svn commit: r194968 - in head: share/man/man8 usr.bin/ypcat
usr.bin/ypmatch usr.bin/ypwhich usr.sbin/ypserv
Brian Somers
brian at FreeBSD.org
Thu Jun 25 16:15:40 UTC 2009
Author: brian
Date: Thu Jun 25 16:15:39 2009
New Revision: 194968
URL: http://svn.freebsd.org/changeset/base/194968
Log:
Support shadow.byname and shadow.byuid maps, protecting them by
insisting on privileged port access.
Include /var/yp/Makefile.local if it exists and suggest using
it to override /var/yp/Makefile behaviour.
Approved by: re (kib)
MFC after: 3 weeks
Modified:
head/share/man/man8/yp.8
head/usr.bin/ypcat/ypcat.c
head/usr.bin/ypmatch/ypmatch.c
head/usr.bin/ypwhich/ypwhich.c
head/usr.sbin/ypserv/Makefile.yp
head/usr.sbin/ypserv/yp_access.c
head/usr.sbin/ypserv/ypserv.8
Modified: head/share/man/man8/yp.8
==============================================================================
--- head/share/man/man8/yp.8 Thu Jun 25 16:10:04 2009 (r194967)
+++ head/share/man/man8/yp.8 Thu Jun 25 16:15:39 2009 (r194968)
@@ -28,7 +28,7 @@
.\" from: @(#)yp.8 1.0 (deraadt) 4/26/93
.\" $FreeBSD$
.\"
-.Dd April 5, 1993
+.Dd June 25, 2009
.Dt YP 8
.Os
.Sh NAME
@@ -310,9 +310,15 @@ The
.Tn NIS
.Pa Makefile
.Pq Pa /var/yp/Makefile
-will do this automatically if the administrator comments out the
-line which says
-.Dq Li NOPUSH=true
+will do this automatically if the administrator creates
+.Pa /var/yp/Makefile.local
+and empties the
+.Va NOPUSH
+variable:
+.Bd -literal -offset four
+.Li NOPUSH=
+.Ed
+.Pp
.Va ( NOPUSH
is set to true by default because the default configuration is
for a small network with only one
@@ -394,9 +400,11 @@ To help prevent this,
.Fx Ns 's
.Tn NIS
server handles the shadow password maps
-.Pa ( master.passwd.byname
+.Pa ( master.passwd.byname ,
+.Pa master.passwd.byuid ,
+.Pa shadow.byname
and
-.Pa master.passwd.byuid )
+.Pa shadow.byuid )
in a special way: the server will only provide access to these
maps in response to requests that originate on privileged ports.
Since only the super-user is allowed to bind to a privileged port,
Modified: head/usr.bin/ypcat/ypcat.c
==============================================================================
--- head/usr.bin/ypcat/ypcat.c Thu Jun 25 16:10:04 2009 (r194967)
+++ head/usr.bin/ypcat/ypcat.c Thu Jun 25 16:15:39 2009 (r194968)
@@ -52,6 +52,7 @@ struct ypalias {
} ypaliases[] = {
{ "passwd", "passwd.byname" },
{ "master.passwd", "master.passwd.byname" },
+ { "shadow", "shadow.byname" },
{ "group", "group.byname" },
{ "networks", "networks.byaddr" },
{ "hosts", "hosts.byaddr" },
Modified: head/usr.bin/ypmatch/ypmatch.c
==============================================================================
--- head/usr.bin/ypmatch/ypmatch.c Thu Jun 25 16:10:04 2009 (r194967)
+++ head/usr.bin/ypmatch/ypmatch.c Thu Jun 25 16:15:39 2009 (r194968)
@@ -52,6 +52,7 @@ struct ypalias {
} ypaliases[] = {
{ "passwd", "passwd.byname" },
{ "master.passwd", "master.passwd.byname" },
+ { "shadow", "shadow.byname" },
{ "group", "group.byname" },
{ "networks", "networks.byaddr" },
{ "hosts", "hosts.byname" },
Modified: head/usr.bin/ypwhich/ypwhich.c
==============================================================================
--- head/usr.bin/ypwhich/ypwhich.c Thu Jun 25 16:10:04 2009 (r194967)
+++ head/usr.bin/ypwhich/ypwhich.c Thu Jun 25 16:15:39 2009 (r194968)
@@ -64,6 +64,7 @@ struct ypalias {
} ypaliases[] = {
{ "passwd", "passwd.byname" },
{ "master.passwd", "master.passwd.byname" },
+ { "shadow", "shadow.byname" },
{ "group", "group.byname" },
{ "networks", "networks.byaddr" },
{ "hosts", "hosts.byaddr" },
Modified: head/usr.sbin/ypserv/Makefile.yp
==============================================================================
--- head/usr.sbin/ypserv/Makefile.yp Thu Jun 25 16:10:04 2009 (r194967)
+++ head/usr.sbin/ypserv/Makefile.yp Thu Jun 25 16:15:39 2009 (r194968)
@@ -11,33 +11,40 @@
# This Makefile can be modified to support more NIS maps if desired.
#
-# If this machine is an NIS master, comment out this next line so
-# that changes to the NIS maps can be propagated to the slave servers.
