Use new method to change kerberos passwords.

5 files changed, 339 insertions, 308 deletions

diff --git a/usr.bin/passwd/Makefile b/usr.bin/passwd/Makefile
index aaac8e5afb8..cd4d904978d 100644
--- a/usr.bin/passwd/Makefile
+++ b/usr.bin/passwd/Makefile
@@ -1,9 +1,9 @@
-#	$OpenBSD: Makefile,v 1.15 1997/04/19 21:26:27 millert Exp $
+#	$OpenBSD: Makefile,v 1.16 1998/01/20 15:32:19 art Exp $
 
 .include <bsd.own.mk>
 
 PROG=	passwd
-SRCS=	local_passwd.c yp_passwd.c passwd.c getpwent.c pwd_gensalt.c
+SRCS=	local_passwd.c yp_passwd.c passwd.c pwd_gensalt.c new_pwd.c
 .PATH:  ${.CURDIR}/../../lib/libc/gen
 DPADD+= ${LIBRPCSVC} ${LIBUTIL}
 LDADD+= -lrpcsvc -lutil
@@ -25,13 +25,11 @@ LDADD+=	-lkrb5 -lcrypto
 SRCS+= krb_passwd.c des_rw.c
 CFLAGS+= -DKERBEROS
 DPADD+=	${LIBKRB} ${LIBDES}
-LDADD+=	-lkrb -ldes
+LDADD+=	-lkadm -lkrb -ldes -lcom_err
 .endif
 
 BINMODE=4555
-BINOWN=	root
+BINOWN=root
 
 .include <bsd.prog.mk>
 
-getpwent.o: getpwent.c
-	${COMPILE.c} -UYP ${.IMPSRC}
diff --git a/usr.bin/passwd/krb_passwd.c b/usr.bin/passwd/krb_passwd.c
index 6a5afaac089..3b19b58fa01 100644
--- a/usr.bin/passwd/krb_passwd.c
+++ b/usr.bin/passwd/krb_passwd.c
@@ -1,43 +1,30 @@
-/*	$OpenBSD: krb_passwd.c,v 1.7 1997/06/29 11:10:33 provos Exp $	*/
-
-/*-
- * Copyright (c) 1990 The Regents of the University of California.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
+/* $KTH: kpasswd.c,v 1.25 1997/05/02 14:28:51 assar Exp $ */
+
+/* 
+  Copyright (C) 1989 by the Massachusetts Institute of Technology
+
+   Export of this software from the United States of America is assumed
+   to require a specific license from the United States Government.
+   It is the responsibility of any person or organization contemplating
+   export to obtain such a license before exporting.
+
+WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+distribute this software and its documentation for any purpose and
+without fee is hereby granted, provided that the above copyright
+notice appear in all copies and that both that copyright notice and
+this permission notice appear in supporting documentation, and that
+the name of M.I.T. not be used in advertising or publicity pertaining
+to distribution of the software without specific, written prior
+permission.  M.I.T. makes no representations about the suitability of
+this software for any purpose.  It is provided "as is" without express
+or implied warranty.
+
+  */
+
+/*
+ * change your password with kerberos
  */
 
-#ifndef lint
-/*static char sccsid[] = "from: @(#)krb_passwd.c	5.4 (Berkeley) 3/1/91";*/
-static char rcsid[] = "$OpenBSD: krb_passwd.c,v 1.7 1997/06/29 11:10:33 provos Exp $";
-#endif /* not lint */
-
 #ifdef KERBEROS
 
 #include <sys/types.h>
@@ -47,268 +34,151 @@ static char rcsid[] = "$OpenBSD: krb_passwd.c,v 1.7 1997/06/29 11:10:33 provos E
 #include <netinet/in.h>
 #include <des.h>
 #include <kerberosIV/krb.h>
+#include <kerberosIV/kadm.h>
+#include <kerberosIV/kadm_err.h>
 #include <netdb.h>
 #include <signal.h>
 #include <pwd.h>
 #include <err.h>
 #include <errno.h>
 #include <stdio.h>
-#include "kpasswd_proto.h"
 #include <string.h>
 #include <stdlib.h>
 #include <unistd.h>
 
