misc/66893: LINUX NIS clients connecting to FREEBSD NIS servers get authentication failure

[Stavros Grigorakakis]

>Number:         66893
>Category:       misc
>Synopsis:       LINUX NIS clients connecting to FREEBSD NIS servers get authentication failure
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Wed May 19 09:20:18 PDT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Stavros Grigorakakis
>Release:        
>Organization:
DMST AUEB
>Environment:
FreeBSD aegean.dmst.aueb.gr 4.9-PRERELEASE FreeBSD 4.9-PRERELEASE #0
>Description:
     There are some problems connnecting a Linux NIS client to a FreeBSD NIS server
(Linux is RH9 and freeBSD is 4.9 RELEASE but i believe it concerns all versions)

Having both sides setup , users always get an authentication failure on the linux boxes.

Same problem is described in
http://lists.freebsd.org/pipermail/freebsd-net/2003-August/001126.html

There it is suggested that the only problem is a missing NIS map (  named master.passwd in freeBSD)
shadow.byname.

However patching as suggested the /var/yp/Makefile doesnot solve the problem although it sure is necssary to
make the shadow map.

>How-To-Repeat:
      Just try to set out of the box a linux NIS client to authenticate against a Freebsd NIS server
>Fix:
      Linux authentication routine is distrubbed by the presence of asterisk in tha passwd tables and maps
an really foolishly expects an "x"

I have made small modification in line 470 of /var/yp/Makefile
changing from

print $$1":*:"$$3":"$$4":"$$8":"$$9":"$$10}' $^ \
to
 print $$1":x"$$3":"$$4":"$$8":"$$9":"$$10}' $^ \



 FreeBSD NIS clients seem not have spotted the difference.
 However having searched for possible implications i must point out that the asterisk is used in the
 /usr/src/usr.sbin/rpc.yppasswdd/yppasswdd_server.c  (read comments line 348 )  so i suggest changing line 416
  pw->pw_name, *(ptr+1) == '*' ? "*" : pw->pw_passwd,
to
   pw->pw_name, *(ptr+1) == ('*'||'x') ? "x" : pw->pw_passwd,
(I am not so sure what would be the implications if we dont... )

   Results:
    Linux client users can cleanly authenticate now
    I have no indication of any implication in FBSD NIS clients but it sure is necessary for someone to look more thoroughly

    ATTENTION : More work to be done:
    A user on a linux client still cant change his password using yppasswd , so .. they still have to visit a freebsd box and use yppasswd there :-)


Conclusion:
    It would be appreciable if  someone (on either side) made NIS work fine out of the box

>Release-Note:
>Audit-Trail:
>Unformatted: