2007-10-07 17:17:22 +05:30
|
|
|
/*
|
|
|
|
* Copyright 1990 - 1994, Julianne Frances Haugh
|
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
* 3. Neither the name of Julianne F. Haugh nor the names of its contributors
|
|
|
|
* may be used to endorse or promote products derived from this software
|
|
|
|
* without specific prior written permission.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY JULIE HAUGH AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL JULIE HAUGH OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <config.h>
|
|
|
|
|
2007-11-11 05:16:11 +05:30
|
|
|
#ident "$Id$"
|
2007-10-07 17:17:22 +05:30
|
|
|
|
|
|
|
#include <fcntl.h>
|
|
|
|
#include <getopt.h>
|
|
|
|
#include <pwd.h>
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#ifdef USE_PAM
|
|
|
|
#include "pam_defs.h"
|
|
|
|
#endif /* USE_PAM */
|
|
|
|
#include "defines.h"
|
|
|
|
#include "nscd.h"
|
|
|
|
#include "prototypes.h"
|
|
|
|
#include "groupio.h"
|
2007-10-07 17:17:33 +05:30
|
|
|
#ifdef SHADOWGRP
|
2007-10-07 17:17:22 +05:30
|
|
|
#include "sgroupio.h"
|
2007-10-07 17:17:33 +05:30
|
|
|
#endif
|
2007-10-07 17:17:22 +05:30
|
|
|
/*
|
|
|
|
* Global variables
|
|
|
|
*/
|
|
|
|
static char *Prog;
|
2007-11-20 15:03:52 +05:30
|
|
|
static int cflg = 0;
|
2007-10-07 17:17:22 +05:30
|
|
|
static int eflg = 0;
|
|
|
|
static int md5flg = 0;
|
2007-11-20 15:03:52 +05:30
|
|
|
static int sflg = 0;
|
|
|
|
|
|
|
|
static char *crypt_method = NULL;
|
2007-11-24 01:39:57 +05:30
|
|
|
static long sha_rounds = 5000;
|
2007-10-07 17:17:22 +05:30
|
|
|
|
2007-10-07 17:17:33 +05:30
|
|
|
#ifdef SHADOWGRP
|
|
|
|
static int is_shadow_grp;
|
|
|
|
#endif
|
2007-10-07 17:17:22 +05:30
|
|
|
|
|
|
|
/* local function prototypes */
|
|
|
|
static void usage (void);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* usage - display usage message and exit
|
|
|
|
*/
|
|
|
|
static void usage (void)
|
|
|
|
{
|
2007-11-24 01:39:57 +05:30
|
|
|
fprintf (stderr, _("Usage: %s [options]\n"
|
2007-10-07 17:17:22 +05:30
|
|
|
"\n"
|
|
|
|
"Options:\n"
|
2007-11-20 15:03:52 +05:30
|
|
|
" -c, --crypt-method the crypt method (one of %s)\n"
|
2007-10-07 17:17:22 +05:30
|
|
|
" -e, --encrypted supplied passwords are encrypted\n"
|
|
|
|
" -h, --help display this help message and exit\n"
|
2007-11-24 05:46:41 +05:30
|
|
|
" -m, --md5 encrypt the clear text password using the MD5 algorithm\n"
|
2007-11-24 01:39:57 +05:30
|
|
|
"%s"
|
2007-11-20 15:03:52 +05:30
|
|
|
"\n"),
|
2007-11-24 01:39:57 +05:30
|
|
|
Prog,
|
* configure.in: New configure option: --with-sha-crypt enabled by
default. Keeping the feature enabled is safe. Disabling it permits
to disable the references to the SHA256 and SHA512 password
encryption algorithms from the usage help and manuals (in addition
to the support for these algorithms in the code).
* libmisc/obscure.c, libmisc/salt.c, src/newusers.c,
src/chpasswd.c, src/chgpasswd.c, src/passwd.c: ENCRYPT_METHOD is
always supported in login.defs. Remove the ENCRYPTMETHOD_SELECT
preprocessor condition.