-#define	PROTO	"tcp"
-
-static struct timeval timeout = { CLIENT_KRB_TIMEOUT, 0 };
-static struct kpasswd_data proto_data;
-static des_cblock okey;
-static Key_schedule osched;
-KTEXT_ST ticket;
-Key_schedule random_schedule;
-long authopts;
-char realm[REALM_SZ], krbhst[MAX_HSTNM];
-int sock;
-
-krb_passwd()
-{
-	struct servent *se;
-	struct hostent *host;
-	struct sockaddr_in sin;
-	CREDENTIALS cred;
-	int fdsn;
-	fd_set *fdsp;
-	int rval;
-	char pass[_PASSWORD_LEN], password[_PASSWORD_LEN];
-	static void finish();
-
-	static struct rlimit rl = { 0, 0 };
-
-	(void)signal(SIGHUP, SIG_IGN);
-	(void)signal(SIGINT, SIG_IGN);
-	(void)signal(SIGTSTP, SIG_IGN);
-
-	if (setrlimit(RLIMIT_CORE, &rl) < 0) {
-		warn("setrlimit");
-		return(1);
-	}
-
-	if ((se = getservbyname(SERVICE, PROTO)) == NULL) {
-		warnx("couldn't find entry for service %s/%s", SERVICE, PROTO);
-		return(1);
-	}
-
-	if ((rval = krb_get_lrealm(realm,1)) != KSUCCESS) {
-		warnx("couldn't get local Kerberos realm: %s", krb_err_txt[rval]);
-		return(1);
-	}
-
-	if ((rval = krb_get_krbhst(krbhst, realm, 1)) != KSUCCESS) {
-		warnx("couldn't get Kerberos host: %s", krb_err_txt[rval]);
-		return(1);
-	}
-
-	if ((host = gethostbyname(krbhst)) == NULL) {
-		warnx("couldn't get host entry for krb host %s", krbhst);
-		return(1);
-	}
-
-	sin.sin_family = host->h_addrtype;
-	bcopy(host->h_addr, (char *) &sin.sin_addr, host->h_length);
-	sin.sin_port = se->s_port;
-
-	if ((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) {
-		warn("socket");
-		return(1);
-	}
-
-	if (connect(sock, (struct sockaddr *) &sin, sizeof(sin)) < 0) {
-		warn("connect");
-		(void)close(sock);
-		return(1);
-	}
-
-	rval = krb_sendauth(
-		authopts,		/* NOT mutual */
-		sock,
-		&ticket,		/* (filled in) */
-		SERVICE,
-		krbhst,			/* instance (krbhst) */
-		realm,			/* dest realm */
-		(u_long) getpid(),	/* checksum */
-		NULL,			/* msg data */
-		NULL,			/* credentials */ 
-		NULL,			/* schedule */
-		NULL,			/* local addr */
-		NULL,			/* foreign addr */
-		"KPWDV0.1"
-	);
-
-	if (rval != KSUCCESS) {
-		warnx("Kerberos sendauth error: %s", krb_err_txt[rval]);
-		return(1);
-	}
-
-	krb_get_cred("krbtgt", realm, realm, &cred);
+char realm[REALM_SZ];
 
