Manual Pages  — RPC.YPPASSWDD

The rpc.yppasswdd utility allows users to change their NIS passwords and certain other information using the yppasswd(1) and ypchpass(1) commands. The rpc.yppasswdd utility is an RPC-based server that accepts incoming password change requests, authenticates them, places the updated information in the /var/yp/master.passwd template file and then updates the NIS master.passwd and passwd maps.

The rpc.yppasswdd utility allows a normal NIS user to change his or her NIS password, full name (also known as 'GECOS' field) or shell. These updates are typically done using the yppasswd(1), ypchfn(1), ypchsh(1), or ypchpass(1) commands. (Some administrators do not want users to be able to change their full name information or shells; the server can be invoked with option flags that disallow such changes.) When the server receives an update request, it compares the address of the client making the request against the securenets rules outlined in /var/yp/securenets. (See the ypserv(8) manual page for more information on securenets; the rpc.yppasswdd utility uses the same access control mechanism as ypserv(8).)

The server then checks the 'old' password supplied by the user to make sure it is valid, then performs some sanity checks on the updated information (these include checking for embedded control characters, colons or invalid shells). Once it is satisfied that the update request is valid, the server modifies the template password file (the default is /var/yp/master.passwd) and then runs the /usr/libexec/yppwupdate script to rebuild the NIS maps. (This script has two arguments passed to it: the absolute pathname of the password template that was modified and the name of the domain that is to be updated. These in turn are passed to /var/yp/Makefile).

The FreeBSD version of rpc.yppasswdd also allows the super-user on the NIS master server to perform more sophisticated updates on the NIS passwd maps. The super-user can modify any field in any user's master.passwd entry in any domain, and can do so without knowing the user's existing NIS password (when the server receives a request from the super-user, the password authentication check is bypassed). Furthermore, if the server is invoked with the -a flag, the super-user can even add new entries to the maps using ypchpass(1). Again, this only applies to the super-user on the NIS master server: none of these special functions can be performed over the network.

The rpc.yppasswdd utility can only be run on a machine that is an NIS master server.

yp(8), yppush(8), ypserv(8), ypxfr(8)

As listed in the yppasswd.x protocol definition, the YPPASSWDPROC_UPDATE procedure takes two arguments: a V7-style passwd structure containing updated user information and the user's existing unencrypted (cleartext) password. Since rpc.yppasswdd is supposed to handle update requests from remote NIS client machines, this means that yppasswd(1) and similar client programs will in fact be transmitting users' cleartext passwords over the network.

This is not a problem for password updates since the plaintext password sent with the update will no longer be valid once the new encrypted password is put into place, but if the user is only updating his or her 'GECOS' information or shell, then the cleartext password sent with the update will still be valid once the update is completed. If the network is insecure, this cleartext password could be intercepted and used to gain unauthorized access to the user's account.