* libmisc/obscure.c, libmisc/salt.c, src/newusers.c,
src/chpasswd.c, src/chgpasswd.c, src/passwd.c: Disable SHA256 and
SHA512 if USE_SHA_CRYPT is not defined (this corresponds to a
subset of the ENCRYPTMETHOD_SELECT sections).
2007-11-24 18:38:08 +05:30
|
|
|
#ifndef USE_SHA_CRYPT
|
2007-11-24 01:39:57 +05:30
|
|
|
"NONE DES MD5", ""
|
2007-11-20 15:03:52 +05:30
|
|
|
#else
|
2007-11-24 01:39:57 +05:30
|
|
|
"NONE DES MD5 SHA256 SHA512",
|
|
|
|
_(" -s, --sha-rounds number of SHA rounds for the SHA* crypt algorithms\n")
|
2007-11-20 15:03:52 +05:30
|
|
|
#endif
|
|
|
|
);
|
2007-10-07 17:17:22 +05:30
|
|
|
exit (1);
|
|
|
|
}
|
|
|
|
|
|
|
|
int main (int argc, char **argv)
|
|
|
|
{
|
|
|
|
char buf[BUFSIZ];
|
|
|
|
char *name;
|
|
|
|
char *newpwd;
|
|
|
|
char *cp;
|
|
|
|
|
2007-10-07 17:17:33 +05:30
|
|
|
#ifdef SHADOWGRP
|
2007-10-07 17:17:22 +05:30
|
|
|
const struct sgrp *sg;
|
|
|
|
struct sgrp newsg;
|
2007-10-07 17:17:33 +05:30
|
|
|
#endif
|
2007-10-07 17:17:22 +05:30
|
|
|
|
|
|
|
const struct group *gr;
|
2007-11-21 02:29:42 +05:30
|
|
|
struct group newgr;
|
2007-10-07 17:17:22 +05:30
|
|
|
int errors = 0;
|
|
|
|
int line = 0;
|
|
|
|
int ok;
|
|
|
|
|
|
|
|
#ifdef USE_PAM
|
|
|
|
pam_handle_t *pamh = NULL;
|
|
|
|
int retval;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
Prog = Basename (argv[0]);
|
|
|
|
|
|
|
|
setlocale (LC_ALL, "");
|
|
|
|
bindtextdomain (PACKAGE, LOCALEDIR);
|
|
|
|
textdomain (PACKAGE);
|
|
|
|
|
|
|
|
{
|
|
|
|
int option_index = 0;
|
|
|
|
int c;
|
|
|
|
static struct option long_options[] = {
|
2007-11-20 15:03:52 +05:30
|
|
|
{"crypt-method", required_argument, NULL, 'c'},
|
2007-10-07 17:17:22 +05:30
|
|
|
{"encrypted", no_argument, NULL, 'e'},
|
|
|
|
{"help", no_argument, NULL, 'h'},
|
|
|
|
{"md5", no_argument, NULL, 'm'},
|
* configure.in: New configure option: --with-sha-crypt enabled by
default. Keeping the feature enabled is safe. Disabling it permits
to disable the references to the SHA256 and SHA512 password
encryption algorithms from the usage help and manuals (in addition
to the support for these algorithms in the code).
* libmisc/obscure.c, libmisc/salt.c, src/newusers.c,
src/chpasswd.c, src/chgpasswd.c, src/passwd.c: ENCRYPT_METHOD is
always supported in login.defs. Remove the ENCRYPTMETHOD_SELECT
preprocessor condition.
* libmisc/obscure.c, libmisc/salt.c, src/newusers.c,
src/chpasswd.c, src/chgpasswd.c, src/passwd.c: Disable SHA256 and
SHA512 if USE_SHA_CRYPT is not defined (this corresponds to a
subset of the ENCRYPTMETHOD_SELECT sections).
