checkpass: installation arrangements

8 files changed, 65 insertions, 10 deletions

diff --git a/README b/README
index a968a8e..38e1b46 100644
--- a/README
+++ b/README
@@ -25,6 +25,7 @@ ipif		Y Y A   UC create IP interfaces/VPNs (Linux-specific)
 www-cgi		Y B A	UC provide CGIs which run as themselves
 misc/mailq	Y S S	UC list mail queue even if sendmail forbids
 misc/ndc-reload	Y S S	UC reload named after editing own zone files
+misc/checkpass* Y Y S   UC check own password; some can check any passwd
 git-daemon	Y Y Y	UC safely publish git repositories on port 9418
 newsrc-lg	X B X	Acquire list of subscribed groups from .newsrcs
 
@@ -48,7 +49,7 @@ Key to the Status:
    S	Too small to need any significant documentation.
 
 userv-utils are
-Copyright (C)1996-2010 Ian Jackson <ian@davenant.greenend.org.uk>.
+Copyright (C)1996-2013 Ian Jackson <ian@davenant.greenend.org.uk>.
 Copyright (C)1998 David Damerell <damerell@chiark.greenend.org.uk>
 Copyright (C)1999,2003
    Chancellor Masters and Scholars of the University of Cambridge
diff --git a/debian/changelog b/debian/changelog
index 11faf52..49dc8f9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,6 @@
-userv-utils (0.5.0) unstable; urgency=low
+userv-utils (0.5.0~~iwj) unstable; urgency=low
 
+  * checkpasswd-*: new service
   * www-cgi: whitelist some more HTTP headers.
   * ipif: Improve documentation comment.
   * ipif: Some portability improvements.
@@ -7,7 +8,7 @@ userv-utils (0.5.0) unstable; urgency=low
   * Pass -g to linker, by default.
   * www-cgi: clean target removes *.o.
 
- --
+ -- Ian Jackson <ian@liberator.relativity.greenend.org.uk>  Sun, 27 Jan 2013 16:34:29 +0000
 
 userv-utils (0.4.2) unstable; urgency=low
 
diff --git a/debian/control b/debian/control
index 48852b4..8b6e3e5 100644
--- a/debian/control
+++ b/debian/control
@@ -89,3 +89,4 @@ Description: miscellaneous small userv scripts
  .
  mailq - allow users to view the mail queue
  ndc-reload  - allow certain users to reload the nameserver
+ checkpasswd-* - allow users to run a UNIX password check
diff --git a/misc/Makefile b/misc/Makefile
index 0bfa61d..bdec315 100644
--- a/misc/Makefile
+++ b/misc/Makefile
@@ -24,9 +24,12 @@ include ../settings.make
 install:
 		mkdir -p $(bindir)
 		cp mailq-wrapper $(bindir)/mailq
+		mkdir -p $(sbindir)
+		cp checkpasswd-service $(sbindir)/checkpasswd-service
 
 install-examples:
 		mkdir -p $(services)
-		cp mailq ndc-reload $(services)/.
+		cp mailq ndc-reload checkpasswd-self checkpasswd-other \
+			$(services)/.
 
 install-docs:
diff --git a/misc/checkpasswd-other b/misc/checkpasswd-other
index c9a9b59..bb52b9b 100644
--- a/misc/checkpasswd-other
+++ b/misc/checkpasswd-other
@@ -5,5 +5,5 @@ if ( grep calling-user /etc/userv/checkpasswd-service-users
 	reset
 	no-set-environment
 	disconnect-hup
-	execute checkpasswd-service
+	execute checkpasswd-service /var/run/checkpasswd.synch 0.5 --
 fi
diff --git a/misc/checkpasswd-self b/misc/checkpasswd-self
index 5e3a5a5..a0daf6b 100644
--- a/misc/checkpasswd-self
+++ b/misc/checkpasswd-self
@@ -1,8 +1,10 @@
 #
-if glob service-user root
+if ( grep service /etc/userv/default-services-enabled
+   & glob service-user root
+   )
 	reset
 	no-set-environment
 	disconnect-hup
 	suppress-args
-	execute checkpasswd-service SELF
+	execute checkpasswd-service /var/run/checkpasswd.synch 0.5 -- SELF
 fi
diff --git a/misc/checkpasswd-service b/misc/checkpasswd-service
index 5418a7c..af72772 100755
--- a/misc/checkpasswd-service
+++ b/misc/checkpasswd-service
@@ -1,10 +1,57 @@
 #!/usr/bin/perl -w
+# checkpasswd-service
+# part of userv-utils
+#
+#
+# protocols:
+#
+#   userv root checkpasswd-self <<'END'
+# < PASSWORD
+# < ^D
+# > STATUS MESSAGE...
+#
+#   userv root checkpasswd-other USERNAME <<'END'
+# < PASSWORD
+# < ^D
+# > STATUS MESSAGE...
+#
+# STATUS MESSAGE may be
+#   0 ok
+#   2 incorrect password
+#   4 no such user
+#   5 password disabled
+#
+#
+# Copyright (C) 2013 Ian Jackson
+#
+# This is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with userv-utils; if not, write to the Free Software
+# Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+
 use strict;
 use IO::File;
 use Fcntl qw(:flock);
 
-die "$0: bad usage\n" unless @ARGV==1 && $ARGV[0] !~ m/^-/;
-my $username = shift @ARGV;
+my ($lockpath, $delay, $separator, $username) = @ARGV;
+
+die "$0: bad usage\n" unless
+    @ARGV == 4 ||
+    $lockpath =~ m#^/# ||
+    $delay =~ m/^[0-9.]+$/ ||
+    $separator eq '--' ||
+    $username =~ m/^\w/;
+
 $username = $ENV{'USERV_USER'} if $username eq 'SELF';
 
 sub result {
@@ -21,7 +68,6 @@ result 5, "password disabled" unless length $encrpw >= 13;
 $!=0; my $pw = <STDIN>;
 chomp $pw or die "reading password: $!\n";
 
-my $lockpath = "/var/run/checkpasswd.synch";
 my $lockf = new IO::File $lockpath, "w+" or die "open $lockpath: $!\n";
 flock($lockf, LOCK_EX) or die "lock $lockpath: $!\n";
 select(undef,undef,undef,0.5);
diff --git a/settings.make b/settings.make
index 0c4de29..22c0073 100644
--- a/settings.make
+++ b/settings.make
@@ -21,6 +21,7 @@
 etcdir=		/etc
 prefix=		/usr/local
 bindir=		$(prefix)/bin
+sbindir=	$(prefix)/sbin
 vardir=		/var
 
 libdir=		$(prefix)/lib