Bring BSD-licensed ext2fs from FreeBSD

[ikiwiki.git] / docs / handbook / handbook-network-nis.mdwn

\r
\r
## 19.9 NIS/YP \r
\r
***Written by Bill Swingle. ******Enhanced by Eric Ogren and Udo Erdelhoff. ***\r
\r
### 19.9.1 What Is It? \r
\r
NIS, which stands for Network Information Services, was developed by Sun Microsystems to centralize administration of UNIX® (originally SunOS™) systems. It has now essentially become an industry standard; all major UNIX like systems (Solaris™, HP-UX, AIX®, Linux, NetBSD, OpenBSD, FreeBSD, DragonFly, etc.) support NIS.\r
\r
NIS was formerly known as Yellow Pages, but because of trademark issues, Sun changed the name. The old term (and yp) is still often seen and used.\r
\r
It is a RPC-based client/server system that allows a group of machines within an NIS domain to share a common set of configuration files. This permits a system administrator to set up NIS client systems with only minimal configuration data and add, remove or modify configuration data from a single location.\r
\r
It is similar to the Windows NT® domain system; although the internal implementation of the two are not at all similar, the basic functionality can be compared.\r
\r
### 19.9.2 Terms/Processes You Should Know \r
\r
There are several terms and several important user processes that you will come across when attempting to implement NIS on DragonFly, whether you are trying to create an NIS server or act as an NIS client:\r
\r
[[!table  data="""
| Term | Description 
 NIS domainname | An NIS master server and all of its clients (including its slave servers) have a NIS domainname. Similar to an Windows NT domain name, the NIS domainname does not have anything to do with DNS. 
 portmap | Must be running in order to enable RPC (Remote Procedure Call, a network protocol used by NIS). If `portmap` is not running, it will be impossible to run an NIS server, or to act as an NIS client. 
 ypbind | ***Binds*** an NIS client to its NIS server. It will take the NIS domainname from the system, and using RPC, connect to the server. `ypbind` is the core of client-server communication in an NIS environment; if `ypbind` dies on a client machine, it will not be able to access the NIS server. 
 ypserv | Should only be running on NIS servers; this is the NIS server process itself. If [ypserv(8)](http://leaf.dragonflybsd.org/cgi/web-man?command#ypserv&section8) dies, then the server will no longer be able to respond to NIS requests (hopefully, there is a slave server to take over for it). There are some implementations of NIS (but not the DragonFly one), that do not try to reconnect to another server if the server it used before dies. Often, the only thing that helps in this case is to restart the server process (or even the whole server) or the `ypbind` process on the client. 
 rpc.yppasswdd | Another process that should only be running on NIS master servers; this is a daemon that will allow NIS clients to change their NIS passwords. If this daemon is not running, users will have to login to the NIS master server and change their passwords there. |\r
"""]]\r
### 19.9.3 How Does It Work? \r
\r
There are three types of hosts in an NIS environment: master servers, slave servers, and clients. Servers act as a central repository for host configuration information. Master servers hold the authoritative copy of this information, while slave servers mirror this information for redundancy. Clients rely on the servers to provide this information to them.\r
\r
Information in many files can be shared in this manner. The `master.passwd`, `group`, and `hosts` files are commonly shared via NIS. Whenever a process on a client needs information that would normally be found in these files locally, it makes a query to the NIS server that it is bound to instead.\r
\r
#### 19.9.3.1 Machine Types \r
\r

* A ***NIS master server***. This server, analogous to a Windows NT primary domain controller, maintains the files used by all of the NIS clients. The `passwd`, `group`, and other various files used by the NIS clients live on the master server.\r
   **Note:** It is possible for one machine to be an NIS master server for more than one NIS domain. However, this will not be covered in this introduction, which assumes a relatively small-scale NIS environment.\r

* ***NIS slave servers***. Similar to the Windows NT backup domain controllers, NIS slave servers maintain copies of the NIS master's data files. NIS slave servers provide the redundancy, which is needed in important environments. They also help to balance the load of the master server: NIS Clients always attach to the NIS server whose response they get first, and this includes slave-server-replies.\r

* ***NIS clients***. NIS clients, like most Windows NT workstations, authenticate against the NIS server (or the Windows NT domain controller in the Windows NT Workstation case) to log on.\r
\r
### 19.9.4 Using NIS/YP \r
\r
This section will deal with setting up a sample NIS environment.\r
\r
#### 19.9.4.1 Planning \r
\r
Let us assume that you are the administrator of a small university lab. This lab, which consists of 15 DragonFly machines, currently has no centralized point of administration; each machine has its own `/etc/passwd` and `/etc/master.passwd`. These files are kept in sync with each other only through manual intervention; currently, when you add a user to the lab, you must run `adduser` on all 15 machines. Clearly, this has to change, so you have decided to convert the lab to use NIS, using two of the machines as servers.\r