2007-11-24 18:38:08 +05:30
|
|
|
#ifdef USE_SHA_CRYPT
|
2007-11-20 15:03:52 +05:30
|
|
|
{"sha-rounds", required_argument, NULL, 's'},
|
2007-11-24 05:46:41 +05:30
|
|
|
#endif
|
2007-10-07 17:17:22 +05:30
|
|
|
{NULL, 0, NULL, '\0'}
|
|
|
|
};
|
|
|
|
|
|
|
|
while ((c =
|
2007-11-24 05:46:41 +05:30
|
|
|
getopt_long (argc, argv,
|
* configure.in: New configure option: --with-sha-crypt enabled by
default. Keeping the feature enabled is safe. Disabling it permits
to disable the references to the SHA256 and SHA512 password
encryption algorithms from the usage help and manuals (in addition
to the support for these algorithms in the code).
* libmisc/obscure.c, libmisc/salt.c, src/newusers.c,
src/chpasswd.c, src/chgpasswd.c, src/passwd.c: ENCRYPT_METHOD is
always supported in login.defs. Remove the ENCRYPTMETHOD_SELECT
preprocessor condition.
* libmisc/obscure.c, libmisc/salt.c, src/newusers.c,
src/chpasswd.c, src/chgpasswd.c, src/passwd.c: Disable SHA256 and
SHA512 if USE_SHA_CRYPT is not defined (this corresponds to a
subset of the ENCRYPTMETHOD_SELECT sections).
2007-11-24 18:38:08 +05:30
|
|
|
#ifdef USE_SHA_CRYPT
|
2007-11-24 05:46:41 +05:30
|
|
|
"c:ehms:",
|
|
|
|
#else
|
|
|
|
"c:ehm",
|
|
|
|
#endif
|
|
|
|
long_options,
|
2007-10-07 17:17:22 +05:30
|
|
|
&option_index)) != -1) {
|
|
|
|
switch (c) {
|
2007-11-20 15:03:52 +05:30
|
|
|
case 'c':
|
|
|
|
cflg = 1;
|
|
|
|
crypt_method = optarg;
|
|
|
|
break;
|
2007-10-07 17:17:22 +05:30
|
|
|
case 'e':
|
|
|
|
eflg = 1;
|
|
|
|
break;
|
|
|
|
case 'h':
|
|
|
|
usage ();
|
|
|
|
break;
|
|
|
|
case 'm':
|
|
|
|
md5flg = 1;
|
|
|
|
break;
|
* configure.in: New configure option: --with-sha-crypt enabled by
default. Keeping the feature enabled is safe. Disabling it permits
to disable the references to the SHA256 and SHA512 password
encryption algorithms from the usage help and manuals (in addition
to the support for these algorithms in the code).
* libmisc/obscure.c, libmisc/salt.c, src/newusers.c,
src/chpasswd.c, src/chgpasswd.c, src/passwd.c: ENCRYPT_METHOD is
always supported in login.defs. Remove the ENCRYPTMETHOD_SELECT
preprocessor condition.
* libmisc/obscure.c, libmisc/salt.c, src/newusers.c,
src/chpasswd.c, src/chgpasswd.c, src/passwd.c: Disable SHA256 and
SHA512 if USE_SHA_CRYPT is not defined (this corresponds to a
subset of the ENCRYPTMETHOD_SELECT sections).
2007-11-24 18:38:08 +05:30
|
|
|
#ifdef USE_SHA_CRYPT
|
2007-11-20 15:03:52 +05:30
|
|
|
case 's':
|
|
|
|
sflg = 1;
|
2007-11-24 01:39:57 +05:30
|
|
|
if (!getlong(optarg, &sha_rounds)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: invalid numeric argument '%s'\n"),
|
|
|
|
Prog, optarg);
|
|
|
|
usage ();
|
|
|
|
}
|
2007-11-20 15:03:52 +05:30
|
|
|
break;
|
2007-11-24 05:46:41 +05:30
|
|
|
#endif
|
2007-10-07 17:17:22 +05:30
|
|
|
case 0:
|
|
|
|
/* long option */
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
usage ();
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-11-20 15:03:52 +05:30
|
|
|
/* validate options */
|
|
|
|
if (sflg && !cflg) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: %s flag is ONLY allowed with the %s flag\n"),
|
|
|
|
Prog, "-s", "-c");
|
|
|
|
usage ();
|
|
|
|
}
|
2007-11-20 18:39:55 +05:30
|
|
|
if ((eflg && (md5flg || cflg)) ||
|
2007-11-21 01:30:16 +05:30
|
|
|
(md5flg && cflg)) {
|
2007-11-20 15:03:52 +05:30
|
|
|
fprintf (stderr,
|
2007-11-20 18:39:55 +05:30
|
|
|
_("%s: the -c, -e, and -m flags are exclusive\n"),
|
2007-11-20 15:03:52 +05:30
|
|
|
Prog);
|
|
|
|
usage ();
|
|
|
|
}
|
|
|
|
if (cflg) {
|
2007-11-24 02:21:43 +05:30
|
|
|
if ( 0 != strcmp (crypt_method, "DES")
|
|
|
|
&& 0 != strcmp (crypt_method, "MD5")
|
|
|
|
&& 0 != strcmp (crypt_method, "NONE")
|
* configure.in: New configure option: --with-sha-crypt enabled by
default. Keeping the feature enabled is safe. Disabling it permits
to disable the references to the SHA256 and SHA512 password
encryption algorithms from the usage help and manuals (in addition
to the support for these algorithms in the code).
