Cannot login after yp binding OpenBSD 5.7

[chipc]

Hi,

I've got an OpenBSD 5.7 system which seems to be correctly bound to a yp domain, but which is not authenticating users in the yp passwd map.

The server is a Solaris 5.10 machine with scores of Solaris (various versions), Linux and OS X yp clients. I had no trouble binding and using a FreeBSD machine a few weeks ago.

I'm sure OpenBSD is bound correctly: ypwhich returms the name of my yp master; "ypcat passwd" shows the correct full passwd map, and "id username" shows correct information for users in the yp map.

But those users cannot log in, either at the login prompt or via "su -".

/etc/login.conf says:
default:\
...
:ypcipher=old:\
...

I've tried it with "md5" with no change. The server is at the Solaris default setting of "__UNIX__" in policy.conf, referring to the "traditional Unix algorithm", which I'm assuming is what OpenBSD calls "old".

/etc/master.passwd ends in
+:*::::::::
and /etc/passwd in
+:*:0:0:::

What am I missing?

Thanks,

Chip
Toronto

[jggimi]

Hello, and welcome!

I don't use YP, but I know there are OpenBSD-specific considerations, such as enabling the portmapper and the ypbind(8) daemon. FAQ 10.19.4 discusses provisioning a YP client.

[jggimi]

I have a follow-up for you, regarding cipher choices. Raimo Niskanen had posted a query to the OpenBSD misc@ mailing list within the last two hours:

http://marc.info/?l=openbsd-misc&m=144482694314182&w=2

He posted a follow-up, which at this time does not appear in the archives at marc.info or at gmane.org, so I have reproduced it below.

Some answers from myself after experimenting and finding Wikipedia :/

On Wed, Oct 14, 2015 at 02:36:09PM +0200, Raimo Niskanen wrote:
> Hi misc@
> 
> I just found out that ypcipher=old is no longer supported in login.conf.
> 
> Since I have a mixed platform lab network using YP (FreeBSD servers) I am
> curious if anyone has some experience of how portable blowfish is as a
> cipher for YP passwords.
> 
> FreeBSD man pages say that they support it.  I also have lots of old and new
> linux clients and just a few OpenBSD clients in the network.  Linux as usual
> shines being badly documented so I can not find out if any of those support
> blowfish.  Therefore I ask this list if anyone knows about this?  

FreeBSD and OpenBSD have Blowfish in common.
FreeBSD and recent Linux'es have SHA-2 (SHA-256 and SHA-512) in common.

[jggimi]

And, Theo de Raadt has weighed in to answer the remaining questions.

http://marc.info/?t=144482709800003&r=1&w=2

[chipc]

Hah! That's it. I'll have to kludge around it with a local user account for myself.

Thanks for finding this!

Chip