters are sufficient),
 173 .Ar day
 174 is the day of the month, and
 175 .Ar year
 176 is the year.
 177 .Pp
 178 Five fields are available for storing the user's
 179 .Ar full name , office location ,
 180 .Ar work
 181 and
 182 .Ar home telephone
 183 numbers and finally
 184 .Ar other information
 185 which is a single comma delimited string to represent any additional
 186 gcos fields (typically used for site specific user information).
 187 Note that
 188 .Xr finger 1
 189 will display the office location and office phone together under the
 190 heading
 191 .Ar Office: .
 192 .Pp
 193 The user's
 194 .Ar home directory
 195 is the full UNIX path name where the user
 196 will be placed at login.
 197 .Pp
 198 The
 199 .Ar shell
 200 field is the command interpreter the user prefers.
 201 If the
 202 .Ar shell
 203 field is empty, the Bourne shell,
 204 .Pa /bin/sh ,
 205 is assumed.
 206 When altering a login shell, and not the super-user, the user
 207 may not change from a non-standard shell or to a non-standard
 208 shell.
 209 Non-standard is defined as a shell not found in
 210 .Pa /etc/shells .
 211 .Pp
 212 Once the information has been verified,
 213 .Nm chpass
 214 uses
 215 .Xr pwd_mkdb 8
 216 to update the user database.
 217 .Sh ENVIRONMENT
 218 The
 219 .Xr vi 1
 220 editor will be used unless the environment variable EDITOR is set to
 221 an alternate editor.
 222 When the editor terminates, the information is re-read and used to
 223 update the user database itself.
 224 Only the user, or the super-user, may edit the information associated
 225 with the user.
 226 .Sh NIS INTERACTION
 227 .Nm Chpass
 228 can also be used in conjunction with NIS, however some restrictions
 229 apply.
 230 Currently,
 231 .Nm chpass
 232 can only make changes to the NIS passwd maps through
 233 .Xr rpc.yppasswdd 8 ,
 234 which normally only permits changes to a user's password, shell and GECOS
 235 fields. Except when invoked by the super-user on the NIS master server,
 236 .Nm chpass
 237 (and, similarly,
 238 .Xr passwd 1 )
 239 can not use the
 240 .Xr rpc.yppasswdd 8
 241 server to change other user information or
 242 add new records to the NIS passwd maps.
 243 Furthermore,
 244 .Xr rpc.yppasswdd 8
 245 requires password authentication before it will make any
 246 changes. The only user allowed to submit changes without supplying
 247 a password is the super-user on the NIS master server; all other users,
 248 including those with root privileges on NIS clients (and NIS slave
 249 servers) must enter a password.
 250 (The super-user on the NIS master is allowed to bypass these restrictions
 251 largely for convenience: a user with root access
 252 to the NIS master server already has the privileges required to make
 253 updates to the NIS maps, but editing the map source files by hand can
 254 be cumbersome.
 255 .Pp
 256 Note: these exceptions only apply when the NIS master server is a
 257 .Fx
 258 system).
 259 .Pp
 260 Consequently, except where noted, the following restrictions apply when
 261 .Nm chpass
 262 is used with NIS:
 263 .Bl -enum -offset indent
 264 .It
 265 .Em "Only the shell and GECOS information may be changed" .
 266 All other
 267 fields are restricted, even when
 268 .Nm chpass
 269 is invoked by the super-user.
 270 While support for
 271 changing other fields could be added, this would lead to
 272 compatibility problems with other NIS-capable systems.
 273 Even though the super-user may supply data for other fields
 274 while editing an entry, the extra information (other than the
 275 password -- see below) will be silently discarded.
 276 .Pp
 277 Exception: the super-user on the NIS master server is permitted to
 278 change any field.
 279 .Pp
 280 .It
 281 .Em "Password authentication is required" .
 282 .Nm Chpass
 283 will prompt for the user's NIS password before effecting
 284 any changes. If the password is invalid, all changes will be
 285 discarded.
 286 .Pp
 287 Exception: the super-user on the NIS master server is allowed to
 288 submit changes without supplying a password. (The super-user may
 289 choose to turn off this feature using the
 290 .Fl o
 291 flag, described below.)
 292 .It
 293 .Em "Adding new records to the local password database is discouraged" .
 294 .Nm Chpass
 295 will allow the administrator to add new records to the
 296 local password database while NIS is enabled, but this can lead to
 297 some confusion since the new records are appended to the end of
 298 the master password file, usually after the special NIS '+' entries.
 299 The administrator should use
 300 .Xr vipw 8
 301 to modify the local password
 302 file when NIS is running.
 303 .Pp
 304 The super-user on the NIS master server is permitted to add new records
 305 to the NIS password maps, provided the
 306 .Xr rpc.yppasswdd 8
 307 server has been started with the
 308 .Fl a
 309 flag to permitted additions (it refuses them by default).
