NIS

• Developed by Sun Microsystems to share common data
• usernames, groups, hostnames, automount maps, etc
• Originally called YP but this bothered the phone company ;)
• A distributed database service
• Allows for central management of configuration files
• Configuration files are maintained on a single computer and distributed to the rest of the computers on the network


Example:

• The passwd file is maintained on the NIS server
• user accounts must be modified and added on the NIS server




http://www.hgc.ims.u-tokyo.ac.jp/announce/systems/manual/HITACHI/manual/8x203506/m0120058.htm

• File to be converted to NIS database
• /etc/passwd, /etc/group, /etc/hosts....
• Createusers shell script
• Createhosts shell script

• NIS Domainname
• Note: this is a different name space than the DNS name (although the names may be the same)
 
$ domainname
$ domainname nixrox.nis
• modify this configuration file: /etc/sysconfig/network, add a line for NIS domainname
 
NISDOMAIN=nixrox.nis
• Make sure you have the NIS server and client packages
 
$ rpm -qa | grep yp
ypbind
ypserv
yp-tools
• The RPC Portmapper daemon must be running
 
rpcinfo -p | grep portmapper
chkconfig --list | grep port
 
• started at boot time from /etc/init.d/portmap
• Shared library glibc
• GNU C Library
• A directory named /var/yp on master and slave
• Created when you install the server package, ypserv
• NIS servers should have fixed IP addresses with an entry for themselves in the /etc/hosts file

• Generate NIS database either from files in /etc or some other location
• passwd, hosts, groups, etc
• Configure the server as a client as well!
• modify /var/yp/securenets to restrict access to just your net!
• Setup ypserv and ypbind to start at boot time
• Start the yp services


1. Create NIS files using the shell scripts createusers and createhosts above

• You will need to decide if you are going to use the existing files in /etc or if you want the text files to live elsewhere such as /etc/yp
• If you choose to put them elsewhere you will need to edit the NIS Makefile (with care)


2. Modify /var/yp/securenets to restrict access

 
255.0.0.0       127.0.0.0
255.255.255.0   10.2.135.0


3. Explicitly set the NIS Domain name (also edit /etc/sysconfig/network)
 

# domainname nixrox.nis


4. Generate the NIS database
 

# /usr/lib/yp/ypinit -m


5. Configure NIS Master Server as a client
    NOTE: station12's IP address must be in the /etc/hosts file.
 

# cat /etc/yp.conf
domain nixrox.nis server station12


6. Configure NIS server and client to start at boot time

# chkconfig ypserv on
# chkconfig ypbind on


7. Start the server and client daemons now
 

# service ypserv start
# service ypbind start

• Install software: ypserv
• Make sure portmapper is running
• Set NIS domain name
• Configure the machine to be a client as well, ypbind
• /etc/yp.conf, set the machine to point to itself as nis server
• Grab NIS database from server
 
# domainname nixrox.nis
# /usr/lib/yp/ypinit -s 10.2.128.30
• edit root's crontab on slave server so it will pull maps from server regularly

 
22 *    * * *    /usr/lib/yp/ypxfr_1perhour
42 6    * * *    /usr/lib/yp/ypxfr_1perday
52 6,18 * * *    /usr/lib/yp/ypxfr_2perday
 
• ypxfrd
• transfers map from master server
• used to speed up transfers of large NIS maps
• only copies the database map files
• used RPC-based file transfer protocol
• setup NIS processes to run at boot time and start them now
• kill ypbind first if running before restarting

# service ypserv start
# service ypbind start
# /sbin/chkconfig ypserv on
# /sbin/chkconfig ypbind on
• Add new slave server to /var/yp/ypservers file

• Test to see all map nicknames

# ypmatch -x
Use "ethers" for map "ethers.byname"
Use "aliases" for map "mail.aliases"
Use "services" for map "services.byname"
Use "protocols" for map "protocols.bynumber"
Use "hosts" for map "hosts.byname"
Use "networks" for map "networks.byaddr"
Use "group" for map "group.byname"
Use "passwd" for map "passwd.byname"

• modify /etc/sysconfig/network file to add domainname
• set NIS domain name explicitely
 
# domainname nixrox.nis
• modify /etc/yp.conf and add name of nis slave (or master) server
• Note: You will have to do this on your Master server too. Why?


domain nixrox.nis server station12
 

• You can also run NIS in broadcast mode (if you have a slave on your subnet)


domain nixrox.nis broadcast
 

• modify /etc/nsswitch.conf so your system will use the NIS files

passwd:     files nis
shadow:     files nis
group:      files nis
hosts:      files nis dns
automount:  files nis
aliases:    files nis
services:   files nis
protocols:  files nis
 
• setup ypbind to run at boot time and start it now

 
# chkconfig --level 345 ypbind on
# service ypbind start

ypcat: cats the file requested

$ ypcat passwd
$ ypcat hosts
 

$ ypwhich
ponto.example.com

 $ ypmatch pattyo auto.home
-rw,noquota ponto:/home/pattyo

 $ yppasswd username

• NIS was designed to support open, trusting environments
• There is little security built into this service

• NIS clients get information from a NIS server via RPC calls
• This info is cached by the client's ypbind daemon
• An intruder could pretent to be a NIS server, run ypserv and respond to ypbind requests
• the client is then being supplied with the intruders version of the passwd file

Is the server running?

$ rpcinfo -u station12 ypserv
program 100004 version 1 ready and waiting
program 100004 version 2 ready and waiting

     If you are running server in broadcast mode

$ rpcinfo -b ypserv 1

Is the client running?

$ rpcinfo -u stationX ypbind
program 100007 version 1 ready and waiting
program 100007 version 2 ready and waiting
 
• Do you have a NIS domain configured?


$ domainname
nixrox.nis
 

• Is your machine configured to look at NIS files?
• Check /etc/nsswitch.conf
• Test to see if you have service

$ ypcat hosts

Changes are made on NIS Master Server

Our example will be a file with phone numbers in it

• Edit new NIS file


# cat /etc/yp/phone
Dad  222-888-2222
Joel 555-222-6666
Ruth 777-555-3333
Kelly 888-333-5555
Tom  999-444-1111
 

• Put hooks into /var/yp/Makefile for new map


# vi /var/yp/Makefile
 

• Build the maps


# make phone
Updating phone...
 

• Test


# ypcat -k phone
Dad  222-888-2222
Joel 555-222-6666
Ruth 777-555-3333
Kelly 888-333-5555
Tom  999-444-1111

Getting new map from the master onto a slave server

# /usr/lib/yp/ypxfr -h mastserver phone

Turning a dbm map file into readable text

• in order to edit and add new entries
• rebuild the dbm file again when done
• typically systems administrators write scripts to mange this process


# /usr/lib/yp/makedbm -u ypservers > /tmp/ypservers.txt
 

• add your new nisslave server here


# vi /tmp/ypservers.txt
 

• remake the dbm data file and replace it


# /usr/lib/yp/makedbm /tmp/ypservers.txt /var/yp/example.com/ypservers
 

• Test to see if you see your new entry


# ypcat ypservers