1.\" Copyright (c) 1990, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)passwd.1 8.1 (Berkeley) 6/6/93 33.\" 34.Dd June 6, 1993 35.Dt PASSWD 1 36.Os BSD 4 37.Sh NAME 38.Nm passwd, yppasswd 39.Nd modify a user's password 40.Sh SYNOPSIS 41.Nm passwd 42.Op Fl l 43.Op Ar user 44.Nm yppasswd 45.Op Fl l 46.Op Fl y 47.Op Fl d Ar domain 48.Op Fl s Ar host 49.Op Fl o 50.Sh DESCRIPTION 51.Nm Passwd 52changes the user's local, Kerberos, or NIS password. First, the user is prompted for their 53current password. 54If the current password is correctly typed, a new password is 55requested. 56The new password must be entered twice to avoid typing errors. 57.Pp 58The new password should be at least six characters long (which 59may be overridden using the 60.Xr login.cap 5 61"minpasswordlen" setting for a user's login class) and not purely alphabetic. 62Its total length must be less than 63.Dv _PASSWORD_LEN 64(currently 128 characters). 65Numbers, upper case letters and meta characters 66are encouraged. 67.Pp 68Once the password has been verified, 69.Nm passwd 70communicates the new password information to 71the Kerberos authenticating host. 72.Bl -tag -width flag 73.It Fl l 74This option causes the password to be updated only in the local 75password file, and not with the Kerberos database. 76When changing only the local password, 77.Xr pwd_mkdb 8 78is used to update the password databases. 79.Pp 80.El 81When changing local or NIS password, the next password change date 82is set according to "passwordperiod" capability in the user's 83login class. 84.Pp 85To change another user's Kerberos password, one must first 86run 87.Xr kinit 1 88followed by 89.Xr passwd 1 . 90The super-user is not required to provide a user's current password 91if only the local password is modified. 92.Sh NIS INTERACTION 93.Nm Passwd 94has built-in support for NIS. If a user exists in the NIS password 95database but does not exist locally, 96.Nm passwd 97automatically switches into ``yppasswd'' mode. If the specified 98user does not exist in either the local password database of the 99NIS password maps, 100.Nm passwd 101returns an error. 102.Pp 103When changing an NIS password, unprivileged users are required to provide 104their old password for authentication (the 105.Xr rpc.yppasswdd 8 106daemon requires the original password before 107it will allow any changes to the NIS password maps). 108This restriction applies even to the 109super-user, with one important exception: the password authentication is 110bypassed for the super-user on the NIS master server. This means that 111the super-user on the NIS master server can make unrestricted changes to 112anyone's NIS password. The super-user on NIS client systems and NIS slave 113servers still needs to provide a password before the update will be processed. 114.Pp 115The following additional options are supported for use with NIS: 116.Bl -tag -width flag 117.It Fl y 118The 119.Fl y 120flag overrides 121.Nm passwd 's 122checking heuristics and forces 123it into NIS mode. 124.It Fl l 125When NIS is enabled, the 126.Fl l 127flag can be used to force 128.Nm passwd 129into ``local only'' mode. This flag can be used to change the entry 130for a local user when an NIS user exists when the same login name. 131For example, you will sometimes find entries for system ``placeholder'' 132users such as 133.Pa bin 134or 135.Pa daemon 136in both the NIS password maps and the local user database. By 137default, 138.Nm passwd 139will try to change the NIS password. The 140.Fl l 141flag can be used to change the local password instead. 142.It Fl d Ar domain 143Specify what domain to use when changing an NIS password. By default, 144.Nm passwd 145assumes that the system default domain should be used. This flag is 146primarily for use by the superuser on the NIS master server: a single 147NIS server can support multiple domains. It is also possible that the 148domainname on the NIS master may not be set (it is not necessary for 149an NIS server to also be a client) in which case the 150.Nm passwd 151command needs to be told what domain to operate on. 152.It Fl s Ar host 153Specify the name of an NIS server. This option, in conjunction 154with the 155.Fl d 156option, can be used to change an NIS password on a non-local NIS 157server. When a domain is specified with the 158.Fl d 159option and 160.Nm passwd 161is unable to determine the name of the NIS master server (possibly because 162the local domainname isn't set), the name of the NIS master is assumed to 163be ``localhost''. This can be overriden with the 164.Fl s 165flag. The specified hostname need not be the name of an NIS master: the 166name of the NIS master for a given map can be determined by querying any 167NIS server (master or slave) in a domain, so specifying the name of a 168slave server will work equally well. 169.Pp 170.It Fl o 171Do not automatically override the password authentication checks for the 172super-user on the NIS master server; assume 'old' mode instead. This 173flag is of limited practical use but is useful for testing. 174.El 175.Sh FILES 176.Bl -tag -width /etc/master.passwd -compact 177.It Pa /etc/master.passwd 178The user database 179.It Pa /etc/passwd 180A Version 7 format password file 181.It Pa /etc/passwd.XXXXXX 182Temporary copy of the password file 183.It Pa /etc/login.conf 184Login class capabilities database 185.El 186.Sh SEE ALSO 187.Xr chpass 1 , 188.Xr kerberos 1 , 189.Xr kinit 1 , 190.Xr login 1 , 191.Xr login.conf 5 , 192.Xr passwd 5 , 193.Xr kpasswdd 8 , 194.Xr pwd_mkdb 8 , 195.Xr vipw 8 196.Rs 197.%A Robert Morris 198.%A Ken Thompson 199.%T "UNIX password security" 200.Re 201.Sh NOTES 202The 203.Xr yppasswd 1 204command is really only a link to 205.Nm passwd . 206.Sh HISTORY 207A 208.Nm passwd 209command appeared in 210.At v6 . 211