-# (By default we assume that we are only serving a small domain with
-# only one server.)
+# If this machine is an NIS master, reset this variable (NOPUSH=)
+# in Makefile.local so that changes to the NIS maps can be propagated to
+# the slave servers. (By default we assume that we are only serving a
+# small domain with only one server.)
#
NOPUSH = "True"
+# If this machine does not wish to generate a linux-style shadow map
+# from the master.passwd file, reset this variable (SHADOW=) in
+# Makefile.local.
+SHADOW = "True"
+
# If you want to use a FreeBSD NIS server to serve non-FreeBSD clients
# (i.e. clients who expect the password field in the passwd maps to be
-# valid) then uncomment this line. This will cause $YPDIR/passwd to
-# be generated with valid password fields. This is insecure: FreeBSD
-# normally only serves the master.passwd maps (which have real encrypted
-# passwords in them) to the superuser on other FreeBSD machines, but
-# non-FreeBSD clients (e.g. SunOS, Solaris (without NIS+), IRIX, HP-UX,
-# etc...) will only work properly in 'unsecure' mode.
+# valid) then set this variable (UNSECURE="True") in Makefile.local.
+# This will cause $YPDIR/passwd to be generated with valid password
+# fields. This is insecure: FreeBSD normally only serves the
+# master.passwd and shadow maps (which have real encrypted passwords
+# in them) to the superuser on other FreeBSD machines, but non-FreeBSD
+# clients (e.g. SunOS, Solaris (without NIS+), IRIX, HP-UX, etc...)
+# will only work properly in 'unsecure' mode.
#
#UNSECURE = "True"
# The following line encodes the YP_INTERDOMAIN key into the hosts.byname
# and hosts.byaddr maps so that ypserv(8) will do DNS lookups to resolve
-# hosts not in the current domain. Commenting this line out will disable
-# the DNS lookups.
+# hosts not in the current domain. Resetting this variable in
+# Makefile.local (B=) will disable the DNS lookups.
B=-b
-# Normally, the master.passwd.* maps are guarded against access from
-# non-privileged users. By commenting out the following line, the YP_SECURE
-# key will be removed from these maps, allowing anyone to access them.
+# Normally, the master.passwd.* and shadow.* maps are guarded against access
+# from non-privileged users. By resetting S in Makefile.local (S=), the
+# YP_SECURE key will be removed from these maps, allowing anyone to access
+# them.
S=-s
# These are commands which this Makefile needs to properly rebuild the
@@ -118,6 +125,17 @@ PUBLICKEY = $(YPSRCDIR)/publickey
NETID = $(YPSRCDIR)/netid
AMDHOST = $(YPSRCDIR)/amd.map
+target:
+ @if [ ! -d $(DOMAIN) ]; then mkdir $(DOMAIN); fi; \
+ cd $(DOMAIN) ; echo "NIS Map update started on `date` for domain $(DOMAIN)" ; \
+ make -f ../Makefile all; echo "NIS Map update completed."
+
+# Read overrides. Note, the current directory will be /var/yp/<domain>
+# when 'all' is built.
+.if exists(${YPDIR}/Makefile.local)
+.include "${YPDIR}/Makefile.local"
+.endif
+
# List of maps that are always built.
# If you want to omit some of them, feel free to comment
# them out from this list.
@@ -148,6 +166,9 @@ NETGROUP= /dev/null
.if exists($(MASTER))
TARGETS+= passwd master.passwd netid
+.if ${SHADOW} == "\"True\""
+TARGETS+= shadow
+.endif
.else
MASTER= /dev/null
TARGETS+= nopass
@@ -171,11 +192,6 @@ TARGETS+= ipnodes
IPNODES= /dev/null
.endif
-target:
- @if [ ! -d $(DOMAIN) ]; then mkdir $(DOMAIN); fi; \
- cd $(DOMAIN) ; echo "NIS Map update started on `date` for domain $(DOMAIN)" ; \
- make -f ../Makefile all; echo "NIS Map update completed."
-
all: $(TARGETS)
ethers: ethers.byname ethers.byaddr
@@ -187,6 +203,7 @@ protocols: protocols.bynumber protocols.
rpc: rpc.byname rpc.bynumber
services: services.byname
passwd: passwd.byname passwd.byuid
+shadow: shadow.byname shadow.byuid
group: group.byname group.bygid
netgrp: netgroup
netid: netid.byname
@@ -207,6 +224,10 @@ pushpw:
@$(DBLOAD) -c
@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) master.passwd.byname ; fi
@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) master.passwd.byuid ; fi
+.if ${SHADOW} == "\"True\""
+ @if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) shadow.byname ; fi
+ @if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) shadow.byuid ; fi
+.endif
@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) passwd.byname ; fi
@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) passwd.byuid ; fi
@@ -586,6 +607,36 @@ master.passwd.byuid: $(MASTER)
.endif
+shadow.byname: $(MASTER)
+ @echo "Updating $@..."