-	(void)printf("Changing Kerberos password for %s.%s@%s.\n",
-	    cred.pname, cred.pinst, realm);
-
-	if (des_read_pw_string(pass,
-	    sizeof(pass)-1, "Old Kerberos password:", 0)) {
-		warnx("error reading old Kerberos password");
-		return(1);
-	}
-
-	(void)des_string_to_key(pass, &okey);
-	(void)des_key_sched(&okey, osched);
-	(void)desrw_set_key(&okey, osched);
-
-	/* wait on the verification string */
-
-	fdsn = howmany(sock+1, NFDBITS) * sizeof(fd_mask);
-	if ((fdsp = (fd_set *)malloc(fdsn)) == NULL)
-		err(1, "malloc");
-	memset(fdsp, 0, fdsn);
-	FD_SET(sock, fdsp);
-
-	rval =
-	    select(sock + 1, fdsp, (fd_set *) 0, (fd_set *) 0, &timeout);
-
-	if ((rval < 1) || !FD_ISSET(sock, fdsp)) {
-		free(fdsp);
-		if(rval == 0) {
-			warnx("timed out (aborted)");
-			cleanup();
-			return(1);
-		}
-		warnx("select failed (aborted)");
-		cleanup();
-		return(1);
-	}
-	free(fdsp);
-
-	/* read verification string */
-
-	if (des_read(sock, &proto_data, sizeof(proto_data)) !=
-	    sizeof(proto_data)) {
-		warnx("couldn't read verification string (aborted)");
-		cleanup();
-		return(1);
-	}
-
-	(void)signal(SIGHUP, finish);
-	(void)signal(SIGINT, finish);
-
-	if (strcmp(SECURE_STRING, proto_data.secure_msg) != 0) {
-		cleanup();
-		/* don't complain loud if user just hit return */
-		if (pass == NULL || (!*pass))
-			return(0);
-		warnx("Sorry");
-		return(1);
-	}
-
-	(void)des_key_sched(&proto_data.random_key, random_schedule);
-	(void)desrw_set_key(&proto_data.random_key, random_schedule);
-	(void)bzero(pass, sizeof(pass));
-
-	if (des_read_pw_string(pass,
-	    sizeof(pass)-1, "New Kerberos password:", 0)) {
-		warnx("error reading new Kerberos password (aborted)");
-		cleanup();
-		return(1);
-	}
-
-	if (des_read_pw_string(password,
-	    sizeof(password)-1, "Retype new Kerberos password:", 0)) {
-		warnx("error reading new Kerberos password (aborted)");
-		cleanup();
-		return(1);
-	}
-
-	if (strcmp(password, pass) != 0) {
-		warnx("password mismatch (aborted)");
-		cleanup();
-		return(1);
-	}
-
-	if (strlen(pass) == 0)
-		(void)printf("using NULL password\n");
-
-	send_update(sock, password, SECURE_STRING);
-
-	/* wait for ACK */
-
-	fdsn = howmany(sock+1, NFDBITS) * sizeof(fd_mask);
-	if ((fdsp = (fd_set *)malloc(fdsn)) == NULL)
-		err(1, "malloc");
-	memset(fdsp, 0, fdsn);
-	FD_SET(sock, fdsp);
-
-	rval =
-	    select(sock + 1, fdsp, (fd_set *) 0, (fd_set *) 0, &timeout);
-	if ((rval < 1) || !FD_ISSET(sock, fdsp)) {
-		free(fdsp);
-		if(rval == 0) {
-			warnx("timed out reading ACK (aborted)");
-			cleanup();
-			exit(1);
-		}
-		warnx("select failed (aborted)");
-		cleanup();
-		exit(1);
-	}
-	free(fdsp);
-	recv_ack(sock);
-	cleanup();
-	exit(0);
-}
-
-send_update(dest, pwd, str)
-	int dest;
-	char *pwd, *str;
-{
-	static struct update_data ud;
-
-	(void)strncpy(ud.secure_msg, str, _PASSWORD_LEN);
-	(void)strncpy(ud.pw, pwd, sizeof(ud.pw));
-	if (des_write(dest, &ud, sizeof(ud)) != sizeof(ud)) {
-		warnx("couldn't write pw update (abort)");
-		bzero((char *)&ud, sizeof(ud));
-		cleanup();
-		exit(1);
-	}
-}
-
-recv_ack(remote)
-	int remote;
-{
-	int cc;
-	char buf[BUFSIZ];
-
-	cc = des_read(remote, buf, sizeof(buf));
-	if (cc <= 0) {
-		warnx("error reading acknowledgement (aborted)");
-		cleanup();
-		exit(1);
-	}
-	(void)printf("%s", buf);
-}
-
-cleanup()
-{
-	(void)bzero((char *)&proto_data, sizeof(proto_data));
-	(void)bzero((char *)okey, sizeof(okey));
-	(void)bzero((char *)osched, sizeof(osched));
-	(void)bzero((char *)random_schedule, sizeof(random_schedule));
-}
+extern void usage(int value);
 