 310 .Nm Chpass
 311 tries to update the local password database by default; to update the
 312 NIS maps instead, invoke chpass with the
 313 .Fl y
 314 flag.
 315 .It
 316 .Em "Password changes are not permitted".
 317 Users should use
 318 .Xr passwd 1
 319 or
 320 .Xr yppasswd 1
 321 to change their NIS passwords. The super-user is allowed to specify
 322 a new password (even though the
 323 .Dq Password:
 324 field does not show
 325 up in the editor template, the super-user may add it back by hand),
 326 but even the super-user must supply the user's original password
 327 otherwise
 328 .Xr rpc.yppasswdd 8
 329 will refuse to update the NIS maps.
 330 .Pp
 331 Exception: the super-user on the NIS master server is permitted to
 332 change a user's NIS password with
 333 .Nm chpass .
 334 .El
 335 .Pp
 336 There are also a few extra option flags that are available when
 337 .Nm chpass
 338 is compiled with NIS support:
 339 .Bl -tag -width flag
 340 .It Fl l
 341 The
 342 .Fl l
 343 flag forces
 344 .Nm chpass
 345 to modify the local copy of a user's password
 346 information in the even that a user exists in both
 347 the local and NIS databases.
 348 .It Fl y
 349 This flag has the opposite effect of
 350 .Fl l .
 351 This flag is largely redundant since
 352 .Nm chpass
 353 operates on NIS entries by default if NIS is enabled.
 354 .It Fl d Ar domain
 355 Specify a particular NIS domain.
 356 .Nm Chpass
 357 uses the system domain name by default, as set by the
 358 .Xr domainname 1
 359 command. The
 360 .Fl d
 361 option can be used to override a default, or to specify a domain
 362 when the system domain name is not set.
 363 .It Fl h Ar host
 364 Specify the name or address of an NIS server to query. Normally,
 365 .Nm chpass
 366 will communicate with the NIS master host specified in the
 367 .Pa master.passwd
 368 or
 369 .Pa passwd
 370 maps. On hosts that have not been configured as NIS clients, there is
 371 no way for the program to determine this information unless the user
 372 provides the hostname of a server. Note that the specified hostname need
 373 not be that of the NIS master server; the name of any server, master or
 374 slave, in a given NIS domain will do.
 375 .Pp
 376 When using the
 377 .Fl d
 378 option, the hostname defaults to
 379 .Dq localhost .
 380 The
 381 .Fl h
 382 option can be used in conjunction with the
 383 .Fl d
 384 option, in which case the user-specified hostname will override
 385 the default.
 386 .Pp
 387 .It Fl o
 388 Force the use of RPC-based updates when communicating with
 389 .Xr rpc.yppasswdd 8
 390 .Pq Dq old-mode .
 391 When invoked by the super-user on the NIS master server,
 392 .Nm chpass
 393 allows unrestricted changes to the NIS passwd maps using dedicated,
 394 non-RPC-based mechanism (in this case, a UNIX domain socket). The
 395 .Fl o
 396 flag can be used to force
 397 .Nm chpass
 398 to use the standard update mechanism instead. This option is provided
 399 mainly for testing purposes.
 400 .El
 401 .Pp
 402 .Sh FILES
 403 .Bl -tag -width /etc/master.passwd -compact
 404 .It Pa /etc/master.passwd
 405 The user database
 406 .It Pa /etc/passwd
 407 A Version 7 format password file
 408 .It Pa /etc/chpass.XXXXXX
 409 Temporary copy of the password file
 410 .It Pa /etc/shells
 411 The list of approved shells
 412 .El
 413 .Sh SEE ALSO
 414 .Xr finger 1 ,
 415 .Xr login 1 ,
 416 .Xr passwd 1 ,
 417 .Xr getusershell 3 ,
 418 .Xr login.conf 5 ,
 419 .Xr passwd 5 ,
 420 .Xr pwd_mkdb 8 ,
 421 .Xr vipw 8
 422 .Rs
 423 .%A Robert Morris
 424 and
 425 .%A Ken Thompson
 426 .%T "UNIX Password security"
 427 .Re
 428 .Sh NOTES
 429 The
 430 .Xr chfn 1 ,
 431 .Xr chsh 1 ,
 432 .Xr ypchpass 1 ,
 433 .Xr ypchfn 1
 434 and
 435 .Xr ypchsh 1
 436 commands are really only links to
 437 .Nm chpass .
 438 .Sh BUGS
 439 User information should (and eventually will) be stored elsewhere.
 440 .Sh HISTORY
 441 The
 442 .Nm chpass
 443 command appeared in
 444 .Bx 4.3 Reno .