\r
Therefore, the configuration of the lab now looks something like:\r
\r
[[!table  data="""
| Machine name | IP address | Machine role 
 `ellington` | `10.0.0.2` | NIS master 
 `coltrane` | `10.0.0.3` | NIS slave 
 `basie` | `10.0.0.4` | Faculty workstation 
 `bird` | `10.0.0.5` | Client machine 
 `cli[1-11]` | `10.0.0.[6-17]` | Other client machines |\r
"""]]\r
If you are setting up a NIS scheme for the first time, it is a good idea to think through how you want to go about it. No matter what the size of your network, there are a few decisions that need to be made.\r
\r
##### 19.9.4.1.1 Choosing a NIS Domain Name \r
\r
This might not be the ***domainname*** that you are used to. It is more accurately called the ***NIS domainname***. When a client broadcasts its requests for info, it includes the name of the NIS domain that it is part of. This is how multiple servers on one network can tell which server should answer which request. Think of the NIS domainname as the name for a group of hosts that are related in some way.\r
\r
Some organizations choose to use their Internet domainname for their NIS domainname. This is not recommended as it can cause confusion when trying to debug network problems. The NIS domainname should be unique within your network and it is helpful if it describes the group of machines it represents. For example, the Art department at Acme Inc. might be in the ***acme-art*** NIS domain. For this example, assume you have chosen the name ***test-domain***.\r
\r
However, some operating systems (notably SunOS) use their NIS domain name as their Internet domain name. If one or more machines on your network have this restriction, you ***must*** use the Internet domain name as your NIS domain name.\r
\r
##### 19.9.4.1.2 Physical Server Requirements \r
\r
There are several things to keep in mind when choosing a machine to use as a NIS server. One of the unfortunate things about NIS is the level of dependency the clients have on the server. If a client cannot contact the server for its NIS domain, very often the machine becomes unusable. The lack of user and group information causes most systems to temporarily freeze up. With this in mind you should make sure to choose a machine that will not be prone to being rebooted regularly, or one that might be used for development. The NIS server should ideally be a stand alone machine whose sole purpose in life is to be an NIS server. If you have a network that is not very heavily used, it is acceptable to put the NIS server on a machine running other services, just keep in mind that if the NIS server becomes unavailable, it will affect ***all*** of your NIS clients adversely.\r
\r
#### 19.9.4.2 NIS Servers \r
\r
The canonical copies of all NIS information are stored on a single machine called the NIS master server. The databases used to store the information are called NIS maps. In DragonFly, these maps are stored in `/var/yp/[domainname]` where `[domainname]` is the name of the NIS domain being served. A single NIS server can support several domains at once, therefore it is possible to have several such directories, one for each supported domain. Each domain will have its own independent set of maps.\r
\r
NIS master and slave servers handle all NIS requests with the `ypserv` daemon. `ypserv` is responsible for receiving incoming requests from NIS clients, translating the requested domain and map name to a path to the corresponding database file and transmitting data from the database back to the client.\r
\r
##### 19.9.4.2.1 Setting Up a NIS Master Server \r
\r
Setting up a master NIS server can be relatively straight forward, depending on your needs. DragonFly comes with support for NIS out-of-the-box. All you need is to add the following lines to `/etc/rc.conf`, and DragonFly will do the rest for you.\r
\r
      1. \r
      nisdomainname="test-domain"\r
  \r
   This line will set the NIS domainname to ***test-domain*** upon network setup (e.g. after reboot).\r
      1. \r
      nis_server_enable="YES"\r
  \r
   This will tell DragonFly to start up the NIS server processes when the networking is next brought up.\r
      1. \r
      nis_yppasswdd_enable="YES"\r
  \r
   This will enable the `rpc.yppasswdd` daemon which, as mentioned above, will allow users to change their NIS password from a client machine.\r
\r
 **Note:** Depending on your NIS setup, you may need to add further entries. See the [network-nis.html#NETWORK-NIS-SERVER-IS-CLIENT section about NIS servers that are also NIS clients], below, for details.\r
\r
Now, all you have to do is to run the command `/etc/netstart` as superuser. It will set up everything for you, using the values you defined in `/etc/rc.conf`.\r
\r
##### 19.9.4.2.2 Initializing the NIS Maps \r
\r
The ***NIS maps*** are database files, that are kept in the `/var/yp` directory. They are generated from configuration files in the `/etc` directory of the NIS master, with one exception: the `/etc/master.passwd` file. This is for a good reason; you do not want to propagate passwords to your `root` and other administrative accounts to all the servers in the NIS domain. Therefore, before we initialize the NIS maps, you should:\r
\r
    \r
