diff --git a/yp-tools-2.11-shadow.patch b/yp-tools-2.11-shadow.patch
new file mode 100644
index 0000000..1813ac4
--- /dev/null
+++ b/yp-tools-2.11-shadow.patch
@@ -0,0 +1,11 @@
+diff -up yp-tools-2.11/src/yppasswd.c.shadow yp-tools-2.11/src/yppasswd.c
+--- yp-tools-2.11/src/yppasswd.c.shadow	2010-04-20 15:31:59.000000000 +0200
++++ yp-tools-2.11/src/yppasswd.c	2010-11-19 18:37:14.931766315 +0100
+@@ -449,6 +449,7 @@ verifypassword (struct passwd *pwd, char
+ 
+   passwdlen = get_passwd_len (pwd->pw_passwd);
+   if (pwd->pw_passwd[0]
++      && 0 != strcmp (pwd->pw_passwd, "x") /* don't check shadow passwords */
+       && !strncmp (pwd->pw_passwd, crypt (pwdstr, pwd->pw_passwd), passwdlen)
+       && uid)
+     {
diff --git a/yp-tools.spec b/yp-tools.spec
index 2a50ab8..5838937 100644
--- a/yp-tools.spec
+++ b/yp-tools.spec
@@ -1,10 +1,11 @@
 Summary: NIS (or YP) client programs
 Name: yp-tools
 Version: 2.11
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPLv2
 Group: System Environment/Base
 Source: ftp://ftp.kernel.org/pub/linux/utils/net/NIS/yp-tools-%{version}.tar.bz2
+Patch0: yp-tools-2.11-shadow.patch
 Url: http://www.linux-nis.org/nis/yp-tools/index.html
 Requires: ypbind
 
@@ -30,6 +31,7 @@ you'll need to install the ypserv package on one machine on the network.
 
 %prep
 %setup -q
+%patch0 -p1 -b .shadow
 
 %build
 %configure --disable-domainname
@@ -41,9 +43,6 @@ make DESTDIR="$RPM_BUILD_ROOT" INSTALL_PROGRAM=install install
 
 %find_lang %name
 
-%clean
-rm -rf $RPM_BUILD_ROOT
-
 %files -f %{name}.lang
 %defattr(-,root,root,-)
 %doc AUTHORS COPYING README ChangeLog NEWS etc/nsswitch.conf
@@ -54,13 +53,18 @@ rm -rf $RPM_BUILD_ROOT
 /var/yp/nicknames
 
 %changelog
+* Fri Nov 19 2010 Karel Klic <kklic@redhat.com> - 2.11-2
+- Added patch to fix yppasswd utility when used with shadow
+  passwords (rhbz#653921)
+- Removed %%clean section
+
 * Tue Apr 20 2010 Karel Klic <kklic@redhat.com> - 2.11-1
 - New upstream release
 - MD5, SHA-2 passwords patch merged by upstream
 - Removed BuildRoot tag
 
 * Thu Apr 15 2010 Karel Klic <kklic@redhat.com> - 2.10-3
-- Added a new patch -passwords, which merges -md5 and -sha-2 patches 
+- Added a new patch -passwords, which merges -md5 and -sha-2 patches
   together, and adds proper MD5/SHA support to verifypassword()
   #514061