* libmisc/obscure.c, libmisc/salt.c, src/newusers.c,
src/chpasswd.c, src/chgpasswd.c, src/passwd.c: ENCRYPT_METHOD is
always supported in login.defs. Remove the ENCRYPTMETHOD_SELECT
preprocessor condition.
* libmisc/obscure.c, libmisc/salt.c, src/newusers.c,
src/chpasswd.c, src/chgpasswd.c, src/passwd.c: Disable SHA256 and
SHA512 if USE_SHA_CRYPT is not defined (this corresponds to a
subset of the ENCRYPTMETHOD_SELECT sections).
2007-11-24 18:38:08 +05:30
|
|
|
#ifdef USE_SHA_CRYPT
|
2007-11-24 02:21:43 +05:30
|
|
|
&& 0 != strcmp (crypt_method, "SHA256")
|
|
|
|
&& 0 != strcmp (crypt_method, "SHA512")
|
2007-11-20 15:03:52 +05:30
|
|
|
#endif
|
|
|
|
) {
|
|
|
|
fprintf (stderr,
|
2007-11-24 01:39:57 +05:30
|
|
|
_("%s: unsupported crypt method: %s\n"),
|
|
|
|
Prog, crypt_method);
|
2007-11-20 15:03:52 +05:30
|
|
|
usage ();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-10-07 17:17:22 +05:30
|
|
|
#ifdef USE_PAM
|
|
|
|
retval = PAM_SUCCESS;
|
|
|
|
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
{
|
|
|
|
struct passwd *pampw;
|
|
|
|
pampw = getpwuid (getuid ()); /* local, no need for xgetpwuid */
|
|
|
|
if (pampw == NULL) {
|
|
|
|
retval = PAM_USER_UNKNOWN;
|
|
|
|
}
|
2007-10-07 17:17:22 +05:30
|
|
|
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
if (retval == PAM_SUCCESS) {
|
|
|
|
retval = pam_start ("chpasswd", pampw->pw_name,
|
|
|
|
&conv, &pamh);
|
|
|
|
}
|
2007-10-07 17:17:22 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
if (retval == PAM_SUCCESS) {
|
|
|
|
retval = pam_authenticate (pamh, 0);
|
|
|
|
if (retval != PAM_SUCCESS) {
|
|
|
|
pam_end (pamh, retval);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (retval == PAM_SUCCESS) {
|
|
|
|
retval = pam_acct_mgmt (pamh, 0);
|
|
|
|
if (retval != PAM_SUCCESS) {
|
|
|
|
pam_end (pamh, retval);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (retval != PAM_SUCCESS) {
|
|
|
|
fprintf (stderr, _("%s: PAM authentication failed\n"), Prog);
|
|
|
|
exit (1);
|
|
|
|
}
|
|
|
|
#endif /* USE_PAM */
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Lock the group file and open it for reading. This will bring
|
|
|
|
* all of the entries into memory where they may be updated.
