Subject: Re: Two sysadmin questions

From: [email-masked] (Willi Burmeister)
Date: 30 Sep 1993 06:54:52 GMT

In <[email-masked]> [email-masked] (Chris Horne) writes:

>We are in the process of moving our network to Solaris 2 running NIS+. 
>At the moment we have two unresolved questions (although I am sure that
>many will follow). Both relate to passwords.

>1) When we set up a new user using the User Account Manager, we would like to
>   specify the "Password: Cleared until first login" option. However, when we do this
>   the "test" user gets the following response on login

>	You don't have a password.  Choose one.
>	passwd test
>	/usr/bin/passwd:  test does not exist
>	Connection closed.

Here the script we got from sun:

--------------------------------------------------------------------------------
#!/bin/sh
#       Hack passwd command rapper for other name services.
#
#       @(#)passwd.sh   1.3 03 Aug 1992 [email-masked]
#
trap "exit 1" 1 2 3 4 5 6 7 8 10 12 13 14 15 16 17 22 28 29 30 31
 
if [ $# -gt 0 ];then
pass=$*
else
pass=$LOGNAME
fi
 
result=`while read targ spam ; do
if [ "$targ" = "passwd:" ]; then
echo $spam
break
fi
done < /etc/nsswitch.conf`

for tat in $result
do
case $tat in
        files)  if egrep  "^$pass" /etc/passwd > /dev/null; then
                        exec localpasswd $pass
                fi ;;
        nisplus)        if nistest [name=$pass],passwd.org_dir.`domainname`
                        then
                        if nismatch  name=$pass passwd.org_dir.`domainname` \
                                        > /dev/null 2>&1
                                then
                                :
                                else
                                echo  "Enter old \c" ;  keylogin
                                fi
                                exec nispasswd $pass
                        fi ;;
        nis)    if ypmatch $pass passwd > /dev/null ; then
                        exec yppasswd $pass
                fi ;;
        *)      echo Unknown name service $tat. Check nsswitch.conf
                exit 0
esac
done
echo $0:$pass user not found
exit 1
--------------------------------------------------------------------------------

do a 'mv /usr/bin/passwd /usr/bin/localpasswd' first and save the script as
/usr/bin/passwd. 

>2) Now once a user has a valid password which they want to change they use 
>   nispasswd. (NB. we don't use password ageing - yet).

>   	vernon% nispasswd	
>	Changing password for cdh on NIS+ server.
>	Old login password:
>	New password:
>	Re-enter new  password:
>	WARNING: Could not update aging information associated with the password.
>		Updated only the password
>	NIS+ password information changed for cdh

>	SERIOUS WARNING: Could not reencrypt NIS+ credentials for cdh; 
>		login and keylogin passwords may differ.
>		Use NEW passwd for login and OLD passwd for keylogin.
>		Recommend using "nispasswd cdh" again to 
>		revert back to the old passwd
>		Or, do "nisaddcred des" for cdh with the NEW password

>	Permission denied

Your permissions on several NIS+ files are wrong. Here our passwd.org_dir:

--------------------------------------------------------------------------------
taurec{wib} niscat -o passwd.org_dir
Object Name   : passwd
Owner         : taurec.hlt.e-technik.uni-kiel.de.
Group         : admin.hlt.e-technik.uni-kiel.de.
Domain        : org_dir.hlt.e-technik.uni-kiel.de.
Access Rights : ----rmcdrmcd----
Time to Live  : 12:0:0
Object Type   : TABLE
Table Type          : passwd_tbl
Number of Columns   : 8
Character Separator : :
Search Path         : 
Columns             :
        [0]     Name          : name
                Attributes    : (SEARCHABLE, TEXTUAL DATA, CASE SENSITIVE)
                Access Rights : r---------------
        [1]     Name          : passwd
                Attributes    : (TEXTUAL DATA)
                Access Rights : -----m----------
        [2]     Name          : uid
                Attributes    : (SEARCHABLE, TEXTUAL DATA, CASE SENSITIVE)
                Access Rights : r---------------
        [3]     Name          : gid
                Attributes    : (TEXTUAL DATA)
                Access Rights : r---------------
        [4]     Name          : gcos
                Attributes    : (TEXTUAL DATA)
                Access Rights : r---------------
        [5]     Name          : home
                Attributes    : (TEXTUAL DATA)
                Access Rights : r---------------
        [6]     Name          : shell
                Attributes    : (TEXTUAL DATA)
                Access Rights : r----m----------
        [7]     Name          : shadow
                Attributes    : (TEXTUAL DATA)
                Access Rights : ----------------
--------------------------------------------------------------------------------

