Support shadow.byname and shadow.byuid maps, protecting them by

insisting on privileged port access.

Include /var/yp/Makefile.local if it exists and suggest using
it to override /var/yp/Makefile behaviour.

Approved by:	re (kib)
MFC after:	3 weeks

7 files changed, 98 insertions, 33 deletions

diff --git a/share/man/man8/yp.8 b/share/man/man8/yp.8
index 75e3cc1403eb..f57c8df25fce 100644
--- a/share/man/man8/yp.8
+++ b/share/man/man8/yp.8
@@ -28,7 +28,7 @@
 .\"     from: @(#)yp.8	1.0 (deraadt) 4/26/93
 .\" $FreeBSD$
 .\"
-.Dd April 5, 1993
+.Dd June 25, 2009
 .Dt YP 8
 .Os
 .Sh NAME
@@ -310,9 +310,15 @@ The
 .Tn NIS
 .Pa Makefile
 .Pq Pa /var/yp/Makefile
-will do this automatically if the administrator comments out the
-line which says
-.Dq Li NOPUSH=true
+will do this automatically if the administrator creates
+.Pa /var/yp/Makefile.local
+and empties the
+.Va NOPUSH
+variable:
+.Bd -literal -offset four
+.Li NOPUSH=
+.Ed
+.Pp
 .Va ( NOPUSH
 is set to true by default because the default configuration is
 for a small network with only one
@@ -394,9 +400,11 @@ To help prevent this,
 .Fx Ns 's
 .Tn NIS
 server handles the shadow password maps
-.Pa ( master.passwd.byname
+.Pa ( master.passwd.byname ,
+.Pa master.passwd.byuid ,
+.Pa shadow.byname
 and
-.Pa master.passwd.byuid )
+.Pa shadow.byuid )
 in a special way: the server will only provide access to these
 maps in response to requests that originate on privileged ports.
 Since only the super-user is allowed to bind to a privileged port,
diff --git a/usr.bin/ypcat/ypcat.c b/usr.bin/ypcat/ypcat.c
index 55390433597a..3484bc9c1f4c 100644
--- a/usr.bin/ypcat/ypcat.c
+++ b/usr.bin/ypcat/ypcat.c
@@ -52,6 +52,7 @@ struct ypalias {
 } ypaliases[] = {
 	{ "passwd", "passwd.byname" },
 	{ "master.passwd", "master.passwd.byname" },
+	{ "shadow", "shadow.byname" },
 	{ "group", "group.byname" },
 	{ "networks", "networks.byaddr" },
 	{ "hosts", "hosts.byaddr" },
diff --git a/usr.bin/ypmatch/ypmatch.c b/usr.bin/ypmatch/ypmatch.c
index d0904c51de90..a9c32ea72c48 100644
--- a/usr.bin/ypmatch/ypmatch.c
+++ b/usr.bin/ypmatch/ypmatch.c
@@ -52,6 +52,7 @@ struct ypalias {
 } ypaliases[] = {
 	{ "passwd", "passwd.byname" },
 	{ "master.passwd", "master.passwd.byname" },
+	{ "shadow", "shadow.byname" },
 	{ "group", "group.byname" },
 	{ "networks", "networks.byaddr" },
 	{ "hosts", "hosts.byname" },
diff --git a/usr.bin/ypwhich/ypwhich.c b/usr.bin/ypwhich/ypwhich.c
index 8bfca24ed132..4e719dffcd0e 100644
--- a/usr.bin/ypwhich/ypwhich.c
+++ b/usr.bin/ypwhich/ypwhich.c
@@ -64,6 +64,7 @@ struct ypalias {
 } ypaliases[] = {
 	{ "passwd", "passwd.byname" },
 	{ "master.passwd", "master.passwd.byname" },
+	{ "shadow", "shadow.byname" },
 	{ "group", "group.byname" },
 	{ "networks", "networks.byaddr" },
 	{ "hosts", "hosts.byaddr" },
diff --git a/usr.sbin/ypserv/Makefile.yp b/usr.sbin/ypserv/Makefile.yp
index 407663d2dae6..33ca4443fb75 100644
--- a/usr.sbin/ypserv/Makefile.yp
+++ b/usr.sbin/ypserv/Makefile.yp
@@ -11,33 +11,40 @@
 # This Makefile can be modified to support more NIS maps if desired.
 #
 
-# If this machine is an NIS master, comment out this next line so
-# that changes to the NIS maps can be propagated to the slave servers.
-# (By default we assume that we are only serving a small domain with
-# only one server.)
+# If this machine is an NIS master, reset this variable (NOPUSH=)
+# in Makefile.local so that changes to the NIS maps can be propagated to
+# the slave servers.  (By default we assume that we are only serving a
+# small domain with only one server.)
 #
 NOPUSH = "True"
 
