Subject: Re: Any way around remote passwd security?

From: [email-masked] (James Litchfield - SunSoft Western Area OS Person)
Date: 29 Sep 1993 01:55:46 GMT

If you're setting up accounts under the control of a naming service with a null
passwd, the passwd program isn't smart enough to do things correctly if you've
specified that passwords are required in the /etc/defaults/passwd file.

This is a workaround I use:

mv /usr/bin/passwd /usr/bin/passwd.orig (note: leave permissions as is: r-sr-sr-x
	owned by root and group of sys)
insert this script as /usr/bin/passwd (note: 0755 permissions are sufficient for
	the script - no suid is necessary):

---- Cut Here ----
#! /bin/sh
#
# Fix for passwd's inability to deal with naming services. Based on an
# an idea of Chuck McManis. Expects the original passwd program to live in
# /usr/bin/passwd.orig (with its original permissions). Uses the "who" command
# instead of the BSD whoami command since you're not guaranteed that the BSD source
# compatibility software was installed.
#
# That is a space (040) between the double quotes in the cut command.
#
if [ $# -eq 0 ] 
then
    UID=`who am i | cut -f 1 -d " "`
elif [ $# -eq 1 ]
then
    UID=$1
else
    echo "passwd: one username at a time please"
    exit 1
fi
DONE=0
NS=`egrep passwd: /etc/nsswitch.conf`
for name in $NS
do
    case "$name" in
    files)
	IPW=`egrep $UID /etc/passwd`
	if [ -n "$IPW" ]
	then
	    /usr/bin/passwd.orig $UID
	    DONE=1
	    break
	fi
	;;
    nis)
	IYP=`ypmatch $UID passwd 2> /dev/null`
	if [ -n "$IYP" ]
	then
	    /usr/bin/yppasswd $UID
	    DONE=1
	    break
	fi
	;;
    nisplus)
	DOM=`domainname`
	INS=`nismatch name=$UID passwd.org_dir.$DOM`
	if [ -n $INS ]
	then
	    /usr/bin/nispasswd $UID
	    DONE=1
	    break
	fi
	;;
    esac
done
if [ $DONE -eq 0 ] 
then
    echo "Username $UID not found in local files or naming service"
    exit 2
fi
exit 0