1.\" Copyright (c) 1988, 1990, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)chpass.1 8.2 (Berkeley) 12/30/93 33.\" $FreeBSD$ 34.\" 35.Dd December 30, 1993 36.Dt CHPASS 1 37.Os 38.Sh NAME 39.Nm chpass , 40.Nm chfn , 41.Nm chsh , 42.Nm ypchpass , 43.Nm ypchfn , 44.Nm ypchsh 45.Nd add or change user database information 46.Sh SYNOPSIS 47.Nm 48.Op Fl a Ar list 49.Op Fl p Ar encpass 50.Op Fl e Ar expiretime 51.Op Fl s Ar newshell 52.Op user 53.Pp 54.Nm 55.Op Fl oly 56.Op Fl a Ar list 57.Op Fl p Ar encpass 58.Op Fl e Ar expiretime 59.Op Fl s Ar newshell 60.Op Fl d Ar domain 61.Op Fl h Ar host 62.Op user 63.Sh DESCRIPTION 64The 65.Nm 66program 67allows editing of the user database information associated 68with 69.Ar user 70or, by default, the current user. 71The information is formatted and supplied to an editor for changes. 72.Pp 73Only the information that the user is allowed to change is displayed. 74.Pp 75The options are as follows: 76.Bl -tag -width indent 77.It Fl a 78The super-user is allowed to directly supply a user database 79entry, in the format specified by 80.Xr passwd 5 , 81as an argument. 82This argument must be a colon 83.Pq Dq \&: 84separated list of all the 85user database fields, although they may be empty. 86.It Fl p 87The super-user is allowed to directly supply an encrypted password field, 88in the format used by 89.Xr crypt 3 , 90as an argument. 91.It Fl e Ar expiretime 92Change the account expire time. 93This option is used to set the expire time 94from a script as if it was done in the interactive editor. 95.It Fl s Ar newshell 96Attempt to change the user's shell to 97.Ar newshell . 98.El 99.Pp 100Possible display items are as follows: 101.Pp 102.Bl -tag -width "Other Information:" -compact -offset indent 103.It Login: 104user's login name 105.It Password: 106user's encrypted password 107.It Uid: 108user's login 109.It Gid: 110user's login group 111.It Class: 112user's general classification 113.It Change: 114password change time 115.It Expire: 116account expiration time 117.It Full Name: 118user's real name 119.It Office Location: 120user's office location (1) 121.It Office Phone: 122user's office phone (1) 123.It Home Phone: 124user's home phone (1) 125.It Other Information: 126any locally defined parameters for user (1) 127.It Home Directory: 128user's home directory 129.It Shell: 130user's login shell 131.Pp 132.It NOTE(1) - 133In the actual master.passwd file, these fields are comma-delimited 134fields embedded in the FullName field. 135.El 136.Pp 137The 138.Ar login 139field is the user name used to access the computer account. 140.Pp 141The 142.Ar password 143field contains the encrypted form of the user's password. 144.Pp 145The 146.Ar uid 147field is the number associated with the 148.Ar login 149field. 150Both of these fields should be unique across the system (and often 151across a group of systems) as they control file access. 152.Pp 153While it is possible to have multiple entries with identical login names 154and/or identical user id's, it is usually a mistake to do so. Routines 155that manipulate these files will often return only one of the multiple 156entries, and that one by random selection. 157.Pp 158The 159.Ar group 160field is the group that the user will be placed in at login. 161Since 162.Bx 163supports multiple groups (see 164.Xr groups 1 ) 165this field currently has little special meaning. 166This field may be filled in with either a number or a group name (see 167.Xr group 5 ) . 168.Pp 169The 170.Ar class 171field references class descriptions in 172.Pa /etc/login.conf 173and is typically used to initialize the user's system resource limits 174when they login. 175.Pp 176The 177.Ar change 178field is the date by which the password must be changed. 179.Pp 180The 181.Ar expire 182field is the date on which the account expires. 183.Pp 184Both the 185.Ar change 186and 187.Ar expire 188fields should be entered in the form 189.Dq month day year 190where 191.Ar month 192is the month name (the first three characters are sufficient), 193.Ar day 194is the day of the month, and 195.Ar year 196is the year. 197.Pp 198Five fields are available for storing the user's 199.Ar full name , office location , 200.Ar work 201and 202.Ar home telephone 203numbers and finally 204.Ar other information 205which is a single comma delimited string to represent any additional 206gcos fields (typically used for site specific user information). 