    # cp /etc/master.passwd /var/yp/master.passwd\r
    # cd /var/yp\r
    # vi master.passwd\r
\r
\r
You should remove all entries regarding system accounts (`bin`, `tty`, `kmem`, `games`, etc), as well as any accounts that you do not want to be propagated to the NIS clients (for example `root` and any other UID 0 (superuser) accounts).\r
\r
 **Note:** Make sure the `/var/yp/master.passwd` is neither group nor world readable (mode 600)! Use the `chmod` command, if appropriate.\r
\r
When you have finished, it is time to initialize the NIS maps! DragonFly includes a script named `ypinit` to do this for you (see its manual page for more information). Note that this script is available on most UNIX Operating Systems, but not on all. On Digital UNIX/Compaq Tru64 UNIX it is called `ypsetup`. Because we are generating maps for an NIS master, we are going to pass the `-m` option to `ypinit`. To generate the NIS maps, assuming you already performed the steps above, run:\r
\r
    \r
    ellington# ypinit -m test-domain\r
    Server Type: MASTER Domain: test-domain\r
    Creating an YP server will require that you answer a few questions.\r
    Questions will all be asked at the beginning of the procedure.\r
    Do you want this procedure to quit on non-fatal errors? [y/n: n] n\r
    Ok, please remember to go back and redo manually whatever fails.\r
    If you don't, something might not work.\r
    At this point, we have to construct a list of this domains YP servers.\r
    rod.darktech.org is already known as master server.\r
    Please continue to add any slave servers, one per line. When you are\r
    done with the list, type a <control D>.\r
    master server   :  ellington\r
    next host to add:  coltrane\r
    next host to add:  ^D\r
    The current list of NIS servers looks like this:\r
    ellington\r
    coltrane\r
    Is this correct?  [y/n: y] y\r
    \r
    [..output from map generation..]\r
    \r
    NIS Map update completed.\r
    ellington has been setup as an YP master server without any errors.\r
\r
\r
`ypinit` should have created `/var/yp/Makefile` from `/var/yp/Makefile.dist`. When created, this file assumes that you are operating in a single server NIS environment with only DragonFly machines. Since ***test-domain*** has a slave server as well, you must edit `/var/yp/Makefile`:\r
\r
    \r
    ellington# vi /var/yp/Makefile\r
\r
\r
You should comment out the line that says\r
\r
    \r
    NOPUSH = "True"\r
\r
\r
(if it is not commented out already).\r
\r
##### 19.9.4.2.3 Setting up a NIS Slave Server \r
\r
Setting up an NIS slave server is even more simple than setting up the master. Log on to the slave server and edit the file `/etc/rc.conf` as you did before. The only difference is that we now must use the `-s` option when running `ypinit`. The `-s` option requires the name of the NIS master be passed to it as well, so our command line looks like:\r
\r
    \r
    coltrane# ypinit -s ellington test-domain\r
    \r
    Server Type: SLAVE Domain: test-domain Master: ellington\r
    \r
    Creating an YP server will require that you answer a few questions.\r
    Questions will all be asked at the beginning of the procedure.\r
    \r
    Do you want this procedure to quit on non-fatal errors? [y/n: n]  n\r
    \r
    Ok, please remember to go back and redo manually whatever fails.\r
    If you don't, something might not work.\r
    There will be no further questions. The remainder of the procedure\r
    should take a few minutes, to copy the databases from ellington.\r
    Transferring netgroup...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring netgroup.byuser...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring netgroup.byhost...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring master.passwd.byuid...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring passwd.byuid...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring passwd.byname...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring group.bygid...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring group.byname...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring services.byname...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring rpc.bynumber...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring rpc.byname...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring protocols.byname...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring master.passwd.byname...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring networks.byname...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring networks.byaddr...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring netid.byname...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring hosts.byaddr...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring protocols.bynumber...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring ypservers...\r
    ypxfr: Exiting: Map successfully transferred\r
    Transferring hosts.byname...\r
    ypxfr: Exiting: Map successfully transferred\r
    \r
    coltrane has been setup as an YP slave server without any errors.\r
    Don't forget to update map ypservers on ellington.\r
\r
\r
You should now have a directory called `/var/yp/test-domain`. Copies of the NIS master server's maps should be in this directory. You will need to make sure that these stay updated. The following `/etc/crontab` entries on your slave servers should do the job:\r
