Date: Fri, 2 Oct 2015 08:58:51 +0000 (UTC) From: Marcelo Araujo <araujo@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r288482 - head/usr.sbin/rpc.yppasswdd Message-ID: <201510020858.t928wpt6091771@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: araujo Date: Fri Oct 2 08:58:50 2015 New Revision: 288482 URL: https://svnweb.freebsd.org/changeset/base/288482 Log: The rpc.yppasswdd has an option to not allow shell changes (-s), but is always passed a shell by the remote yppasswd. If an NIS client overrides the shell provided by the ypserv, then yppasswd (pam_unix, actually, afaict) will pass this new shell to the yppasswdd. If this shell has been set on the client to a shell which is invalid on the server, a user will never be able to change their password on the client. PR: 67142 Submitted by: russell@rucus.ru.ac.za Approved by: bapt (mentor) Sponsored by: EuroBSDCon Sweden. Modified: head/usr.sbin/rpc.yppasswdd/yppasswdd_server.c Modified: head/usr.sbin/rpc.yppasswdd/yppasswdd_server.c ============================================================================== --- head/usr.sbin/rpc.yppasswdd/yppasswdd_server.c Fri Oct 2 08:33:06 2015 (r288481) +++ head/usr.sbin/rpc.yppasswdd/yppasswdd_server.c Fri Oct 2 08:58:50 2015 (r288482) @@ -212,12 +212,12 @@ validate(struct passwd *opw, struct x_pa * Don't allow the user to shoot himself in the foot, * even on purpose. */ - if (!ok_shell(npw->pw_shell)) { + if (!no_chsh && !ok_shell(npw->pw_shell)) { yp_error("%s is not a valid shell", npw->pw_shell); return(1); } - if (validchars(npw->pw_shell)) { + if (!no_chsh && validchars(npw->pw_shell)) { yp_error("specified shell contains invalid characters"); return(1); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201510020858.t928wpt6091771>