Hi,
if we change a NIS password, we always need to ask for the old password, even if root tries to change it. Everything else would be a protocol violation and the server will refuse it anyways.
The following patch fixes this, ok to commit?
diff --git a/modules/pam_unix/pam_unix_passwd.c b/modules/pam_unix/pam_unix_passwd.c index 9aae3b0..b80b291 100644 --- a/modules/pam_unix/pam_unix_passwd.c +++ b/modules/pam_unix/pam_unix_passwd.c @@ -614,7 +614,8 @@ pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv)
if (_unix_blankpasswd(pamh, ctrl, user)) { return PAM_SUCCESS; - } else if (off(UNIX__IAMROOT, ctrl)) { + } else if (off(UNIX__IAMROOT, ctrl) || + _unix_comesfromsource(pamh, user, 0, on(UNIX_NIS, ctrl))) { /* instruct user what is happening */ if (asprintf(&Announce, _("Changing password for %s."), user) < 0) {