-static void
-finish()
+int
+krb_passwd(int argc, char **argv)
 {
-	(void)close(sock);
+    krb_principal principal;
+    krb_principal default_principal;
+    int realm_given = 0;	/* True if realm was give on cmdline */
+    int use_default = 1;	/* True if we should use default name */
+    int status;			/* return code */
+    char pword[MAX_KPW_LEN];
+    int c;
+    char tktstring[MAXPATHLEN];
+    
+    memset (&principal, 0, sizeof(principal));
+    memset (&default_principal, 0, sizeof(default_principal));
+    
+    krb_get_default_principal (default_principal.name,
+			       default_principal.instance,
+			       default_principal.realm);
+
+    while ((c = getopt(argc, argv, "u:n:i:r:h")) != EOF) {
+	switch (c) {
+	case 'u':
+	    status = krb_parse_name (optarg, &principal);
+	    if (status != KSUCCESS)
+		errx (2, "%s", krb_get_err_text(status));
+	    if (principal.realm[0])
+		realm_given++;
+	    else if (krb_get_lrealm(principal.realm, 1) != KSUCCESS)
+		errx (1, "Could not find default realm!");
+	    break;
+	case 'n':
+	    if (k_isname(optarg))
+		strncpy(principal.name, optarg, sizeof(principal.name) - 1);
+	    else {
+		warnx("Bad name: %s", optarg);
+		usage(1);
+	    }
+	    break;
+	case 'i':
+	    if (k_isinst(optarg))
+		strncpy(principal.instance,
+			optarg,
+			sizeof(principal.instance) - 1);
+	    else {
+		warnx("Bad instance: %s", optarg);
+		usage(1);
+	    }
+	    break;
+	case 'r':
+	    if (k_isrealm(optarg)) {
+		strncpy(principal.realm, optarg, sizeof(principal.realm) - 1);
+		realm_given++; 
+	    } else {
+		warnx("Bad realm: %s", optarg);
+		usage(1);
+	    }
+	    break;
+	case 'h':
+	    usage(0);
+	    break;
+	default:
+	    usage(1);
+	    break;
+	}
+	use_default = 0;
+    }
+    if (optind < argc) {
+	use_default = 0;
+	status = krb_parse_name (argv[optind], &principal);
+	if(status != KSUCCESS)
+	    errx (1, "%s", krb_get_err_text (status));
+    }
+
+    if (use_default) {
+	strncpy(principal.name, default_principal.name, ANAME_SZ - 1);
+	principal.name[ANAME_SZ - 1] = '\0';
+	strncpy(principal.instance, default_principal.instance, INST_SZ - 1);
+	principal.instance[INST_SZ - 1] = '\0';
+	strncpy(principal.realm, default_principal.realm, REALM_SZ - 1);
+	principal.realm[REALM_SZ - 1] = '\0';
+    } else {
+	if (!principal.name[0]) {
+	    strncpy(principal.name, default_principal.name, ANAME_SZ - 1);
+	    principal.name[ANAME_SZ - 1] = '\0';
+	}
+	if (!principal.realm[0]) {
+	    strncpy(principal.realm, default_principal.realm, REALM_SZ - 1);
+	    principal.realm[REALM_SZ - 1] = '\0';
+	}
+    }
+
+    snprintf(tktstring, sizeof(tktstring),
+	     TKT_ROOT "_cpw_%u", (unsigned)getpid());
+    krb_set_tkt_string(tktstring);
+    
+    if (get_pw_new_pwd(pword, sizeof(pword), &principal,
+		       realm_given)) {
+	dest_tkt ();
 	exit(1);
+    }
+    
+    status = kadm_init_link (PWSERV_NAME, KRB_MASTER, principal.realm);
+    if (status != KADM_SUCCESS) 
+	com_err(argv[0], status, "while initializing");
+    else {
+	des_cblock newkey;
+	char *pw_msg; /* message from server */
+
+	des_string_to_key(pword, &newkey);
+	status = kadm_change_pw_plain((unsigned char*)&newkey, pword, &pw_msg);
+	memset(newkey, 0, sizeof(newkey));
+      
+	if (status == KADM_INSECURE_PW)
+	    warnx ("Insecure password: %s", pw_msg);
+	else if (status != KADM_SUCCESS)
+	    com_err(argv[0], status, " attempting to change password.");
+    }
+    memset(pword, 0, sizeof(pword));
+
+    if (status != KADM_SUCCESS)
+	fprintf(stderr,"Password NOT changed.\n");
+    else
+	printf("Password changed.\n");
+
+    dest_tkt();
+    if (status)
+	return 2;
+    else 
+	return 0;
 }
 