\r
    \r
    20      *       *       *       *       root   /usr/libexec/ypxfr passwd.byname\r
    21      *       *       *       *       root   /usr/libexec/ypxfr passwd.byuid\r
\r
\r
These two lines force the slave to sync its maps with the maps on the master server. Although these entries are not mandatory, since the master server attempts to ensure any changes to its NIS maps are communicated to its slaves and because password information is vital to systems depending on the server, it is a good idea to force the updates. This is more important on busy networks where map updates might not always complete.\r
\r
Now, run the command `/etc/netstart` on the slave server as well, which again starts the NIS server.\r
\r
#### 19.9.4.3 NIS Clients \r
\r
An NIS client establishes what is called a binding to a particular NIS server using the `ypbind` daemon. `ypbind` checks the system's default domain (as set by the `domainname` command), and begins broadcasting RPC requests on the local network. These requests specify the name of the domain for which `ypbind` is attempting to establish a binding. If a server that has been configured to serve the requested domain receives one of the broadcasts, it will respond to `ypbind`, which will record the server's address. If there are several servers available (a master and several slaves, for example), `ypbind` will use the address of the first one to respond. From that point on, the client system will direct all of its NIS requests to that server. `ypbind` will occasionally ***ping*** the server to make sure it is still up and running. If it fails to receive a reply to one of its pings within a reasonable amount of time, `ypbind` will mark the domain as unbound and begin broadcasting again in the hopes of locating another server.\r
\r
##### 19.9.4.3.1 Setting Up a NIS Client \r
\r
Setting up a DragonFly machine to be a NIS client is fairly straightforward.\r
\r
  1. Edit the file `/etc/rc.conf` and add the following lines in order to set the NIS domainname and start `ypbind` upon network startup:\r
      \r
      nisdomainname="test-domain"\r
      nis_client_enable="YES"\r
  \r
  1. To import all possible password entries from the NIS server, remove all user accounts from your `/etc/master.passwd` file and use `vipw` to add the following line to the end of the file:\r
      \r
      +:::::::::\r
  \r
   **Note:** This line will afford anyone with a valid account in the NIS server's password maps an account. There are many ways to configure your NIS client by changing this line. See the [network-nis.html#NETWORK-NETGROUPS netgroups section] below for more information. For more detailed reading see O'Reilly's book on `Managing NFS and NIS`.\r
   **Note:** You should keep at least one local account (i.e. not imported via NIS) in your `/etc/master.passwd` and this account should also be a member of the group `wheel`. If there is something wrong with NIS, this account can be used to log in remotely, become root, and fix things.\r
  1. To import all possible group entries from the NIS server, add this line to your `/etc/group` file:\r
      \r
      +:*::\r
  \r
\r
After completing these steps, you should be able to run `ypcat passwd` and see the NIS server's passwd map.\r
\r
### 19.9.5 NIS Security \r
\r
In general, any remote user can issue an RPC to [ypserv(8)](http://leaf.dragonflybsd.org/cgi/web-man?command#ypserv&section8) and retrieve the contents of your NIS maps, provided the remote user knows your domainname. To prevent such unauthorized transactions, [ypserv(8)](http://leaf.dragonflybsd.org/cgi/web-man?command=ypserv&section=8) supports a feature called securenets which can be used to restrict access to a given set of hosts. At startup, [ypserv(8)](http://leaf.dragonflybsd.org/cgi/web-man?command=ypserv&section=8) will attempt to load the securenets information from a file called `/var/yp/securenets`.\r
\r
 **Note:** This path varies depending on the path specified with the `-p` option. This file contains entries that consist of a network specification and a network mask separated by white space. Lines starting with ***#*** are considered to be comments. A sample securenets file might look like this:\r
\r
    \r
    # allow connections from local host -- mandatory\r
    127.0.0.1     255.255.255.255\r
    # allow connections from any host\r
    # on the 192.168.128.0 network\r
    192.168.128.0 255.255.255.0\r
    # allow connections from any host\r
    # between 10.0.0.0 to 10.0.15.255\r
    # this includes the machines in the testlab\r
    10.0.0.0      255.255.240.0\r
\r
\r
If [ypserv(8)](http://leaf.dragonflybsd.org/cgi/web-man?command#ypserv&section8) receives a request from an address that matches one of these rules, it will process the request normally. If the address fails to match a rule, the request will be ignored and a warning message will be logged. If the `/var/yp/securenets` file does not exist, `ypserv` will allow connections from any host.\r
\r
The `ypserv` program also has support for Wietse Venema's  **tcpwrapper**  package. This allows the administrator to use the  **tcpwrapper**  configuration files for access control instead of `/var/yp/securenets`.\r
\r
 **Note:** While both of these access control mechanisms provide some security, they, like the privileged port test, are vulnerable to ***IP spoofing*** attacks. All NIS-related traffic should be blocked at your firewall.\r
\r
