Using Network Information Service (NIS)

Setting the NIS Domain Name

The NIS domain name identifies the group of computers that a particular NIS server supports. You can set the NIS domain name of your system by using the domainname command. For example, to set your NIS domain name to admin, log in as root, and type the following at the shell prompt:

domainname admin

If you type domainname without any arguments, the command prints the current NIS domain name.

Secret

To ensure that the NIS domain name is set as soon as your system boots, the command should be run from one of the startup scripts. You can do this by adding the following line to the /etc/sysconfig/network file on your Red Hat Linux system:

NISDOMAIN="admin"

Of course, you should use the NIS domain name appropriate to your network.

The NIS domain is different from the DNS domain names discussed earlier in this chapter. It's best if you pick an NIS domain name that's not related to the DNS domain name. Doing so makes it harder for crackers to guess your NIS domain name (if they know the NIS domain name, there is a risk that they can get the NIS password database).

Preparing the /etc/yp.conf File

The ypbind daemon, described in the next section, needs information about the NIS domains and NIS servers to do its job. It finds this information in the /etc/yp.conf configuration file. The ypbind daemon reads the /etc/yp.conf file when it starts up or when it receives the SIGHUP signal (for example, when you restart ypbind with the command kill -HUP ypbind).

To specify one or more NIS servers for the local domain (which you have already set with the domainname command), all you need in /etc/yp.conf are lines such as the following:

ypserver nisadmin
ypserver 192.168.0.7

You can use a name such as nisadmin if that name is listed in the /etc/hosts file (that way, ypbind can resolve the name into an IP address without having to use NIS). Otherwise, you should specify the NIS server's IP address.

In /etc/yp.conf, you can also specify specific NIS servers for specific NIS domains, like this:

domain sales server nissales
domain admin server nisadmin

A third type of entry in the /etc/yp.conf file specifies that ypbind should use IP broadcast in the local network to find an NIS server for a specified domain. To do this, add a line such as the following to /etc/yp.conf:

domain admin broadcast 

Configuring the ypbind Daemon

Every computer in an NIS domain, including the server, runs the ypbind daemon. Various NIS client applications, such as ypwhich, ypcat, and yppoll, need the ypbind daemon to obtain information from the master NIS server. More precisely, the C library contacts the ypbind daemon to locate the NIS server for the domain. Then the C library contacts the server directly to obtain administrative information. The client applications get the information through functions in the C library.

To interactively start ypbind, log in as root and type the following command:

service ypbind start

If you want ypbind to start when the system boots, log in as root and type the following command to turn ypbind on:

chkconfig --add ypbind
chkconfig --level 35 ypbind on

Creating the NIS Maps

Creating NIS maps involves converting the text files, such as /etc/passwd and /etc/group into DBM files by using makedbm. The map creation is controlled by /var/yp/Makefile, a file that can be used by the make command to perform specific tasks (see Chapter 23 for more information on make and Makefile).

You can configure what you want the NIS server to share with the clients in the NIS domain. You do so by editing the Makefile in the /var/yp directory. Open /var/yp/Makefile in a text editor, and locate the line that begins with all:. Here is a typical excerpt from the Makefile showing the comments before the all: line:

# If you don't want some of these maps built, feel free to comment
# them out from this list.

all:  passwd group hosts rpc services netid protocols mail \
      # netgrp shadow publickey networks ethers bootparams printcap \
      # amd.home auto.master auto.home auto.local passwd.adjunct \
      # timezone locale netmasks

As the comment lines (the ones that begin with #) indicate, you can comment out any maps you do not want to build. In the preceding example, the maps listed in the last three lines will not be built.

Next, you should edit the /var/yp/securenets file to specify the IP addresses of client computers that can access the NIS maps. The default file has the following lines:

# securenets    This file defines the access rights to your NIS server
#               for NIS clients. This file contains netmask/network
#               pairs. A clients IP address needs to match with at 
#               least one of those.
#
#               One can use the word "host" instead of a netmask of
#               255.255.255.255. Only IP addresses are allowed in this
#               file, not hostnames.
#
# Always allow access for localhost
255.0.0.0       127.0.0.0

# This line gives access to everybody. PLEASE ADJUST!
0.0.0.0         0.0.0.0  

As the last comment line shows, the default configuration grants access to all IP addresses. For example, to limit access to the class C network 192.168.0.0, change the last line as follows:

255.255.255.0     192.168.0.0

This allows only those computers on the local network with IP addresses in the range 192.168.0.1 through 192.168.0.254 access to the NIS maps.