 #endif /* KERBEROS */
diff --git a/usr.bin/passwd/new_pwd.c b/usr.bin/passwd/new_pwd.c
new file mode 100644
index 00000000000..0ce5177a4e2
--- /dev/null
+++ b/usr.bin/passwd/new_pwd.c
@@ -0,0 +1,156 @@
+/* $KTH: new_pwd.c,v 1.11 1997/05/02 14:28:54 assar Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/resource.h>
+#include <netinet/in.h>
+#include <des.h>
+#include <kerberosIV/krb.h>
+#include <kerberosIV/kadm.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#ifdef NOENCRYPTION
+#define read_long_pw_string placebo_read_pw_string
+#else
+#define read_long_pw_string des_read_pw_string
+#endif
+
+static char *
+check_pw (char *pword)
+{
+    if (strlen(pword) == 0)
+	return "Null passwords are not allowed - Please enter a longer password.";
+    
+    if (strlen(pword) < MIN_KPW_LEN)
+	return "Password is to short - Please enter a longer password.";
+    
+    /* Don't allow all lower case passwords regardless of length */
+    {
+	char *t;
+	for (t = pword; *t && islower(*t); t++)
+	    ;
+	if (*t == 0)
+	    return "Please don't use an all-lower case password.\n"
+	      "\tUnusual capitalization, delimiter characters or "
+	      "digits are suggested.";
+    }
+
+    return NULL;
+}
+
+int
+get_pw_new_pwd(char *pword, int pwlen, krb_principal *pr, int print_realm)
+{
+    char ppromp[40+ANAME_SZ+INST_SZ+REALM_SZ]; /* for the password prompt */
+    char npromp[40+ANAME_SZ+INST_SZ+REALM_SZ]; /* for the password prompt */
+    
+    char p[MAX_K_NAME_SZ];
+    
+    char local_realm[REALM_SZ];
+    int status;
+    char *expl;
+    
+    /*
+     * We don't care about failure; this is to determine whether or
+     * not to print the realm in the prompt for a new password. 
+     */
+    krb_get_lrealm(local_realm, 1);
+    
+    if (strcmp(local_realm, pr->realm))
+	print_realm++;
+    
+    {
+	char *q;
+	krb_unparse_name_r(pr, p);
+	if(print_realm == 0 && (q = strrchr(p, '@')))
+	    *q = 0;
+    }
+
+    snprintf(ppromp, sizeof(ppromp), "Old password for %s:", p);
+    if (read_long_pw_string(pword, pwlen-1, ppromp, 0)) {
+	fprintf(stderr, "Error reading old password.\n");
+	return -1;
+    }
+
+    status = krb_get_pw_in_tkt(pr->name, pr->instance, pr->realm, 
+			       PWSERV_NAME, KADM_SINST, 1, pword);
+    if (status != KSUCCESS) {
+	if (status == INTK_BADPW) {
+	    printf("Incorrect old password.\n");
+	    return -1;
+	}
+	else {
+	    fprintf(stderr, "Kerberos error: %s\n", krb_get_err_text(status));
+	    return -1;
+	}
+    }
+    memset(pword, 0, pwlen);
+
+    do {
+	char verify[MAX_KPW_LEN];
+	snprintf(npromp, sizeof(npromp), "New Password for %s:",p);
+	if (read_long_pw_string(pword, pwlen-1, npromp, 0)) {
+	    fprintf(stderr,
+		    "Error reading new password, password unchanged.\n");
+	    return -1;
+        }
+	expl = check_pw (pword);
+	if (expl) {
+	    printf("\n\t%s\n\n", expl);
+	    continue;
+	}
+	/* Now we got an ok password, verify it. */
+	snprintf(npromp, sizeof(npromp), "Verifying New Password for %s:", p);
+	if (read_long_pw_string(verify, MAX_KPW_LEN-1, npromp, 0)) {
+	    fprintf(stderr,
+		    "Error reading new password, password unchanged.\n");
+	    return -1;
+        }
+	if (strcmp(pword, verify) != 0) {
+	    printf("Verify failure - try again\n");
+	    expl = "";		/* continue */
+	}
+    } while (expl);
+    return 0;
+}
diff --git a/usr.bin/passwd/passwd.1 b/usr.bin/passwd/passwd.1
index 641ff69e3c4..b1fb1ea2932 100644
--- a/usr.bin/passwd/passwd.1
+++ b/usr.bin/passwd/passwd.1
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: passwd.1,v 1.4 1997/02/25 18:19:35 provos Exp $
+.\"	$OpenBSD: passwd.1,v 1.5 1998/01/20 15:32:20 art Exp $
 .\" Copyright (c) 1990 The Regents of the University of California.
 .\" All rights reserved.
 .\"
@@ -41,9 +41,14 @@
 .Sh SYNOPSIS
 .Nm passwd
 .Op Fl l
-.Op Fl k
 .Op Fl y
+.Op Fl k
+.Op Fl n Ar name
+.Op Fl i Ar instance
+.Op Fl r Ar realm
+.Op Fl u Ar username[.instance][@realm]
 .Op Ar user
+.\" This should really be: passwd [-l] [-y] [-k [-n name] [-i instance] [-r realm] [-u username[.instance][@realm]]] [user]
 .Sh DESCRIPTION
 .Nm Passwd
 changes the user's local, Kerberos, or YP password.  First, the user is prompted
diff --git a/usr.bin/passwd/passwd.c b/usr.bin/passwd/passwd.c
index 83fa90c9f49..570f265e4aa 100644
--- a/usr.bin/passwd/passwd.c
+++ b/usr.bin/passwd/passwd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: passwd.c,v 1.6 1997/03/27 00:30:54 weingart Exp $	*/
+/*	$OpenBSD: passwd.c,v 1.7 1998/01/20 15:32:21 art Exp $	*/
 