|
|
|
|
*/
|
|
|
|
if (!gr_lock ()) {
|
|
|
|
fprintf (stderr, _("%s: can't lock group file\n"), Prog);
|
|
|
|
exit (1);
|
|
|
|
}
|
|
|
|
if (!gr_open (O_RDWR)) {
|
|
|
|
fprintf (stderr, _("%s: can't open group file\n"), Prog);
|
|
|
|
gr_unlock ();
|
|
|
|
exit (1);
|
|
|
|
}
|
2007-10-07 17:17:33 +05:30
|
|
|
#ifdef SHADOWGRP
|
|
|
|
is_shadow_grp = sgr_file_present ();
|
|
|
|
if (is_shadow_grp) {
|
2007-10-07 17:17:22 +05:30
|
|
|
if (!sgr_lock ()) {
|
|
|
|
fprintf (stderr, _("%s: can't lock gshadow file\n"),
|
|
|
|
Prog);
|
|
|
|
gr_unlock ();
|
|
|
|
exit (1);
|
|
|
|
}
|
|
|
|
if (!sgr_open (O_RDWR)) {
|
|
|
|
fprintf (stderr, _("%s: can't open shadow file\n"),
|
|
|
|
Prog);
|
|
|
|
gr_unlock ();
|
|
|
|
sgr_unlock ();
|
|
|
|
exit (1);
|
|
|
|
}
|
|
|
|
}
|
2007-10-07 17:17:33 +05:30
|
|
|
#endif
|
2007-10-07 17:17:22 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* Read each line, separating the group name from the password. The
|
|
|
|
* password entry for each group will be looked up in the appropriate
|
|
|
|
* file (gshadow or group) and the password changed.
|
|
|
|
*/
|
|
|
|
while (fgets (buf, sizeof buf, stdin) != (char *) 0) {
|
|
|
|
line++;
|
|
|
|
if ((cp = strrchr (buf, '\n'))) {
|
|
|
|
*cp = '\0';
|
|
|
|
} else {
|
|
|
|
fprintf (stderr, _("%s: line %d: line too long\n"),
|
|
|
|
Prog, line);
|
|
|
|
errors++;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The groupname is the first field. It is separated from the
|
|
|
|
* password with a ":" character which is replaced with a
|
|
|
|
* NUL to give the new password. The new password will then
|
|
|
|
* be encrypted in the normal fashion with a new salt
|
|
|
|
* generated, unless the '-e' is given, in which case it is
|
|
|
|
* assumed to already be encrypted.
|
|
|
|
*/
|
|
|
|
|
|
|
|
name = buf;
|
|
|
|
if ((cp = strchr (name, ':'))) {
|
|
|
|
*cp++ = '\0';
|
|
|
|
} else {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: line %d: missing new password\n"),
|
|
|
|
Prog, line);
|
|
|
|
errors++;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
newpwd = cp;
|
2007-11-24 01:39:57 +05:30
|
|
|
if (!eflg &&
|
|
|
|
(NULL == crypt_method ||
|
|
|
|
0 != strcmp(crypt_method, "NONE"))) {
|
2007-11-20 15:03:52 +05:30
|
|
|
void *arg = NULL;
|
|
|
|
if (md5flg)
|
|
|
|
crypt_method = "MD5";
|
|
|
|
else if (crypt_method != NULL) {
|
|
|
|
if (sflg)
|
|
|
|
arg = &sha_rounds;
|
2007-10-07 17:17:22 +05:30
|
|
|
} else
|
2007-11-24 05:46:41 +05:30
|
|
|
crypt_method = NULL;
|
2007-11-20 15:03:52 +05:30
|
|
|
cp = pw_encrypt (newpwd,
|
|
|
|
crypt_make_salt(crypt_method, arg));
|
2007-10-07 17:17:22 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Get the password file entry for this user. The user must
|
|
|
|
* already exist.
