summaryrefslogtreecommitdiffstats
path: root/usr.sbin/rpc.yppasswdd
diff options
context:
space:
mode:
authoraraujo <araujo@FreeBSD.org>2015-10-02 08:58:50 +0000
committeraraujo <araujo@FreeBSD.org>2015-10-02 08:58:50 +0000
commit26866ae661d7d6070d3a4ea5395576a2be3d17b2 (patch)
treeac78b9d3a94b49de363f2664e36ba3951c85622e /usr.sbin/rpc.yppasswdd
parent2a5d62de17a548f167b4c0ba7ec082eed347b693 (diff)
downloadFreeBSD-src-26866ae661d7d6070d3a4ea5395576a2be3d17b2.zip
FreeBSD-src-26866ae661d7d6070d3a4ea5395576a2be3d17b2.tar.gz
The rpc.yppasswdd has an option to not allow shell changes (-s), but is
always passed a shell by the remote yppasswd. If an NIS client overrides the shell provided by the ypserv, then yppasswd (pam_unix, actually, afaict) will pass this new shell to the yppasswdd. If this shell has been set on the client to a shell which is invalid on the server, a user will never be able to change their password on the client. PR: 67142 Submitted by: russell@rucus.ru.ac.za Approved by: bapt (mentor) Sponsored by: EuroBSDCon Sweden.
Diffstat (limited to 'usr.sbin/rpc.yppasswdd')
-rw-r--r--usr.sbin/rpc.yppasswdd/yppasswdd_server.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/usr.sbin/rpc.yppasswdd/yppasswdd_server.c b/usr.sbin/rpc.yppasswdd/yppasswdd_server.c
index 0260e4c..9eb874b 100644
--- a/usr.sbin/rpc.yppasswdd/yppasswdd_server.c
+++ b/usr.sbin/rpc.yppasswdd/yppasswdd_server.c
@@ -212,12 +212,12 @@ validate(struct passwd *opw, struct x_passwd *npw)
* Don't allow the user to shoot himself in the foot,
* even on purpose.
*/
- if (!ok_shell(npw->pw_shell)) {
+ if (!no_chsh && !ok_shell(npw->pw_shell)) {
yp_error("%s is not a valid shell", npw->pw_shell);
return(1);
}
- if (validchars(npw->pw_shell)) {
+ if (!no_chsh && validchars(npw->pw_shell)) {
yp_error("specified shell contains invalid characters");
return(1);
}
OpenPOWER on IntegriCloud