Servers using `/var/yp/securenets` may fail to serve legitimate NIS clients with archaic TCP/IP implementations. Some of these implementations set all host bits to zero when doing broadcasts and/or fail to observe the subnet mask when calculating the broadcast address. While some of these problems can be fixed by changing the client configuration, other problems may force the retirement of the client systems in question or the abandonment of `/var/yp/securenets`.\r
\r
Using `/var/yp/securenets` on a server with such an archaic implementation of TCP/IP is a really bad idea and will lead to loss of NIS functionality for large parts of your network.\r
\r
The use of the  **tcpwrapper**  package increases the latency of your NIS server. The additional delay may be long enough to cause timeouts in client programs, especially in busy networks or with slow NIS servers. If one or more of your client systems suffers from these symptoms, you should convert the client systems in question into NIS slave servers and force them to bind to themselves.\r
\r
### 19.9.6 Barring Some Users from Logging On \r
\r
In our lab, there is a machine `basie` that is supposed to be a faculty only workstation. We do not want to take this machine out of the NIS domain, yet the `passwd` file on the master NIS server contains accounts for both faculty and students. What can we do?\r
\r
There is a way to bar specific users from logging on to a machine, even if they are present in the NIS database. To do this, all you must do is add ***-`***username***`*** to the end of the `/etc/master.passwd` file on the client machine, where `***username***` is the username of the user you wish to bar from logging in. This should preferably be done using `vipw`, since `vipw` will sanity check your changes to `/etc/master.passwd`, as well as automatically rebuild the password database when you finish editing. For example, if we wanted to bar user ***bill*** from logging on to `basie` we would:\r
\r
    \r
    basie# vipw\r
    [add -bill to the end, exit]\r
    vipw: rebuilding the database...\r
    vipw: done\r
    \r
    basie# cat /etc/master.passwd\r
    \r
    root:[password]:0:0::0:0:The super-user:/root:/bin/csh\r
    toor:[password]:0:0::0:0:The other super-user:/root:/bin/sh\r
    daemon:*:1:1::0:0:Owner of many system processes:/root:/sbin/nologin\r
    operator:*:2:5::0:0:System &:/:/sbin/nologin\r
    bin:*:3:7::0:0:Binaries Commands and Source,,,:/:/sbin/nologin\r
    tty:*:4:65533::0:0:Tty Sandbox:/:/sbin/nologin\r
    kmem:*:5:65533::0:0:KMem Sandbox:/:/sbin/nologin\r
    games:*:7:13::0:0:Games pseudo-user:/usr/games:/sbin/nologin\r
    news:*:8:8::0:0:News Subsystem:/:/sbin/nologin\r
    man:*:9:9::0:0:Mister Man Pages:/usr/share/man:/sbin/nologin\r
    bind:*:53:53::0:0:Bind Sandbox:/:/sbin/nologin\r
    uucp:*:66:66::0:0:UUCP pseudo-user:/var/spool/uucppublic:/usr/libexec/uucp/uucico\r
    xten:*:67:67::0:0:X-10 daemon:/usr/local/xten:/sbin/nologin\r
    pop:*:68:6::0:0:Post Office Owner:/nonexistent:/sbin/nologin\r
    nobody:*:65534:65534::0:0:Unprivileged user:/nonexistent:/sbin/nologin\r
    +:::::::::\r
    -bill\r
    \r
    basie#\r
\r
\r
### 19.9.7 Using Netgroups \r
\r
***Contributed by Udo Erdelhoff. ***\r
\r
The method shown in the previous section works reasonably well if you need special rules for a very small number of users and/or machines. On larger networks, you ***will*** forget to bar some users from logging onto sensitive machines, or you may even have to modify each machine separately, thus losing the main benefit of NIS, ***centralized*** administration.\r
\r
The NIS developers' solution for this problem is called ***netgroups***. Their purpose and semantics can be compared to the normal groups used by UNIX file systems. The main differences are the lack of a numeric id and the ability to define a netgroup by including both user accounts and other netgroups.\r
\r
Netgroups were developed to handle large, complex networks with hundreds of users and machines. On one hand, this is a Good Thing if you are forced to deal with such a situation. On the other hand, this complexity makes it almost impossible to explain netgroups with really simple examples. The example used in the remainder of this section demonstrates this problem.\r
\r
Let us assume that your successful introduction of NIS in your laboratory caught your superiors' interest. Your next job is to extend your NIS domain to cover some of the other machines on campus. The two tables contain the names of the new users and new machines as well as brief descriptions of them.\r
\r
[[!table  data="""
| User Name(s) | Description 
 alpha, beta | Normal employees of the IT department 
 charlie, delta | The new apprentices of the IT department 
 echo, foxtrott, golf, ... | Ordinary employees 
 able, baker, ... | The current interns |\r
"""]]\r
[[!table  data="""
| Machine Name(s) | Description 
 war, death, famine, pollution | Your most important servers. Only the IT employees are allowed to log onto these machines. 
 pride, greed, envy, wrath, lust, sloth | Less important servers. All members of the IT department are allowed to login onto these machines. 
 one, two, three, four, ... | Ordinary workstations. Only the ***real*** employees are allowed to use these machines. 
