CVS log for src/usr.bin/passwd/local_passwd.c

Up to [cvs.NetBSD.org] / src / usr.bin / passwd

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

s/Aborb/Absorb/ in comment.

sync with head

fix non-PAM build

NULL does not need a cast

Pull up following revision(s) (requested by gdt in ticket #1360):
	usr.bin/passwd/pam_passwd.c: revision 1.5
	usr.bin/passwd/local_passwd.c: revision 1.34
Log successful and unsuccessful attempts to change passwords, via -l
or pam, to ease IT audit guideline compliance.  Patch from Richard
Hansen of BBN in private mail.
Proposed on tech-kern with positive comments, except a suggestion I
didn't implement:
A possible future enhancement is refraining from logging if the old
password is empty, as some people abort password changing that way.
However, it's not clear if this complies with most guidelines that
require password change logging, and at first glance that appears to
be a fairly difficult change.

Log successful and unsuccessful attempts to change passwords, via -l
or pam, to ease IT audit guideline compliance.  Patch from Richard
Hansen of BBN in private mail.

Proposed on tech-kern with positive comments, except a suggestion I
didn't implement:

A possible future enhancement is refraining from logging if the old
password is empty, as some people abort password changing that way.
However, it's not clear if this complies with most guidelines that
require password change logging, and at first glance that appears to
be a fairly difficult change.

Sync with HEAD.

Third (and last) commit. See http://mail-index.netbsd.org/source-changes/2009/05/13/msg221222.html

Rename variables to fix GCC warnings: local variables optopt and optarg
shadow globals.

Fix WARNS=4 issues

sync with HEAD

minor lint

Magor rework of passwd(1) for the PAM case.  Add "-d <database>" option,
similar to Solaris's "-r <repository" or Mac OS X's "-i <infosystem>",
to select the password database (files, nis, krb5).  Otherwise, we default
to using whatever PAM decides.

adapt to pw_gensalt() changes.

use pw_gensalt() and don't dig into libcrypt.

Add (unsigned char) cast to ctype functions
A password containg 80...ff could be reported (incorrectly) as being
all lower case.

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22365, verified by myself.

use strlcpy

Pull up revision 1.20 (requested by jonathan):
  Add support for local MD5-encrypted passwords.

Slight change to previous: rebuild the insecure password db if the expiry
time has changed, not just been set.

Update for pw_mkdb() change: restrict updates to one user's records and/or
the secure database where appropriate.

Back out previous.

When not running as the super-user: if the user's password has expired or is
due to expire within _PASSWORD_WARNDAYS (or the setting from login.conf),
force the user to set a different password than the one they are currently
using. (Yes, it's actually worthwhile doing this.)

- Pull in pwd.h since `struct passwd' is now used in extern.h.
- Use pwd_gensalt().

Modularize password changing mechanisms, as proposed in
<20000130122641.A8134@xanadu.kublai.com>:
Subject: PROPOSAL: making passwd pluggable (sort of)
Date: Sun, 30 Jan 2000 12:26:41 -0500

Wrap login.conf database access in ifdef LOGIN_CAP.

Changes to passwd(1) for login.conf. Supported capabilities are
minpasswordlen and passwordtime (expiry time).

KNF. ensure buffers are nul-terminated.

Need <time.h> for time() prototype.

WARNSify, fix .Nm usage

Changes to close PR3806. (Different than in PR.)
-- don't lock passwd until data is collected.
-- save a copy of original pw data for pw_copy checking
-- Try several times to lock passwd

Tidy up printf formats in "don't use all lower case" warning
message.  From Dave Huang <khym@bga.com>, PR #3198.

remove dangerous sprintf and strcpy calls.

Sync with 4.4BSD-Lite2 (whew!)

Import of 4.4BSD-Lite2 sources

Slight semantics change: ALWAYS use YP if the system is bound to a
YP server.  This is required if the passwd database is to stay in sync
if this program is run on the YP server.  Note, local passwd database
operations can still be performed by passing the -l flag.

Also, some minor cleanup and RCS id police.

Updated to use new password file functions in libutil.
From Greg Hudson <ghudson@MIT.EDU>.

needs string.h

rationalize & cleanup -y/-k/-l code
update man page for -y
yp password setting now works again!
relax passwd setting retry code a teeny bit

Add RCS identifiers.

Return status instead of exiting.

changed to use new libcrypt scheme.

Fixed problem where users with a blank password field can't change their
password.

initial import of 386bsd-0.1 sources

Initial revision