 /*
  * Copyright (c) 1988 The Regents of the University of California.
@@ -41,7 +41,7 @@ char copyright[] =
 
 #ifndef lint
 /*static char sccsid[] = "from: @(#)passwd.c	5.5 (Berkeley) 7/6/91";*/
-static char rcsid[] = "$OpenBSD: passwd.c,v 1.6 1997/03/27 00:30:54 weingart Exp $";
+static char rcsid[] = "$OpenBSD: passwd.c,v 1.7 1998/01/20 15:32:21 art Exp $";
 #endif /* not lint */
 
 #include <stdio.h>
@@ -68,7 +68,7 @@ int force_yp;
 
 extern int local_passwd(char *);
 extern int yp_passwd(char *);
-extern int krb_passwd(void);
+extern int krb_passwd(int, char **);
 void usage(void);
 
 
@@ -92,7 +92,7 @@ main(argc, argv)
 #endif
 
 	/* Process args and options */
-	while ((ch = getopt(argc, argv, "lky")) != -1)
+	while ((ch = getopt(argc, argv, "lyk")) != -1)
 		switch (ch) {
 		case 'l':		/* change local password file */
 			use_kerberos = 0;
@@ -102,6 +102,7 @@ main(argc, argv)
 #if defined(KERBEROS) || defined(KERBEROS5)
 			use_kerberos = 1;
 			use_yp = 0;
+			exit(krb_passwd(argc, argv));
 			break;
 #else
 			fprintf(stderr, "passwd: Kerberos not compiled in\n");
@@ -140,13 +141,13 @@ main(argc, argv)
 		break;
 	case 1:
 #if defined(KERBEROS) || defined(KERBEROS5)
-		if (use_kerberos && strcmp(argv[0], username)) {
-			(void)fprintf(stderr, "passwd: %s\n\t%s\n%s\n",
-"to change another user's Kerberos password, do",
-"\"kinit <user>; passwd; kdestroy\";",
-"to change a user's local passwd, use \"passwd -l <user>\"");
-			exit(1);
-		}
+	    if (use_kerberos && strcmp(argv[0], username)) {
+		(void)fprintf(stderr, "passwd: %s\n\t%s\n%s\n",
+			      "to change another user's Kerberos password, do",
+			      "\"passwd -k -u <user>\";",
+			      "to change a user's local passwd, use \"passwd -l <user>\"");
+		exit(1);
+	    }
 #endif
 		username = argv[0];
 		break;
@@ -156,9 +157,10 @@ main(argc, argv)
 	}
 
 #if defined(KERBEROS) || defined(KERBEROS5)
-	if (use_kerberos)
-		exit(krb_passwd());
+        if (use_kerberos)
+                exit(krb_passwd(argc, argv));
 #endif
+
 #ifdef	YP
 	if (force_yp || ((status = local_passwd(username)) && use_yp))
 		exit(yp_passwd(username));
@@ -170,5 +172,5 @@ main(argc, argv)
 void
 usage(void)
 {
-	fprintf(stderr, "usage: passwd [-l] [-k] [-y] user\n");
+	fprintf(stderr, "usage: passwd [-l] [-y] [-k [-n name] [-i instance] [-r realm] [-u username[.instance][@realm]] [user]\n");
 }