 trashcan | A very old machine without any critical data. Even the intern is allowed to use this box. |\r
"""]]\r
If you tried to implement these restrictions by separately blocking each user, you would have to add one -`***user***` line to each system's `passwd` for each user who is not allowed to login onto that system. If you forget just one entry, you could be in trouble. It may be feasible to do this correctly during the initial setup, however you ***will*** eventually forget to add the lines for new users during day-to-day operations. After all, Murphy was an optimist.\r
\r
Handling this situation with netgroups offers several advantages. Each user need not be handled separately; you assign a user to one or more netgroups and allow or forbid logins for all members of the netgroup. If you add a new machine, you will only have to define login restrictions for netgroups. If a new user is added, you will only have to add the user to one or more netgroups. Those changes are independent of each other; no more ***for each combination of user and machine do...*** If your NIS setup is planned carefully, you will only have to modify exactly one central configuration file to grant or deny access to machines.\r
\r
The first step is the initialization of the NIS map netgroup. DragonFly's [ypinit(8)](http://leaf.dragonflybsd.org/cgi/web-man?command#ypinit&section8) does not create this map by default, but its NIS implementation will support it once it has been created. To create an empty map, simply type\r
\r
    \r
    ellington# vi /var/yp/netgroup\r
\r
\r
and start adding content. For our example, we need at least four netgroups: IT employees, IT apprentices, normal employees and interns.\r
\r
    \r
    IT_EMP  (,alpha,test-domain)    (,beta,test-domain)\r
    IT_APP  (,charlie,test-domain)  (,delta,test-domain)\r
    USERS   (,echo,test-domain)     (,foxtrott,test-domain) \\r
            (,golf,test-domain)\r
    INTERNS (,able,test-domain)     (,baker,test-domain)\r
\r
\r
`IT_EMP`, `IT_APP` etc. are the names of the netgroups. Each bracketed group adds one or more user accounts to it. The three fields inside a group are:\r
\r
  1. The name of the host(s) where the following items are valid. If you do not specify a hostname, the entry is valid on all hosts. If you do specify a hostname, you will enter a realm of darkness, horror and utter confusion.\r
  1. The name of the account that belongs to this netgroup.\r
  1. The NIS domain for the account. You can import accounts from other NIS domains into your netgroup if you are one of the unlucky fellows with more than one NIS domain.\r
\r
Each of these fields can contain wildcards. See [netgroup(5)](http://leaf.dragonflybsd.org/cgi/web-man?command#netgroup&section5) for details.\r
\r
 **Note:** Netgroup names longer than 8 characters should not be used, especially if you have machines running other operating systems within your NIS domain. The names are case sensitive; using capital letters for your netgroup names is an easy way to distinguish between user, machine and netgroup names.\r
\r
Some NIS clients (other than DragonFly) cannot handle netgroups with a large number of entries. For example, some older versions of SunOS start to cause trouble if a netgroup contains more than 15 ***entries***. You can circumvent this limit by creating several sub-netgroups with 15 users or less and a real netgroup that consists of the sub-netgroups:\r
\r
    \r
    BIGGRP1  (,joe1,domain)  (,joe2,domain)  (,joe3,domain) [...]\r
    BIGGRP2  (,joe16,domain)  (,joe17,domain) [...]\r
    BIGGRP3  (,joe31,domain)  (,joe32,domain)\r
    BIGGROUP  BIGGRP1 BIGGRP2 BIGGRP3\r
\r
\r
You can repeat this process if you need more than 225 users within a single netgroup.\r
\r
Activating and distributing your new NIS map is easy:\r
\r
    \r
    ellington# cd /var/yp\r
    ellington# make\r
\r
\r
This will generate the three NIS maps `netgroup`, `netgroup.byhost` and `netgroup.byuser`. Use [ypcat(1)](http://leaf.dragonflybsd.org/cgi/web-man?command#ypcat&section1) to check if your new NIS maps are available:\r
\r
    \r
    ellington% ypcat -k netgroup\r
    ellington% ypcat -k netgroup.byhost\r
    ellington% ypcat -k netgroup.byuser\r
\r
\r
The output of the first command should resemble the contents of `/var/yp/netgroup`. The second command will not produce output if you have not specified host-specific netgroups. The third command can be used to get the list of netgroups for a user.\r
\r
The client setup is quite simple. To configure the server `***war***`, you only have to start [vipw(8)](http://leaf.dragonflybsd.org/cgi/web-man?command#vipw&section8) and replace the line\r
\r
    \r
    +:::::::::\r
\r
\r
with\r
\r
    \r
    +@IT_EMP:::::::::\r
\r
\r
Now, only the data for the users defined in the netgroup `***IT_EMP***` is imported into `***war***`'s password database and only these users are allowed to login.\r
\r
Unfortunately, this limitation also applies to the ~ function of the shell and all routines converting between user names and numerical user IDs. In other words, `cd ~`***user****** will not work, `ls -l` will show the numerical id instead of the username and `find . -user joe -print` will fail with ***`No such user`***. To fix this, you will have to import all user entries ***without allowing them to login onto your servers***.\r
\r