207Note that 208.Xr finger 1 209will display the office location and office phone together under the 210heading 211.Ar Office: . 212.Pp 213The user's 214.Ar home directory 215is the full 216.Ux 217path name where the user 218will be placed at login. 219.Pp 220The 221.Ar shell 222field is the command interpreter the user prefers. 223If the 224.Ar shell 225field is empty, the Bourne shell, 226.Pa /bin/sh , 227is assumed. 228When altering a login shell, and not the super-user, the user 229may not change from a non-standard shell or to a non-standard 230shell. 231Non-standard is defined as a shell not found in 232.Pa /etc/shells . 233.Pp 234Once the information has been verified, 235.Nm 236uses 237.Xr pwd_mkdb 8 238to update the user database. 239.Sh ENVIRONMENT 240The 241.Xr vi 1 242editor will be used unless the environment variable 243.Ev EDITOR 244is set to 245an alternate editor. 246When the editor terminates, the information is re-read and used to 247update the user database itself. 248Only the user, or the super-user, may edit the information associated 249with the user. 250.Pp 251See 252.Xr pwd_mkdb 8 253for an explanation of the impact of setting the 254.Ev PW_SCAN_BIG_IDS 255environment variable. 256.Sh NIS INTERACTION 257The 258.Nm 259utility can also be used in conjunction with NIS, however some restrictions 260apply. 261Currently, 262.Nm 263can only make changes to the NIS passwd maps through 264.Xr rpc.yppasswdd 8 , 265which normally only permits changes to a user's password, shell and GECOS 266fields. 267Except when invoked by the super-user on the NIS master server, 268.Nm 269(and, similarly, 270.Xr passwd 1 ) 271cannot use the 272.Xr rpc.yppasswdd 8 273server to change other user information or 274add new records to the NIS passwd maps. 275Furthermore, 276.Xr rpc.yppasswdd 8 277requires password authentication before it will make any 278changes. 279The only user allowed to submit changes without supplying 280a password is the super-user on the NIS master server; all other users, 281including those with root privileges on NIS clients (and NIS slave 282servers) must enter a password. 283(The super-user on the NIS master is allowed to bypass these restrictions 284largely for convenience: a user with root access 285to the NIS master server already has the privileges required to make 286updates to the NIS maps, but editing the map source files by hand can 287be cumbersome. 288.Pp 289Note: these exceptions only apply when the NIS master server is a 290.Fx 291system). 292.Pp 293Consequently, except where noted, the following restrictions apply when 294.Nm 295is used with NIS: 296.Bl -enum -offset indent 297.It 298.Em "Only the shell and GECOS information may be changed" . 299All other 300fields are restricted, even when 301.Nm 302is invoked by the super-user. 303While support for 304changing other fields could be added, this would lead to 305compatibility problems with other NIS-capable systems. 306Even though the super-user may supply data for other fields 307while editing an entry, the extra information (other than the 308password -- see below) will be silently discarded. 309.Pp 310Exception: the super-user on the NIS master server is permitted to 311change any field. 312.Pp 313.It 314.Em "Password authentication is required" . 315The 316.Nm 317utility will prompt for the user's NIS password before effecting 318any changes. 319If the password is invalid, all changes will be 320discarded. 321.Pp 322Exception: the super-user on the NIS master server is allowed to 323submit changes without supplying a password. 324(The super-user may 325choose to turn off this feature using the 326.Fl o 327flag, described below.) 328.It 329.Em "Adding new records to the local password database is discouraged" . 