diff options
| author | araujo <araujo@FreeBSD.org> | 2015-10-02 08:58:50 +0000 |
|---|---|---|
| committer | araujo <araujo@FreeBSD.org> | 2015-10-02 08:58:50 +0000 |
| commit | 26866ae661d7d6070d3a4ea5395576a2be3d17b2 (patch) | |
| tree | ac78b9d3a94b49de363f2664e36ba3951c85622e /usr.sbin/rpc.yppasswdd | |
| parent | 2a5d62de17a548f167b4c0ba7ec082eed347b693 (diff) | |
| download | FreeBSD-src-26866ae661d7d6070d3a4ea5395576a2be3d17b2.zip FreeBSD-src-26866ae661d7d6070d3a4ea5395576a2be3d17b2.tar.gz | |
The rpc.yppasswdd has an option to not allow shell changes (-s), but is
always passed a shell by the remote yppasswd. If an NIS client overrides the
shell provided by the ypserv, then yppasswd (pam_unix, actually, afaict)
will pass this new shell to the yppasswdd. If this shell has been set on the
client to a shell which is invalid on the server, a user will never be able
to change their password on the client.
PR: 67142
Submitted by: russell@rucus.ru.ac.za
Approved by: bapt (mentor)
Sponsored by: EuroBSDCon Sweden.
Diffstat (limited to 'usr.sbin/rpc.yppasswdd')
| -rw-r--r-- | usr.sbin/rpc.yppasswdd/yppasswdd_server.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/usr.sbin/rpc.yppasswdd/yppasswdd_server.c b/usr.sbin/rpc.yppasswdd/yppasswdd_server.c index 0260e4c..9eb874b 100644 --- a/usr.sbin/rpc.yppasswdd/yppasswdd_server.c +++ b/usr.sbin/rpc.yppasswdd/yppasswdd_server.c @@ -212,12 +212,12 @@ validate(struct passwd *opw, struct x_passwd *npw) * Don't allow the user to shoot himself in the foot, * even on purpose. */ - if (!ok_shell(npw->pw_shell)) { + if (!no_chsh && !ok_shell(npw->pw_shell)) { yp_error("%s is not a valid shell", npw->pw_shell); return(1); } - if (validchars(npw->pw_shell)) { + if (!no_chsh && validchars(npw->pw_shell)) { yp_error("specified shell contains invalid characters"); return(1); } |