Next, you should generate the NIS map database by running the /usr/lib/yp/ypinit program with the -m option. Here is a sample session with that program:

/usr/lib/yp/ypinit -m
At this point, we have to construct a list of the hosts which will run NIS
servers.  lnbp200 is in the list of NIS server hosts.  Please continue to add
the names for the other hosts, one per line.  When you are done with the
list, type a <control D>.
        next host to add:  lnbp200
        next host to add: <Press Ctrl-D here>
The current list of NIS servers looks like this:

lnbp200

Is this correct?  [y/n: y]  y
We need some  minutes to build the databases...
Building /var/yp/admin/ypservers...
Running /var/yp/Makefile...
gmake[1]: Entering directory `/var/yp/admin'
Updating passwd.byname...
Updating passwd.byuid...
...lines deleted...

The /usr/lib/yp/ypinit program automatically selects your host as an NIS server and prompts for the names of any other NIS servers. You can add the server names one at a time and press Ctrl-D when you are done. Then, you have to verify that the list of NIS servers is correct (type y). After that, make runs with the /var/yp/Makefile and generates the NIS maps as specified by the all: line in the Makefile. The map files are stored in a subdirectory of /var/yp that has the same name as the NIS domain name you have previously set for your system. For example, for the NIS domain admin, the map files are in the /var/yp/admin directory.

Configuring the Master NIS Server

To configure the NIS server daemon, ypserv, you have to prepare the configuration file /etc/ypserv.conf. You can learn about the syntax of this file by reading its man page, which you can access by typing the command man ypserv.conf. Among other options, you can use the following option to specify that DNS should not be used to look up hostnames that are not in the maps of the /etc/hosts file:

dns: no

You can also add other lines in /etc/ypserv.conf that specify access rules-which hosts can access which maps. The format of the access rules is as follows:

Host : Map : Security : mangle [: field_to_mangle]

The field_to_mangle is optional; it indicates which field in the map file should be mangled (the default is the second field because the password is in the second field of most files, such as /etc/passwd). To mangle a field is to replace it with an x if the request comes from an unprivileged host. The rest of the fields have the following meanings:

• Host-IP address or a wildcard (*) indicating to whom the rule applies

• Map-Name of the map to which the rule applies (the names of the maps are the same as those of the map files in the /var/yp/domainname directory, where domainname is your NIS domain name)

• Security-One of the following: none (to allow access always), port (to access from a port less than 1024), deny (to deny access to the map), or des (to require DES authentication-this may not be supported by all C libraries)

• mangle-One of the following: yes (the field specified by field_to_mangle should be replaced by an x if the request is from unauthorized host) or no (do not mangle)

For example, the following lines in the /etc/ypserv.conf file restrict access to the password map to systems in the 192.168.0 network:

192.168.0    :    passwd.byname    : port       : yes
192.168.0    :    passwd.byuid     : port       : yes

If you do not specify any access rules, ypserv allows all computers to access all maps.

Once you have set up the /etc/ypserv.conf file, you can start the NIS server with the following command:

service ypserv start

chkconfig --level 35 ypserv on

Secret

To handle password changes from clients, you must also run the rpc.yppasswdd server on the master NIS server for the domain. The rpc.yppasswdd server enables users on client systems to type the yppasswd command and change their password in the NIS database. If you do not have the rpc.yppasswdd server running on the master NIS server, users will get the following error message when they type the yppasswd command:

yppasswd: yppasswdd not running on NIS master host

You can correct this problem by starting rpc.yppasswdd; log in as root, and type the command:

service yppasswdd start

To start yppasswd automatically at run levels 3 and 5, type:

chkconfig --level 35 yppasswdd on

Once you have the master NIS server up and running, you can test it by using various NIS client programs, such as ypwhich, yppoll, ypcat, and ypmatch.

Configuring a Slave NIS Server

To set up a system as a slave NIS server, first set it up as an NIS client and verify that the client works. In particular, type ypwhich -m and look for a list of NIS maps and the name of the master NIS server for each map (the next section shows how the ypwhich -m command works).

After you confirm that the system is configured as an NIS client, type the following command to set up the system as a slave NIS server:

/usr/lib/yp/ypinit -s nismaster

where nismaster is the name of the master NIS server for the domain.