Date: Wed, 19 May 2004 09:15:43 -0700 (PDT) From: Stavros Grigorakakis <sgrig@aegean.dmst.aueb.gr> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/66893: LINUX NIS clients connecting to FREEBSD NIS servers get authentication failure Message-ID: <200405191615.i4JGFhWV071852@www.freebsd.org> Resent-Message-ID: <200405191620.i4JGKJNQ053717@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 66893
>Category: misc
>Synopsis: LINUX NIS clients connecting to FREEBSD NIS servers get authentication failure
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: change-request
>Submitter-Id: current-users
>Arrival-Date: Wed May 19 09:20:18 PDT 2004
>Closed-Date:
>Last-Modified:
>Originator: Stavros Grigorakakis
>Release:
>Organization:
DMST AUEB
>Environment:
FreeBSD aegean.dmst.aueb.gr 4.9-PRERELEASE FreeBSD 4.9-PRERELEASE #0
>Description:
There are some problems connnecting a Linux NIS client to a FreeBSD NIS server
(Linux is RH9 and freeBSD is 4.9 RELEASE but i believe it concerns all versions)
Having both sides setup , users always get an authentication failure on the linux boxes.
Same problem is described in
http://lists.freebsd.org/pipermail/freebsd-net/2003-August/001126.html
There it is suggested that the only problem is a missing NIS map ( named master.passwd in freeBSD)
shadow.byname.
However patching as suggested the /var/yp/Makefile doesnot solve the problem although it sure is necssary to
make the shadow map.
>How-To-Repeat:
Just try to set out of the box a linux NIS client to authenticate against a Freebsd NIS server
>Fix:
Linux authentication routine is distrubbed by the presence of asterisk in tha passwd tables and maps
an really foolishly expects an "x"
I have made small modification in line 470 of /var/yp/Makefile
changing from
print $$1":*:"$$3":"$$4":"$$8":"$$9":"$$10}' $^ \
to
print $$1":x"$$3":"$$4":"$$8":"$$9":"$$10}' $^ \
FreeBSD NIS clients seem not have spotted the difference.
However having searched for possible implications i must point out that the asterisk is used in the
/usr/src/usr.sbin/rpc.yppasswdd/yppasswdd_server.c (read comments line 348 ) so i suggest changing line 416
pw->pw_name, *(ptr+1) == '*' ? "*" : pw->pw_passwd,
to
pw->pw_name, *(ptr+1) == ('*'||'x') ? "x" : pw->pw_passwd,
(I am not so sure what would be the implications if we dont... )
Results:
Linux client users can cleanly authenticate now
I have no indication of any implication in FBSD NIS clients but it sure is necessary for someone to look more thoroughly
ATTENTION : More work to be done:
A user on a linux client still cant change his password using yppasswd , so .. they still have to visit a freebsd box and use yppasswd there :-)
Conclusion:
It would be appreciable if someone (on either side) made NIS work fine out of the box
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200405191615.i4JGFhWV071852>