mirror of
https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git
synced 2024-12-30 15:38:06 +01:00
161 lines
5.0 KiB
Groff
161 lines
5.0 KiB
Groff
.\" Copyright (c) 1990, 1993
|
|
.\" The Regents of the University of California. All rights reserved.
|
|
.\"
|
|
.\" Redistribution and use in source and binary forms, with or without
|
|
.\" modification, are permitted provided that the following conditions
|
|
.\" are met:
|
|
.\" 1. Redistributions of source code must retain the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer.
|
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer in the
|
|
.\" documentation and/or other materials provided with the distribution.
|
|
.\" 3. All advertising materials mentioning features or use of this software
|
|
.\" must display the following acknowledgement:
|
|
.\" This product includes software developed by the University of
|
|
.\" California, Berkeley and its contributors.
|
|
.\" 4. Neither the name of the University nor the names of its contributors
|
|
.\" may be used to endorse or promote products derived from this software
|
|
.\" without specific prior written permission.
|
|
.\"
|
|
.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
.\" SUCH DAMAGE.
|
|
.\"
|
|
.\" @(#)passwd.1 8.1 (Berkeley) 6/6/93
|
|
.\"
|
|
.Dd June 6, 1993
|
|
.Dt PASSWD 1
|
|
.Os BSD 4
|
|
.Sh NAME
|
|
.Nm passwd, yppasswd
|
|
.Nd modify a user's password
|
|
.Sh SYNOPSIS
|
|
.Nm passwd
|
|
.Op Fl l
|
|
.Op Ar user
|
|
.Sh DESCRIPTION
|
|
.Nm Passwd
|
|
changes the user's Kerberos password. First, the user is prompted for their
|
|
current password.
|
|
If the current password is correctly typed, a new password is
|
|
requested.
|
|
The new password must be entered twice to avoid typing errors.
|
|
.Pp
|
|
The new password should be at least six characters long and not
|
|
purely alphabetic.
|
|
Its total length must be less than
|
|
.Dv _PASSWORD_LEN
|
|
(currently 128 characters).
|
|
Numbers, upper case letters and meta characters
|
|
are encouraged.
|
|
.Pp
|
|
Once the password has been verified,
|
|
.Nm passwd
|
|
communicates the new password information to
|
|
the Kerberos authenticating host.
|
|
.Bl -tag -width flag
|
|
.It Fl l
|
|
This option causes the password to be updated only in the local
|
|
password file, and not with the Kerberos database.
|
|
When changing only the local password,
|
|
.Xr pwd_mkdb 8
|
|
is used to update the password databases.
|
|
.El
|
|
.Pp
|
|
To change another user's Kerberos password, one must first
|
|
run
|
|
.Xr kinit 1
|
|
followed by
|
|
.Xr passwd 1 .
|
|
The super-user is not required to provide a user's current password
|
|
if only the local password is modified.
|
|
.Sh NIS INTERACTION
|
|
.Nm Passwd
|
|
has built-in support for NIS. If a user exists in the NIS password
|
|
database but does not exist locally,
|
|
.Nm passwd
|
|
automatically switches into ``yppasswd'' mode. If the specified
|
|
user does not exist in either the local password database of the
|
|
NIS password maps,
|
|
.Nm passwd
|
|
returns an error.
|
|
The following additional options are supported for use with NIS:
|
|
.Bl -tag -width flag
|
|
.It Fl y
|
|
The
|
|
.Fl y
|
|
flag overrides
|
|
.Nm passwd 's
|
|
checking heuristics and forces
|
|
it into NIS mode.
|
|
.It Fl l
|
|
When NIS is enabled, the
|
|
.Fl l
|
|
flag can be used to force
|
|
.Nm passwd
|
|
into ``local only'' mode. This flag can be used to change the entry
|
|
for a local user when an NIS user exists when the same login name.
|
|
For example, you will sometimes find entries for system ``placeholder''
|
|
users such as
|
|
.Pa bin
|
|
or
|
|
.Pa daemon
|
|
in both the NIS password maps and the local user database. By
|
|
default,
|
|
.Nm passwd
|
|
will try to change the NIS password. The
|
|
.Fl l
|
|
flag can be used to change the local password instead.
|
|
.El
|
|
.Pp
|
|
When changing an NIS password, the user is required to provide
|
|
the old password for authentication (the
|
|
.Xr yppasswdd 8
|
|
daemon requires the original password before
|
|
it will allow any changes to the NIS password maps).
|
|
This restriction applies even to the
|
|
super-user: the only way for an administrator to override a
|
|
user's NIS password is by modifying the NIS password maps on
|
|
the master NIS server.
|
|
.Sh FILES
|
|
.Bl -tag -width /etc/master.passwd -compact
|
|
.It Pa /etc/master.passwd
|
|
The user database
|
|
.It Pa /etc/passwd
|
|
A Version 7 format password file
|
|
.It Pa /etc/passwd.XXXXXX
|
|
Temporary copy of the password file
|
|
.El
|
|
.Sh SEE ALSO
|
|
.Xr chpass 1 ,
|
|
.Xr kerberos 1 ,
|
|
.Xr kinit 1 ,
|
|
.Xr login 1 ,
|
|
.Xr passwd 5 ,
|
|
.Xr kpasswdd 8 ,
|
|
.Xr pwd_mkdb 8 ,
|
|
.Xr vipw 8
|
|
.Rs
|
|
.%A Robert Morris
|
|
.%A Ken Thompson
|
|
.%T "UNIX password security"
|
|
.Re
|
|
.Sh NOTES
|
|
The
|
|
.Xr yppasswd 1
|
|
command is really only a link to
|
|
.Nm passwd .
|
|
.Sh HISTORY
|
|
A
|
|
.Nm passwd
|
|
command appeared in
|
|
.At v6 .
|