This can be achieved by adding another line to `/etc/master.passwd`. This line should contain:\r
\r
`+:::::::::/sbin/nologin`, meaning ***Import all entries but replace the shell with `/sbin/nologin` in the imported entries***. You can replace any field in the passwd entry by placing a default value in your `/etc/master.passwd`.\r
\r
 **Warning:** Make sure that the line `+:::::::::/sbin/nologin` is placed after `+@IT_EMP:::::::::`. Otherwise, all user accounts imported from NIS will have /sbin/nologin as their login shell.\r
\r
After this change, you will only have to change one NIS map if a new employee joins the IT department. You could use a similar approach for the less important servers by replacing the old `+:::::::::` in their local version of `/etc/master.passwd` with something like this:\r
\r
    \r
    +@IT_EMP:::::::::\r
    +@IT_APP:::::::::\r
    +:::::::::/sbin/nologin\r
\r
\r
The corresponding lines for the normal workstations could be:\r
\r
    \r
    +@IT_EMP:::::::::\r
    +@USERS:::::::::\r
    +:::::::::/sbin/nologin\r
\r
\r
And everything would be fine until there is a policy change a few weeks later: The IT department starts hiring interns. The IT interns are allowed to use the normal workstations and the less important servers; and the IT apprentices are allowed to login onto the main servers. You add a new netgroup IT_INTERN, add the new IT interns to this netgroup and start to change the config on each and every machine... As the old saying goes: ***Errors in centralized planning lead to global mess***.\r
\r
NIS' ability to create netgroups from other netgroups can be used to prevent situations like these. One possibility is the creation of role-based netgroups. For example, you could create a netgroup called `***BIGSRV***` to define the login restrictions for the important servers, another netgroup called `***SMALLSRV***` for the less important servers and a third netgroup called `***USERBOX***` for the normal workstations. Each of these netgroups contains the netgroups that are allowed to login onto these machines. The new entries for your NIS map netgroup should look like this:\r
\r
    \r
    BIGSRV    IT_EMP  IT_APP\r
    SMALLSRV  IT_EMP  IT_APP  ITINTERN\r
    USERBOX   IT_EMP  ITINTERN USERS\r
\r
\r
This method of defining login restrictions works reasonably well if you can define groups of machines with identical restrictions. Unfortunately, this is the exception and not the rule. Most of the time, you will need the ability to define login restrictions on a per-machine basis.\r
\r
Machine-specific netgroup definitions are the other possibility to deal with the policy change outlined above. In this scenario, the `/etc/master.passwd` of each box contains two lines starting with ***+***. The first of them adds a netgroup with the accounts allowed to login onto this machine, the second one adds all other accounts with `/sbin/nologin` as shell. It is a good idea to use the ALL-CAPS version of the machine name as the name of the netgroup. In other words, the lines should look like this:\r
\r
    \r
    +@`***BOXNAME***`:::::::::\r
    +:::::::::/sbin/nologin\r
\r
\r
Once you have completed this task for all your machines, you will not have to modify the local versions of `/etc/master.passwd` ever again. All further changes can be handled by modifying the NIS map. Here is an example of a possible netgroup map for this scenario with some additional goodies.\r
\r
    \r
    # Define groups of users first\r
    IT_EMP    (,alpha,test-domain)    (,beta,test-domain)\r
    IT_APP    (,charlie,test-domain)  (,delta,test-domain)\r
    DEPT1     (,echo,test-domain)     (,foxtrott,test-domain)\r
    DEPT2     (,golf,test-domain)     (,hotel,test-domain)\r
    DEPT3     (,india,test-domain)    (,juliet,test-domain)\r
    ITINTERN  (,kilo,test-domain)     (,lima,test-domain)\r
    D_INTERNS (,able,test-domain)     (,baker,test-domain)\r
    #\r
    # Now, define some groups based on roles\r
    USERS     DEPT1   DEPT2     DEPT3\r
    BIGSRV    IT_EMP  IT_APP\r
    SMALLSRV  IT_EMP  IT_APP    ITINTERN\r
    USERBOX   IT_EMP  ITINTERN  USERS\r
    #\r
    # And a groups for a special tasks\r
    # Allow echo and golf to access our anti-virus-machine\r
    SECURITY  IT_EMP  (,echo,test-domain)  (,golf,test-domain)\r
    #\r
    # machine-based netgroups\r
    # Our main servers\r
    WAR       BIGSRV\r
    FAMINE    BIGSRV\r
    # User india needs access to this server\r
    POLLUTION  BIGSRV  (,india,test-domain)\r
    #\r
    # This one is really important and needs more access restrictions\r
    DEATH     IT_EMP\r
    #\r
    # The anti-virus-machine mentioned above\r
    ONE       SECURITY\r
    #\r
    # Restrict a machine to a single user\r
    TWO       (,hotel,test-domain)\r
    # [...more groups to follow]\r
\r
\r
If you are using some kind of database to manage your user accounts, you should be able to create the first part of the map with your database's report tools. This way, new users will automatically have access to the boxes.\r
\r
One last word of caution: It may not always be advisable to use machine-based netgroups. If you are deploying a couple of dozen or even hundreds of identical machines for student labs, you should use role-based netgroups instead of machine-based netgroups to keep the size of the NIS map within reasonable limits.\r
\r
### 19.9.8 Important Things to Remember \r
\r