taurec is NIS+ server. NIS+ admins are all in the NIS+ group admin. All NIS+
client are members of the NIS+ group clients

One line in passwd.org_dir looks like:

--------------------------------------------------------------------------------
taurec{wib} niscat -o [name=wib]passwd.org_dir
Object Name   : passwd
Owner         : wib.hlt.e-technik.uni-kiel.de.
Group         : clients.hlt.e-technik.uni-kiel.de.
Domain        : org_dir.hlt.e-technik.uni-kiel.de.
Access Rights : ----r---r-------
Time to Live  : 12:0:0
Object Type   : ENTRY
        Entry data of type passwd_tbl
        Entry has 8 columns.
        [1] - [4 bytes] flags = 0x0
        'wib'
        [2] - [14 bytes] flags = 0x0
        'secret password'
        [3] - [4 bytes] flags = 0x0
        '107'
        [4] - [3 bytes] flags = 0x0
        '14'
        [5] - [17 bytes] flags = 0x0
        'Willi Burmeister'
        [6] - [10 bytes] flags = 0x0
        '/home/wib'
        [7] - [9 bytes] flags = 0x0
        '/bin/ksh'
        [8] - [12 bytes] flags = 0x0
        '8665:0:::::'
--------------------------------------------------------------------------------

And cred.org_dir:

--------------------------------------------------------------------------------
taurec{wib} niscat -o cred.org_dir
Object Name   : cred
Owner         : taurec.hlt.e-technik.uni-kiel.de.
Group         : admin.hlt.e-technik.uni-kiel.de.
Domain        : org_dir.hlt.e-technik.uni-kiel.de.
Access Rights : r---rmcdrmcdr---
Time to Live  : 12:0:0
Object Type   : TABLE
Table Type          : cred_tbl
Number of Columns   : 5
Character Separator : :
Search Path         : 
Columns             :
        [0]     Name          : cname
                Attributes    : (SEARCHABLE, TEXTUAL DATA, CASE INSENSITIVE)
                Access Rights : ----------------
        [1]     Name          : auth_type
                Attributes    : (SEARCHABLE, TEXTUAL DATA, CASE SENSITIVE)
                Access Rights : ----------------
        [2]     Name          : auth_name
                Attributes    : (SEARCHABLE, TEXTUAL DATA, CASE INSENSITIVE)
                Access Rights : ----------------
        [3]     Name          : public_data
                Attributes    : (TEXTUAL DATA)
                Access Rights : -----m----------
        [4]     Name          : private_data
                Attributes    : (TEXTUAL DATA)
                Access Rights : -----m----------
--------------------------------------------------------------------------------

and one entry:

--------------------------------------------------------------------------------
taurec{wib} niscat -o [cname=wib.hlt.e-technik.uni-kiel.de.]cred.org_dir
Object Name   : cred
Owner         : taurec.hlt.e-technik.uni-kiel.de.
Group         : clients.hlt.e-technik.uni-kiel.de.
Domain        : org_dir.hlt.e-technik.uni-kiel.de.
Access Rights : ----------------
Time to Live  : 12:0:0
Object Type   : ENTRY
        Entry data of type cred_tbl
        Entry has 5 columns.
        [1] - [31 bytes] flags = 0x0
        'wib.hlt.e-technik.uni-kiel.de.'
        [2] - [4 bytes] flags = 0x0
        'DES'
        [3] - [35 bytes] flags = 0x0
        [email-masked]'
        [4] - [49 bytes] flags = 0x0
        '000000000000000000000000000000000000000000000000'
        [5] - [65 bytes] flags = 0x0
        '0000000000000000000000000000000000000000000000000000000000000000'
Object Name   : cred
Owner         : taurec.hlt.e-technik.uni-kiel.de.
Group         : clients.hlt.e-technik.uni-kiel.de.
Domain        : org_dir.hlt.e-technik.uni-kiel.de.
Access Rights : ----------------
Time to Live  : 12:0:0
Object Type   : ENTRY
        Entry data of type cred_tbl
        Entry has 5 columns.
        [1] - [31 bytes] flags = 0x0
        'wib.hlt.e-technik.uni-kiel.de.'
        [2] - [6 bytes] flags = 0x0
        'LOCAL'
        [3] - [4 bytes] flags = 0x0
        '107'
        [4] - [3 bytes] flags = 0x0
        '14'
        [5] - [0 bytes] flags = 0x0
        '(nil)'
--------------------------------------------------------------------------------

This setup works for our NIS+ pool. But attention: this stupid admintool does
not set this permissions correct. You have to set them by hand every time you
modified one entry in the NIS+ passwd or cred table.

We use this small script to clean up:

--------------------------------------------------------------------------------
#!/bin/sh
 
DOMAIN=`domainname`
 
if [ $# -ne 1 ]
then
  echo "usage `basename $0` <user name>"
  exit 1
fi
 
nischgrp clients.$DOMAIN. [name=$1]passwd.org_dir
nischmod g=r [name=$1]passwd.org_dir
 
nischown $1.$DOMAIN [cname=$1.$DOMAIN.]cred.org_dir
nischgrp clients.$DOMAIN. [cname=$1.$DOMAIN]cred.org_dir
nischmod a=,n= [cname=$1.$DOMAIN.]cred.org_dir
 
echo "NIS+ for $1 ok"
--------------------------------------------------------------------------------

I hope this helps

Willi

--
-- 
Willi Burmeister,  Department of Computer Science, Kiel University
Tel: +49 431 5604 98     S-Mail: Preusserstrasse 1-9, D 24105 Kiel
Fax: +49 431 5661 43     E-mail: [email-masked]

---

From: [email-masked] (Dave Miner - ...sometimes you're the bug)
Date: 30 Sep 1993 18:00:52 GMT

In article [email-masked], [email-masked] (Hermann Schinagl) writes:
...
>Not only admintool does the wrong permissions on credentials ! If you add an 
>account with nistbladm, and add the credentials by hand later with nisaddcred
>you will see that the LOCAL credentials of a user are owned by the server, 
>but the DES credentials are owned by the owner of the entry ( == user )
>

Patch 101159-03 is supposed to fix the problem with admintool.  I don't think it's out yet, though.

It's not clear to me exactly which part of nisaddcred you think is wrong, but this is how it should be.  It is usually desirable for the DES credentials to be encrypted with the user's current password so that login can handle the keylogin automatically.  Thus if the password is changed with nispasswd, it also needs to re-encrypt the secret key, and thus the user needs the rights to modify her own DES entry since nispasswd runs under that user's identity and directly updates the table.  With a different ar
chitecture, e.g. a password updating daemon running under some specific administrative identity, this would not be the case.

The LOCAL creds, on the other hand, better be owned by the administrator (root on the server at present) so that users can't just go changing their uid or gid memberships insofar as Secure RPC is concerned.  When you do a netname2user, the LOCAL cred is what's consulted for the answer.

Dave (who put the bug in admintool in the first place and has learned a great deal about Secure RPC since..)

---
---------------------------------------------------------------------------
Dave Miner					    [email-masked]
SunSelect, PC Networking Engineering		    (508) 442-0463
---------------------------------------------------------------------------