NIS, (Network Information Services), enables account logins and other
services (host name resolution, xinetd network services configuration,
...), to be centralized to a single NIS server.
This tutorial covers the configuration and use of NIS for login authentication.
NIS+ is slightly more complex as it uses encryption for the data transfers between the NIS server and NIS client.
Regular NIS does not use encryption, thus it should only be used for isolated or private networks protected by a firewall.
NIS allows a central server to manage password authentication,
host, services, etc which would normally be provided by the local files
/etc/passwd, /etc/shadow, /etc/groups, /etc/hosts, /etc/services, /etc/networks, /etc/rpc, /etc/protocols, /etc/aliases (sendmail), ...
NIS Client systems look to the NIS server to provide this
data. This tutorial will cover the configuration of both an NIS server
and NIS clients.
The logical cluster of the server and clients are known as an NIS "domain".
An NIS domain must have their time synchronized, usually using NTP (Network Time Protocol).
See the YoLinux.com SysAdmin tutorial on NTP for configuring an NTP client to synchronize with a public NTP server.
LDAP has overtaken NIS as the preferred central authentication
server technology as it has cross platform support and greater client
web and desktop application support. See the following YoLinux LDAP
tutorials:
NIS has greater legacy Unix support and is in place and used in many
corporate networks.
NIS is independent of NFS (file sharing) although the two are often
hosted on a single server and they were both originally developed by
Sun Microsystems.
yp-tools - NIS support commands (ypcat, yppasswd, ypwhich, ...)
nscd - Handles password and group lookups and caches the
results. Used by LDAP and NIS. Configuration of nscd defines which
files are supported by NIS. i.e. authentication requires passwd, shadow
and group file support. Uses configuration file /etc/ncsd.conf
Where 127.0.0.1 is the "localhost" IP address
of the NIS server. In this configuration, this NIS server is using NIS
to authenticate logins, not just the client.
Order by which authentication methods are processed. eg. In this case, check the local /etc/passwd file first before checking with NIS for password authentication.
It is recomended that the root password be authenticated locally using "files" with all other users authenticated using NIS.
File: /etc/ypserv.conf
dns: no files: 30 slp: no slp_timeout: 3600 xfr_check_port: yes * : * : shadow.byname : port * : * : passwd.adjunct.byname : port
File: /var/yp/securenets
Configuration authorizes only a single subnet to authenticate with the NIS server:
host 127.0.0.1 255.255.255.0 XXX.XXX.XXX.0
The "host" statement allows access for a specified single host.
Configuration to allow two subnets to authenticate with the NIS server:
host 127.0.0.1 255.255.254.0 192.168.105.0
Allows the range of IP addresses 192.168.105.0 to 192.168.106.255 to authenticate with the NIS server.
Configuration to allow everyone to authenticate with the NIS server:
As root, issue the following configuration commands:
# nisdomainname name-of-domain
# service portmap restart
# service yppasswdd start
# service ypserv start
# /usr/lib/yp/ypinit -m
# make -c /var/yp
# service ypbind start
Where:
The nisdomainname command creates the "NISDOMAIN" entry in /etc/sysconfig/network
This is usually configured during Linux OS installation.
Note the commands nisdomainname, ypdomainname and domainname
all are soft eqivalent. Without specifying an argument, the command returns the domain name.
nisdomainname man page
Network server services:
portmap: RPC network communications services
yppasswd: Password daemon which allows users to change their NIS passwords on the server from their client systems.
ypserv: NIS server daemon
ypbind: NIS client daemon
ypinit -m: Configure the NIS server as a "master NIS server" with the option "-m". This will convert /etc/passwd, /etc/shadow, hosts, ... files into NIS GNU dbm database format and generates a make file.
Traditional Unix systems use ndbm database format.
ypinit man page
Create domain with the command: nisdomainname name-of-domain
Start NIS client services:
service portmap restart
service ypbind start
service nscd start (optional - used to cache login and passwd info to improve authentication response time)
Test:
Check if portmapper daemon is running and ypbind is a registered service: rpcinfo -u localhost ypbind
List passwd file: ypcat passwd
[Potential Pitfall]: If you find
that the daemon ypbind on a client is crashing on a network which
extends great distances, has heavy traffic or is unreliable, try
starting ypbind with the option "-no-ping".