330The 331.Nm 332utility will allow the administrator to add new records to the 333local password database while NIS is enabled, but this can lead to 334some confusion since the new records are appended to the end of 335the master password file, usually after the special NIS '+' entries. 336The administrator should use 337.Xr vipw 8 338to modify the local password 339file when NIS is running. 340.Pp 341The super-user on the NIS master server is permitted to add new records 342to the NIS password maps, provided the 343.Xr rpc.yppasswdd 8 344server has been started with the 345.Fl a 346flag to permitted additions (it refuses them by default). 347The 348.Nm 349utility tries to update the local password database by default; to update the 350NIS maps instead, invoke chpass with the 351.Fl y 352flag. 353.It 354.Em "Password changes are not permitted". 355Users should use 356.Xr passwd 1 357or 358.Xr yppasswd 1 359to change their NIS passwords. 360The super-user is allowed to specify 361a new password (even though the 362.Dq Password: 363field does not show 364up in the editor template, the super-user may add it back by hand), 365but even the super-user must supply the user's original password 366otherwise 367.Xr rpc.yppasswdd 8 368will refuse to update the NIS maps. 369.Pp 370Exception: the super-user on the NIS master server is permitted to 371change a user's NIS password with 372.Nm . 373.El 374.Pp 375There are also a few extra option flags that are available when 376.Nm 377is compiled with NIS support: 378.Bl -tag -width indent 379.It Fl l 380Force 381.Nm 382to modify the local copy of a user's password 383information in the even that a user exists in both 384the local and NIS databases. 385.It Fl y 386Opposite effect of 387.Fl l . 388This flag is largely redundant since 389.Nm 390operates on NIS entries by default if NIS is enabled. 391.It Fl d Ar domain 392Specify a particular NIS domain. 393The 394.Nm 395utility uses the system domain name by default, as set by the 396.Xr domainname 1 397command. 398The 399.Fl d 400option can be used to override a default, or to specify a domain 401when the system domain name is not set. 402.It Fl h Ar host 403Specify the name or address of an NIS server to query. 404Normally, 405.Nm 406will communicate with the NIS master host specified in the 407.Pa master.passwd 408or 409.Pa passwd 410maps. 411On hosts that have not been configured as NIS clients, there is 412no way for the program to determine this information unless the user 413provides the hostname of a server. 414Note that the specified hostname need 415not be that of the NIS master server; the name of any server, master or 416slave, in a given NIS domain will do. 417.Pp 418When using the 419.Fl d 420option, the hostname defaults to 421.Dq localhost . 422The 423.Fl h 424option can be used in conjunction with the 425.Fl d 426option, in which case the user-specified hostname will override 427the default. 428.Pp 429.It Fl o 430Force the use of RPC-based updates when communicating with 431.Xr rpc.yppasswdd 8 432.Pq Dq old-mode . 433When invoked by the super-user on the NIS master server, 434.Nm 435allows unrestricted changes to the NIS passwd maps using dedicated, 436non-RPC-based mechanism (in this case, a 437.Ux 438domain socket). The 439.Fl o 440flag can be used to force 441.Nm 442to use the standard update mechanism instead. 443This option is provided 444mainly for testing purposes. 445.El 446.Sh FILES 447.Bl -tag -width /etc/master.passwd -compact 448.It Pa /etc/master.passwd 449the user database 450.It Pa /etc/passwd 451a Version 7 format password file 452.It Pa /etc/chpass.XXXXXX 453temporary copy of the password file 454.It Pa /etc/shells 455the list of approved shells 456.El 457.Sh SEE ALSO 458.Xr finger 1 , 459.Xr login 1 , 460.Xr passwd 1 , 461.Xr getusershell 3 , 462.Xr login.conf 5 , 463.Xr passwd 5 , 464.Xr pwd_mkdb 8 , 465.Xr vipw 8 466.Rs 467.%A Robert Morris 468and 469.%A Ken Thompson 470.%T "UNIX Password security" 471.Re 472.Sh NOTES 473The 474.Xr chfn 1 , 475.Xr chsh 1 , 476.Xr ypchpass 1 , 477.Xr ypchfn 1 478and 479.Xr ypchsh 1 480commands are really only links to 481.Nm . 482.Sh BUGS 483User information should (and eventually will) be stored elsewhere. 484.Sh HISTORY 485The 486.Nm 487command appeared in 488.Bx 4.3 Reno . 489