+.if ${MASTER} == "/dev/null"
+ @echo "Master.passwd source file not found -- skipping"
+.else
+ @$(AWK) -F: '{ if ($$1 != "" && $$1 !~ "^#.*" && $$1 != "+") \
+ print $$1"\t"$$1":"$$2":12000:0:99999:7:::" }' $(MASTER) \
+ | sed 's/\( [^:]*:\)\*:/\1!:/' \
+ | $(DBLOAD) ${S} -f -i $(PASSWD) -o $(YPMAPDIR)/$@ - $(TMP); \
+ $(RMV) $(TMP) $@
+ @$(DBLOAD) -c
+ @if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) $@; fi
+ @if [ ! $(NOPUSH) ]; then echo "Pushed $@ map." ; fi
+.endif
+
+shadow.byuid: $(MASTER)
+ @echo "Updating $@..."
+.if ${MASTER} == "/dev/null"
+ @echo "Master.passwd source file not found -- skipping"
+.else
+ @$(AWK) -F: '{ if ($$1 != "" && $$1 !~ "^#.*" && $$1 != "+") \
+ print $$3"\t"$$1":"$$2":12000:0:99999:7:::" }' $(MASTER) \
+ | sed 's/\( [^:]*:\)\*:/\1!:/' \
+ | $(DBLOAD) ${S} -f -i $(PASSWD) -o $(YPMAPDIR)/$@ - $(TMP); \
+ $(RMV) $(TMP) $@
+ @$(DBLOAD) -c
+ @if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) $@; fi
+ @if [ ! $(NOPUSH) ]; then echo "Pushed $@ map." ; fi
+.endif
+
amd.map: $(AMDHOST)
@echo "Updating $@..."
@$(AWK) '$$1 !~ "^#.*" { \
@@ -604,4 +655,3 @@ amd.map: $(AMDHOST)
@$(DBLOAD) -c
@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) $@; fi
@if [ ! $(NOPUSH) ]; then echo "Pushed $@ map." ; fi
-
Modified: head/usr.sbin/ypserv/yp_access.c
==============================================================================
--- head/usr.sbin/ypserv/yp_access.c Thu Jun 25 16:10:04 2009 (r194967)
+++ head/usr.sbin/ypserv/yp_access.c Thu Jun 25 16:15:39 2009 (r194968)
@@ -178,9 +178,9 @@ load_securenets(void)
* yp_access() checks the mapname and client host address and watches for
* the following things:
*
- * - If the client is referencing one of the master.passwd.* maps, it must
- * be using a privileged port to make its RPC to us. If it is, then we can
- * assume that the caller is root and allow the RPC to succeed. If it
+ * - If the client is referencing one of the master.passwd.* or shadow.* maps,
+ * it must be using a privileged port to make its RPC to us. If it is, then
+ * we can assume that the caller is root and allow the RPC to succeed. If it
* isn't access is denied.
*
* - The client's IP address is checked against the securenets rules.
@@ -254,7 +254,7 @@ possible spoof attempt from %s:%d",
#ifdef DB_CACHE
if ((yp_testflag((char *)map, (char *)domain, YP_SECURE) ||
#else
- if ((strstr(map, "master.passwd.") ||
+ if ((strstr(map, "master.passwd.") || strstr(map, "shadow.") ||
#endif
(rqstp->rq_prog == YPPROG &&
rqstp->rq_proc == YPPROC_XFR) ||
Modified: head/usr.sbin/ypserv/ypserv.8
==============================================================================
--- head/usr.sbin/ypserv/ypserv.8 Thu Jun 25 16:10:04 2009 (r194967)
+++ head/usr.sbin/ypserv/ypserv.8 Thu Jun 25 16:15:39 2009 (r194968)
@@ -30,7 +30,7 @@
.\"
.\" $FreeBSD$
.\"
-.Dd February 3, 2008
+.Dd June 25, 2009
.Dt YPSERV 8
.Os
.Sh NAME
@@ -142,7 +142,11 @@ and
.Pa master.passwd.byuid
maps in a special way.
When the server receives a request to access
-either of these two maps, it will check the TCP port from which the
+either of these two maps (or in fact either of the
+.Pa shadow.byname
+or
+.Pa shadow.byuid
+maps), it will check the TCP port from which the
request originated and return an error if the port number is greater
than 1023.
Since only the superuser is allowed to bind to TCP ports
More information about the svn-src-head
mailing list