|
|
|
|
*/
|
|
|
|
gr = gr_locate (name);
|
|
|
|
if (!gr) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: line %d: unknown group %s\n"), Prog,
|
|
|
|
line, name);
|
|
|
|
errors++;
|
|
|
|
continue;
|
|
|
|
}
|
2007-10-07 17:17:33 +05:30
|
|
|
#ifdef SHADOWGRP
|
2007-11-21 02:29:42 +05:30
|
|
|
if (is_shadow_grp)
|
|
|
|
sg = sgr_locate (name);
|
|
|
|
else
|
|
|
|
sg = NULL;
|
2007-10-07 17:17:33 +05:30
|
|
|
#endif
|
2007-10-07 17:17:22 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* The freshly encrypted new password is merged into the
|
|
|
|
* user's password file entry and the last password change
|
|
|
|
* date is set to the current date.
|
|
|
|
*/
|
2007-10-07 17:17:33 +05:30
|
|
|
#ifdef SHADOWGRP
|
2007-11-21 02:29:42 +05:30
|
|
|
if (sg) {
|
|
|
|
newsg = *sg;
|
|
|
|
newsg.sg_passwd = cp;
|
|
|
|
} else
|
2007-10-07 17:17:33 +05:30
|
|
|
#endif
|
2007-11-21 02:29:42 +05:30
|
|
|
{
|
|
|
|
newgr = *gr;
|
|
|
|
newgr.gr_passwd = cp;
|
|
|
|
}
|
2007-10-07 17:17:22 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* The updated password file entry is then put back and will
|
|
|
|
* be written to the password file later, after all the
|
|
|
|
* other entries have been updated as well.
|
|
|
|
*/
|
2007-10-07 17:17:33 +05:30
|
|
|
#ifdef SHADOWGRP
|
2007-11-21 02:29:42 +05:30
|
|
|
if (sg)
|
|
|
|
ok = sgr_update (&newsg);
|
|
|
|
else
|
2007-10-07 17:17:33 +05:30
|
|
|
#endif
|
2007-11-21 02:29:42 +05:30
|
|
|
ok = gr_update (&newgr);
|
2007-10-07 17:17:22 +05:30
|
|
|
|
|
|
|
if (!ok) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_
|
|
|
|
("%s: line %d: cannot update password entry\n"),
|
|
|
|
Prog, line);
|
|
|
|
errors++;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Any detected errors will cause the entire set of changes to be
|
|
|
|
* aborted. Unlocking the password file will cause all of the
|
|
|
|
* changes to be ignored. Otherwise the file is closed, causing the
|
|
|
|
* changes to be written out all at once, and then unlocked
|
|
|
|
* afterwards.
|
|
|
|
*/
|
|
|
|
if (errors) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: error detected, changes ignored\n"), Prog);
|
2007-10-07 17:17:33 +05:30
|
|
|
#ifdef SHADOWGRP
|
|
|
|
if (is_shadow_grp)
|
2007-10-07 17:17:22 +05:30
|
|
|
sgr_unlock ();
|
2007-10-07 17:17:33 +05:30
|
|
|
#endif
|
2007-10-07 17:17:22 +05:30
|
|
|
gr_unlock ();
|
|
|
|
exit (1);
|
|
|
|
}
|
2007-10-07 17:17:33 +05:30
|
|
|
#ifdef SHADOWGRP
|
|
|
|
if (is_shadow_grp) {
|
2007-10-07 17:17:22 +05:30
|
|
|
if (!sgr_close ()) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: error updating shadow file\n"), Prog);
|
|
|
|
gr_unlock ();
|
|
|
|
exit (1);
|
|
|
|
}
|
|
|
|
sgr_unlock ();
|
|
|
|
}
|
2007-10-07 17:17:33 +05:30
|
|
|
#endif
|
2007-10-07 17:17:22 +05:30
|
|
|
if (!gr_close ()) {
|
|
|
|
fprintf (stderr, _("%s: error updating password file\n"), Prog);
|
|
|
|
exit (1);
|
|
|
|
}
|
|
|
|
|
|
|
|
nscd_flush_cache ("group");
|
|
|
|
|
|
|
|
gr_unlock ();
|
|
|
|
|
|
|
|
#ifdef USE_PAM
|
|
|
|
if (retval == PAM_SUCCESS)
|
|
|
|
pam_end (pamh, PAM_SUCCESS);
|
|
|
|
#endif /* USE_PAM */
|
|
|
|
|
|
|
|
return (0);
|
|
|
|
}
|