There are still a couple of things that you will need to do differently now that you are in an NIS environment.\r
\r

* Every time you wish to add a user to the lab, you must add it to the master NIS server ***only***, and ***you must remember to rebuild the NIS maps***. If you forget to do this, the new user will not be able to login anywhere except on the NIS master. For example, if we needed to add a new user ***jsmith*** to the lab, we would:\r
      \r
      # pw useradd jsmith\r
      # cd /var/yp\r
      # make test-domain\r
  \r
  You could also run `adduser jsmith` instead of `pw useradd jsmith`.\r

* ***Keep the administration accounts out of the NIS maps***. You do not want to be propagating administrative accounts and passwords to machines that will have users that should not have access to those accounts.\r

* ***Keep the NIS master and slave secure, and minimize their downtime***. If somebody either hacks or simply turns off these machines, they have effectively rendered many people without the ability to login to the lab.\r
  This is the chief weakness of any centralized administration system. If you do not protect your NIS servers, you will have a lot of angry users!\r
\r
### 19.9.9 NIS v1 Compatibility \r
\r
DragonFly's  **ypserv**  has some support for serving NIS v1 clients. DragonFly's NIS implementation only uses the NIS v2 protocol, however other implementations include support for the v1 protocol for backwards compatibility with older systems. The  **ypbind**  daemons supplied with these systems will try to establish a binding to an NIS v1 server even though they may never actually need it (and they may persist in broadcasting in search of one even after they receive a response from a v2 server). Note that while support for normal client calls is provided, this version of ypserv does not handle v1 map transfer requests; consequently, it cannot be used as a master or slave in conjunction with older NIS servers that only support the v1 protocol. Fortunately, there probably are not any such servers still in use today.\r
\r
### 19.9.10 NIS Servers That Are Also NIS Clients \r
\r
Care must be taken when running ypserv in a multi-server domain where the server machines are also NIS clients. It is generally a good idea to force the servers to bind to themselves rather than allowing them to broadcast bind requests and possibly become bound to each other. Strange failure modes can result if one server goes down and others are dependent upon it. Eventually all the clients will time out and attempt to bind to other servers, but the delay involved can be considerable and the failure mode is still present since the servers might bind to each other all over again.\r
\r
You can force a host to bind to a particular server by running `ypbind` with the `-S` flag. If you do not want to do this manually each time you reboot your NIS server, you can add the following lines to your `/etc/rc.conf`:\r
\r
    \r
    nis_client_enable="YES"     # run client stuff as well\r
    nis_client_flags="-S `***NIS domain***`,`***server***`"\r
\r
\r
See [ypbind(8)](http://leaf.dragonflybsd.org/cgi/web-man?command#ypbind&section8) for further information.\r
\r
### 19.9.11 Password Formats \r
\r
One of the most common issues that people run into when trying to implement NIS is password format compatibility. If your NIS server is using DES encrypted passwords, it will only support clients that are also using DES. For example, if you have Solaris NIS clients in your network, then you will almost certainly need to use DES encrypted passwords.\r
\r
To check which format your servers and clients are using, look at `/etc/login.conf`. If the host is configured to use DES encrypted passwords, then the `default` class will contain an entry like this:\r
\r
    \r
    default:\\r
        :passwd_format=des:\\r
        :copyright=/etc/COPYRIGHT:\\r
        [Further entries elided]\r
\r
\r
Other possible values for the `passwd_format` capability include `blf` and `md5` (for Blowfish and MD5 encrypted passwords, respectively).\r
\r
If you have made changes to `/etc/login.conf`, you will also need to rebuild the login capability database, which is achieved by running the following command as `root`:\r
\r
    \r
    # cap_mkdb /etc/login.conf\r
\r
\r
 **Note:** The format of passwords already in `/etc/master.passwd` will not be updated until a user changes their password for the first time ***after*** the login capability database is rebuilt.\r
\r
Next, in order to ensure that passwords are encrypted with the format that you have chosen, you should also check that the `crypt_default` in `/etc/auth.conf` gives precedence to your chosen password format. To do this, place the format that you have chosen first in the list. For example, when using DES encrypted passwords, the entry would be:\r
\r
    \r
    crypt_default       =       des blf md5\r
\r
\r
Having followed the above steps on each of the DragonFly based NIS servers and clients, you can be sure that they all agree on which password format is used within your network. If you have trouble authenticating on an NIS client, this is a pretty good place to start looking for possible problems. Remember: if you want to deploy an NIS server for a heterogenous network, you will probably have to use DES on all systems because it is the lowest common standard.\r
\r
\r
\r
CategoryHandbook\r
CategoryHandbook-advancednetworking\r