Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a NIS master-slave setup and I would like to improve the password rules/complexity for it. Seems like if I introduce new rules to the NIS Master they are applicable only from there. What I mean: I want minimal password length of 9 characters. On the NIS master if I run 'passwd' it obeys this requirement. If I run 'yppasswd' it just go to the default 6 characters. If I use 'chage -d 0 user1' to force a user to change a password, the user is prompted only when login on the NIS Master. The user's old password is still good to login at NIS clients. All machines are running Ubuntu 9.10 or 10.04.

How I can strengthen yppasswd rules and make it warn users to change their passwords? Thank you all!

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Unfortunately (short of recompiling yppasswd and hard coding in your requirements), this cannot be accomplished as stated. I would submit that the yppasswd daemon should be disabled and no calls to yppasswd should be made. A much better approach is to configure your pam stack to handle native calls to passwd and push them through the appropriate authentication channels. Alternatively you can globally alias yppasswd to passwd -r nis (man password for individual arguments).

That'd be where I would start.

share|improve this answer
    
I think my best option is to move away from NIS. It seems like it reads only the first 8 characters and I want to avoid compiling it. Thanks! –  grs Mar 19 '11 at 19:19

You can create a wrapper script that tests the password candidate, then runs your native yppasswd program if the test passes. On the upside, nothing gets recompiled, On the downside, the script has to be replicated to all nodes where yppasswd would be run.

A better solution is to manupulate PAM. This article (http://www.techrepublic.com/article/controlling-passwords-with-pam/1055267) shows you how.

share|improve this answer
    
+1 for the good article! –  grs Mar 19 '11 at 19:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.