+# If this machine does not wish to generate a linux-style shadow map
+# from the master.passwd file, reset this variable (SHADOW=) in
+# Makefile.local.
+SHADOW = "True"
+
 # If you want to use a FreeBSD NIS server to serve non-FreeBSD clients
 # (i.e. clients who expect the password field in the passwd maps to be
-# valid) then uncomment this line. This will cause $YPDIR/passwd to
-# be generated with valid password fields. This is insecure: FreeBSD
-# normally only serves the master.passwd maps (which have real encrypted
-# passwords in them) to the superuser on other FreeBSD machines, but
-# non-FreeBSD clients (e.g. SunOS, Solaris (without NIS+), IRIX, HP-UX,
-# etc...) will only work properly in 'unsecure' mode.
+# valid) then set this variable (UNSECURE="True") in Makefile.local.
+# This will cause $YPDIR/passwd to be generated with valid password
+# fields.  This is insecure: FreeBSD normally only serves the
+# master.passwd and shadow maps (which have real encrypted passwords
+# in them) to the superuser on other FreeBSD machines, but non-FreeBSD
+# clients (e.g. SunOS, Solaris (without NIS+), IRIX, HP-UX, etc...)
+# will only work properly in 'unsecure' mode.
 # 
 #UNSECURE = "True"
 
 # The following line encodes the YP_INTERDOMAIN key into the hosts.byname
 # and hosts.byaddr maps so that ypserv(8) will do DNS lookups to resolve
-# hosts not in the current domain. Commenting this line out will disable
-# the DNS lookups.
+# hosts not in the current domain.  Resetting this variable in
+# Makefile.local (B=) will disable the DNS lookups.
 B=-b
 
-# Normally, the master.passwd.* maps are guarded against access from
-# non-privileged users. By commenting out the following line, the YP_SECURE
-# key will be removed from these maps, allowing anyone to access them.
+# Normally, the master.passwd.* and shadow.* maps are guarded against access
+# from non-privileged users.  By resetting S in Makefile.local (S=), the
+# YP_SECURE key will be removed from these maps, allowing anyone to access
+# them.
 S=-s
 
 # These are commands which this Makefile needs to properly rebuild the
@@ -118,6 +125,17 @@ PUBLICKEY = $(YPSRCDIR)/publickey
 NETID     = $(YPSRCDIR)/netid
 AMDHOST   = $(YPSRCDIR)/amd.map
 
+target: 
+	@if [ ! -d $(DOMAIN) ]; then mkdir $(DOMAIN); fi; \
+	cd $(DOMAIN) ; echo "NIS Map update started on `date` for domain $(DOMAIN)" ; \
+	make -f ../Makefile all; echo "NIS Map update completed."
+
+# Read overrides.  Note, the current directory will be /var/yp/<domain>
+# when 'all' is built.
+.if exists(${YPDIR}/Makefile.local)
+.include "${YPDIR}/Makefile.local"
+.endif
+
 # List of maps that are always built.
 # If you want to omit some of them, feel free to comment
 # them out from this list.
@@ -148,6 +166,9 @@ NETGROUP= /dev/null
 
 .if exists($(MASTER))
 TARGETS+= passwd master.passwd netid
+.if ${SHADOW} == "\"True\""
+TARGETS+= shadow
+.endif
 .else
 MASTER= /dev/null
 TARGETS+= nopass
@@ -171,11 +192,6 @@ TARGETS+= ipnodes
 IPNODES= /dev/null
 .endif
 
-target: 
-	@if [ ! -d $(DOMAIN) ]; then mkdir $(DOMAIN); fi; \
-	cd $(DOMAIN) ; echo "NIS Map update started on `date` for domain $(DOMAIN)" ; \
-	make -f ../Makefile all; echo "NIS Map update completed."
-
 all: $(TARGETS)
 
 ethers:	   ethers.byname ethers.byaddr
@@ -187,6 +203,7 @@ protocols: protocols.bynumber protocols.byname
 rpc:	   rpc.byname rpc.bynumber
 services:  services.byname
 passwd:    passwd.byname passwd.byuid
+shadow:    shadow.byname shadow.byuid
 group:     group.byname group.bygid
 netgrp:    netgroup
 netid:	   netid.byname
@@ -207,6 +224,10 @@ pushpw:
 	@$(DBLOAD) -c
 	@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) master.passwd.byname ; fi
 	@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) master.passwd.byuid ; fi
+.if ${SHADOW} == "\"True\""
+	@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) shadow.byname ; fi
+	@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) shadow.byuid ; fi
+.endif
 	@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) passwd.byname ; fi
 	@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) passwd.byuid ; fi
 
