From owner-freebsd-hackers Tue Mar 21 12:00:24 1995 Return-Path: hackers-owner Received: (from majordom@localhost) by freefall.cdrom.com (8.6.10/8.6.6) id MAA01414 for hackers-outgoing; Tue, 21 Mar 1995 12:00:24 -0800 Received: from skynet.ctr.columbia.edu (skynet.ctr.columbia.edu [128.59.64.70]) by freefall.cdrom.com (8.6.10/8.6.6) with ESMTP id MAA01408 for ; Tue, 21 Mar 1995 12:00:20 -0800 Received: (from wpaul@localhost) by skynet.ctr.columbia.edu (8.6.8/8.6.6) id OAA03653 for freebsd-hackers@freebsd.org; Tue, 21 Mar 1995 14:57:44 -0500 From: Wankle Rotary Engine Message-Id: <199503211957.OAA03653@skynet.ctr.columbia.edu> Subject: How should I do this? To: freebsd-hackers@FreeBSD.org Date: Tue, 21 Mar 1995 14:57:40 -0500 (EST) X-Mailer: ELM [version 2.4 PL23] Content-Type: text Content-Length: 3559 Sender: hackers-owner@FreeBSD.org Precedence: bulk I've finally started to add support for special +@netgroup/-@netgroup substitution in the password database and I've found myself in a quandry. For those who may not know, systems with NIS capability (well, the ones I'm familiar with at least -- SunOS, Solaris, IRIX, HPUX, and even Sony NEWS-OS) allow you to have special entries in your passwd file that look like this: +@rejected-users::32767:32767:Rejected!:/tmp:/usr/local/etc/go-away +@allowed-users:::::: -@silently-rejected-users:*:32767:32767:Rejected!:/tmp:/bin/false People in the 'allowed-users' netgroup will be permitted to log in normally. People in the 'rejected-users' netgroup will be let in, but their UID and GID will be remapped to 32767 and their shell will be remapped to /usr/local/etc/go-away, which is a nastygram program or script that tells them they aren't allowed on this system. Once the program/shell terminates, they get tossed out on their ears. The 'silently-rejected-users' will be denied access outright. (The dummy fields shouldn't be needed for minus entries, but it doesn't hurt to be paranoid.) This permits administrators (like me :) to set up access control for groups of NIS client machines. My plan is to have the getpwent functions cache these special entries so that they can be prepared to match usernames against them quickly. The problem is generating the caches. I've thought of two ways to do it: 1) Do everything in getpwent.c: use the _PW_KEYBYNUM access method to scan through each line in the password database and weed out the special entries. Cons: - The advantage of having a hashed password database goes flying out the window. Pros: - Don't have to change anything except libc. - Since this feature would only be used when YP was turned on, and since when YP is turned on the local password database tends to be fairly small, the speed hit involved should be minimal. 2) Change pwd_mkdb to store special key/data pairs in the password databases if it finds special +@netgroup/-@netgroup entries in the raw master.passwd file. The getpwent routines can then extract the special entries directly. Some extra tags, _PW_PLUSBYNUM and _PW_MINUSBYNUM, would be needed. A _PW_HAVEPLUS and _PW_HAVEMINUS would be nice too, though I think I can get by without them. Cons: - Need to change more things: libc (getpwent.c), pwd.h and pwd_mkdb. Pros: - Overall, it should be much faster than a sequential search (and, as with the other method, the search is only done at all if YP is enabled). - Somehow it seems more elegant than the other solution. :) On the one hand, I'd kind of like to restrict the changes to libc, since that's where this stuff is supposed to go. On the other hand, it would be a little silly not to use the database system. I'm leaning towards solution #2 at the moment, but I want to find out if other people think this is a good idea. Basically, I can't decide, so I'm hoping for some strongly-voiced opinioms to sway me. :) -Bill -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~T~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -Bill Paul (212) 854-6020 | System Manager Work: wpaul@ctr.columbia.edu | Center for Telecommunications Research Home: wpaul@skynet.ctr.columbia.edu | Columbia University, New York City ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The Møøse Illuminati: ignore it and be confused, or join it and be confusing! ~~~~~~~~ FreeBSD 2.1.0-Development #0: Tue Mar 14 11:11:25 EST 1995 ~~~~~~~~~