X-Git-Url: https://git.cameronkatri.com/pw-darwin.git/blobdiff_plain/a562fe5122bbd6f62205ee0789c1da332edd8fe3..5f0c96f2a7b918363d6b3e34a1855ddc64f26a41:/chpass/chpass.1?ds=inline diff --git a/chpass/chpass.1 b/chpass/chpass.1 index 83cddb8..e9059a6 100644 --- a/chpass/chpass.1 +++ b/chpass/chpass.1 @@ -30,6 +30,7 @@ .\" SUCH DAMAGE. .\" .\" @(#)chpass.1 8.2 (Berkeley) 12/30/93 +.\" $Id$ .\" .Dd December 30, 1993 .Dt CHPASS 1 @@ -38,7 +39,7 @@ .Nm chpass, chfn, chsh, ypchpass, ypchfn, ypchsh .Nd add or change user database information .Sh SYNOPSIS -chpass +.Nm chpass .Op Fl a Ar list .Op Fl p Ar encpass .Op Fl s Ar newshell @@ -212,39 +213,64 @@ apply. Currently, .Nm chpass can only make changes to the NIS passwd maps through -.Xr yppasswdd 8 , -which only permits changes to a user's password, shell and gecos -fields. It can not be used to change other user information or to -add new records to the NIS passwd maps. (Doing that would require -something such as ypupdated, which is not yet supported.) +.Xr rpc.yppasswdd 8 , +which normally only permits changes to a user's password, shell and GECOS +fields. Except when invoked by the super-user on the NIS master server, +.Nm chpass +(and, similarly, +.Xr passwd 1 ) +can not use the +.Xr rpc.yppasswdd 8 +server to change other user information or +add new records to the NIS passwd maps. Furthermore, -.Xr yppasswdd 8 +.Xr rpc.yppasswdd 8 requires password authentication before it will make any -changes, even if it receives a request from the super-user. +changes. The only user allowed to submit changes without supplying +a password is the super-user on the NIS master server; all other users, +including those with root privileges on NIS clients (and NIS slave +servers) must enter a password. +(The super-user on the NIS master is allowed to bypass these restrictions +largely for convenience: a user with root access +to the NIS master server already has the privileges required to make +updates to the NIS maps, but editing the map source files by hand can +be cumbersome. +.Pp +Note: these exceptions only apply when the NIS master server is a +FreeBSD system.) .Pp -As a result, the following restrictions apply when +Consequently, except where noted, the following restrictions apply when .Nm chpass is used with NIS: .Bl -enum -offset indent .It -.Pa Only the shell and gecos information may be changed. +.Pa Only the shell and GECOS information may be changed. All other fields are restricted, even when .Nm chpass -is invoked by the super-user, because the -.Xr yppasswdd 8 -daemon has no support for updating them. While support for +is invoked by the super-user. +While support for changing other fields could be added, this would lead to compatibility problems with other NIS-capable systems. Even though the super-user may supply data for other fields while editing an entry, the extra information (other than the password -- see below) will be silently discarded. +.Pp +Exception: the super-user on the NIS master server is permitted to +change any field. +.Pp .It .Pa Password authentication is required. .Nm Chpass will prompt for the user's NIS password before effecting any changes. If the password is invalid, all changes will be discarded. +.Pp +Exception: the super-user on the NIS master server is allowed to +submit changes without supplying a password. (The super-user may +choose to turn off this feature using the +.Fl o +flag, described below.) .It .Pa Adding new records to the local .Pa password database is discouraged. @@ -257,6 +283,18 @@ The administrator should use .Xr vipw 8 to modify the local password file when NIS is running. +.Pp +The super-user on the NIS master server is permitted to add new records +to the NIS password maps, provided the +.Xr rpc.yppasswdd 8 +server has been started with the +.Fl a +flag to permitted additions (it refuses them by default). +.Nm Chpass +tries to update the local password database by default; to update the +NIS maps instead, invoke chpass with the +.Fl y +flag. .It .Pa Password changes are not permitted. Users should use @@ -268,11 +306,15 @@ a new password (even though the ``Password:'' field does not show up in the editor template, the super-user may add it back by hand), but even the super-user must supply the user's original password otherwise -.Xr yppasswdd 8 +.Xr rpc.yppasswdd 8 will refuse to update the NIS maps. +.Pp +Exception: the super-user on the NIS master server is permitted to +change a user's NIS password with +.Nm chpass . .El .Pp -There are also two extra option flags that are available when +There are also a few extra option flags that are available when .Nm chpass is compiled with NIS support: .Bl -tag -width flag @@ -290,6 +332,50 @@ This flag has the opposite effect of This flag is largely redundant since .Nm chpass operates on NIS entries by default if NIS is enabled. +.It Fl d Ar domain +Specify a particular NIS domain. +.Nm Chpass +uses the system domain name by default, as set by the +.Xr domainname 1 +command. The +.Fl d +option can be used to override a default, or to specify a domain +when the system domain name is not set. +.It Fl h Ar host +Specify the name or address of an NIS server to query. Normally, +.Nm chpass +will communicate with the NIS master host specified in the +.Pa master.passwd +or +.Pa passwd +maps. On hosts that have not been configured as NIS clients, there is +no way for the program to determine this information unless the user +provides the hostname of a server. Note that the specified hostname need +not be that of the NIS master server; the name of any server, master or +slave, in a given NIS domain will do. +.Pp +When using the +.Fl d +option, the hostname defaults to ``localhost.'' The +.Fl h +option can be used in conjunction with the +.Fl d +option, in which case the user-specified hostname will override +the default. +.Pp +.It Fl o +Force the use of RPC-based updates when communicating with +.Xr rpc.yppasswdd 8 +(``old-mode''). +When invoked by the super-user on the NIS master server, +.Nm chpass +allows unrestricted changes to the NIS passwd maps using dedicated, +non-RPC-based mechanism (in this case, a UNIX domain socket). The +.Fl o +flag can be used to force +.Nm chpass +to use the standard update mechanism instead. This option is provided +mainly for testing purposes. .El .Pp .Sh FILES @@ -304,8 +390,8 @@ Temporary copy of the password file The list of approved shells .El .Sh SEE ALSO -.Xr login 1 , .Xr finger 1 , +.Xr login 1 , .Xr passwd 1 , .Xr getusershell 3 , .Xr passwd 5 ,