@@ -586,6 +607,36 @@ master.passwd.byuid: $(MASTER)
 .endif
 
 
+shadow.byname: $(MASTER)
+	@echo "Updating $@..."
+.if ${MASTER} == "/dev/null"
+	@echo "Master.passwd source file not found -- skipping"
+.else
+	@$(AWK) -F: '{ if ($$1 != "" && $$1 !~ "^#.*" && $$1 != "+") \
+		print $$1"\t"$$1":"$$2":12000:0:99999:7:::" }' $(MASTER) \
+		| sed 's/\(	[^:]*:\)\*:/\1!:/' \
+		| $(DBLOAD) ${S} -f -i $(PASSWD) -o $(YPMAPDIR)/$@ - $(TMP); \
+		$(RMV) $(TMP) $@
+	@$(DBLOAD) -c
+	@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) $@; fi
+	@if [ ! $(NOPUSH) ]; then echo "Pushed $@ map." ; fi
+.endif
+
+shadow.byuid: $(MASTER)
+	@echo "Updating $@..."
+.if ${MASTER} == "/dev/null"
+	@echo "Master.passwd source file not found -- skipping"
+.else
+	@$(AWK) -F: '{ if ($$1 != "" && $$1 !~ "^#.*" && $$1 != "+") \
+		print $$3"\t"$$1":"$$2":12000:0:99999:7:::" }' $(MASTER) \
+		| sed 's/\(	[^:]*:\)\*:/\1!:/' \
+		| $(DBLOAD) ${S} -f -i $(PASSWD) -o $(YPMAPDIR)/$@ - $(TMP); \
+		$(RMV) $(TMP) $@
+	@$(DBLOAD) -c
+	@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) $@; fi
+	@if [ ! $(NOPUSH) ]; then echo "Pushed $@ map." ; fi
+.endif
+
 amd.map: $(AMDHOST)
 	@echo "Updating $@..."
 	@$(AWK) '$$1 !~ "^#.*"  { \
@@ -604,4 +655,3 @@ amd.map: $(AMDHOST)
 	@$(DBLOAD) -c
 	@if [ ! $(NOPUSH) ]; then $(YPPUSH) -d $(DOMAIN) $@; fi
 	@if [ ! $(NOPUSH) ]; then echo "Pushed $@ map." ; fi
-
diff --git a/usr.sbin/ypserv/yp_access.c b/usr.sbin/ypserv/yp_access.c
index 30ce7407c6e5..66d056bffbb4 100644
--- a/usr.sbin/ypserv/yp_access.c
+++ b/usr.sbin/ypserv/yp_access.c
@@ -178,9 +178,9 @@ load_securenets(void)
  * yp_access() checks the mapname and client host address and watches for
  * the following things:
  *
- * - If the client is referencing one of the master.passwd.* maps, it must
- *   be using a privileged port to make its RPC to us. If it is, then we can
- *   assume that the caller is root and allow the RPC to succeed. If it
+ * - If the client is referencing one of the master.passwd.* or shadow.* maps,
+ *   it must be using a privileged port to make its RPC to us. If it is, then
+ *   we can assume that the caller is root and allow the RPC to succeed. If it
  *   isn't access is denied.
  *
  * - The client's IP address is checked against the securenets rules.
@@ -254,7 +254,7 @@ possible spoof attempt from %s:%d",
 #ifdef DB_CACHE
 		if ((yp_testflag((char *)map, (char *)domain, YP_SECURE) ||
 #else
-		if ((strstr(map, "master.passwd.") ||
+		if ((strstr(map, "master.passwd.") || strstr(map, "shadow.") ||
 #endif
 		    (rqstp->rq_prog == YPPROG &&
 		     rqstp->rq_proc == YPPROC_XFR) ||
diff --git a/usr.sbin/ypserv/ypserv.8 b/usr.sbin/ypserv/ypserv.8
index d4da3b79e862..c8746fd55324 100644
--- a/usr.sbin/ypserv/ypserv.8
+++ b/usr.sbin/ypserv/ypserv.8
@@ -30,7 +30,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd February 3, 2008
+.Dd June 25, 2009
 .Dt YPSERV 8
 .Os
 .Sh NAME
@@ -142,7 +142,11 @@ and
 .Pa master.passwd.byuid
 maps in a special way.
 When the server receives a request to access
-either of these two maps, it will check the TCP port from which the
+either of these two maps (or in fact either of the
+.Pa shadow.byname
+or
+.Pa shadow.byuid
+maps), it will check the TCP port from which the
 request originated and return an error if the port number is greater
 than 1023.
 Since only the superuser is allowed to bind to TCP ports