Red Hat configuration fix, edit file: /etc/init.d/ypbind
change to:
...
OTHER_YPBIND_OPTS="-no-ping"
...
This will keep ypbind from checking its network connection unnecessarily.
Red Hat GUI client configuration:
GUI tool: /usr/bin/system-config-authentication
Select the "Configure NIS ..." button:
NIS and system users:
User Administration:
Add a new user: (as root on NIS server)
useradd -g user-groupuser-id
(or, also create home directory: useradd -m -g user-groupuser-id)
make -c /var/yp
Updates local NIS databases.
Changing a password for a user: yppasswd -p user-id
User password management:
Users will now change their passwords using the NIS password command yppasswd instead of the local password file affected command, passwd.
When using an NIS slave (described below), then do not modify the password while logged into the NIS master.
NIS is capable of performing host name resolution and so is LDAP.
Best Practice: Use DNS for general host resolution and the use the local file /etc/hosts
to resolve the host name of the NIS server. This improves performance
so that host name resolution of the NIS server does not require a
network connection.
Configuring a NIS client to use NIS for host name resolution:
File: /etc/nsswitch.conf
... ...
hosts: files nis
... ...
This configuration has the system look at the file /etc/hosts for a host name and then it looks to the NIS server.
Configuring an NIS Master - Slave failover server:
One can create a redundant failover slave server to improve network robustness.
The NIS clients will be configured with an additional host in /etc/yp.conf.
Client File: /etc/yp.conf
domain name-of-domain server XXX.XXX.XXX.XXX
domain name-of-domain server ZZZ.ZZZ.ZZZ.ZZZ
Where XXX.XXX.XXX.XXX is the IP address of the NIS master server
and ZZZ.ZZZ.ZZZ.ZZZ is the IP address of the NIS slave server.
In addition, the NIS master and slave servers must arrange for NIS database transfers to stay synchronized.
The configuration of the NIS servers are the same as for the above single master with the following additions and/or changes:
NIS Master:
NIS master file: /etc/ypservers
host-name-of-nis-masterhost-name-of-nis-slave
Edit NIS master Makefile to allow database push to slave: /var/yp/Makefile
NOPUSH=false
After performing the NIS server procedures above, start the additional database transfer daemon:
service ypxfrd start
Push configuration change notification to clients: yppush
Perform this after updates to NIS master.
yppush man page
NIS Slave:
/usr/lib/yp/ypinit -s nis-master-hostname:
Configure the NIS server as a "slave NIS server" with the option "-s"
and state the "master" from which the NIS database transfer will occur.
Note: This is a change from the above single NIS master configuration.
Start the additional database transfer daemon: service ypxfrd start
NSS: Name Service Switch. The /etc/nsswitch.conf, determines the order of lookups performed.
RPC: Remote Procedure Call. RPC routines allow C programs to make procedure calls on other machines across the network.
YP: Yellow Pages(tm), a registered trademark in the UK of
British Telecom plc. forcing Sun to rename it to NIS. The NIS commands
retain the "yp" prefix.
HostName: The name of the computer system. This is typically configured using Linux OS installation.
Host Name Resolution: The lookup by a client to find the IP
address given the host name so that it can create a network connection.
Books:
"NFS and NIS"
by Mike Eisler, Ricardo Labiaga, Hal Stern
Sams, ISBN# 1565925106
"Red Hat Fedora 6 and Enterprise Linux Bible"
by Christopher Negus
Sams, ISBN# 047008278X
"Fedora 7 & Red Hat Enterprise Linux: The Complete Reference"
by Richard Petersen
Sams, ISBN# 0071486429
"Red Hat Fedora Core 6 Unleashed"
by Paul Hudson, Andrew Hudson
Sams, ISBN# 0672329298
"Red Hat Linux Fedora 3 Unleashed"
by Bill Ball, Hoyt Duff
Sams, ISBN# 0672327082
"Red Hat Linux 9 Unleashed"
by Bill Ball, Hoyt Duff
Sams, ISBN# 0672325888
I have the Red Hat 6 version and I have found it to be very helpful.
I have found it to be way more complete than the other Linux books.
It is the most complete general Linux book in publication. While other
books in the "Unleashed" series have disappointed me, this book
is the best out there.
Books:
