Transcript nis
Centralized logins with NIS Eric Stolten Tim Meade Mark Sidnam NIS ● Purpose of NIS – – This enables centralized user logins across networks. The centralized database allows users to login and change passwords in one location and have the changes reflected across all involved systems. NIS ● Background Information – NIS was originally developed by Sun Microsystems under the name Yellow Pages. However, we are not allowed to use that trademarked name. NIS vs. NIS+ ● ● NIS+ was supposed to be a more secure replacement to NIS providing security and easy implementation over large area networks. It is important to note that NIS+ is not the same project as NIS. It is a newer version released by Sun Microsystems. NIS vs. NIS+ ● ● NIS+ increases security by using additional authentication methods. We chose to use NIS over NIS+ because of the small network size and stability. NIS Server Configuration ● Necessary configuration. – – #/etc/sysconfig/network NISDOMAIN=”lab2.research.cs.uofs.edu” #/etc/yp.conf --This is the ypbind conf file ypserver 127.0.0.1 NIS Server Configuration ● Necessary running daemons – – – – – portmap – An RPC daemon. yppasswd – allows NIS clients to change their passwords ypserv -- The main NIS server ypbind – The main NIS client ypxfrd – Speeds up password database transfers. Check for running Daemons ● It is helpful to check that our processes are running with rpcinfo -p localhost. – Output should produce something like [root@bigboy tmp]# rpcinfo -p localhost program vers proto port 100000 2 tcp 111 portmapper 100000 2 udp 111 portmapper 100009 1 udp 681 yppasswdd 100004 2 udp 698 ypserv 100004 1 udp 698 ypserv 100004 2 tcp 701 ypserv 100004 1 tcp 701 ypserv Initializing the NIS Domain ● ● ● To build our database, we must run the command /usr/lib/yp/ypinit -m This verifies the NIS domain name and generates password databases according to the entries in /etc/passwd We must rebuild the databases each time a user is added to the system. Adding More Users ● After the initialization you need to run: – ● Then run – ● passwd <username> You can verify this by typing – ● useradd <username> ypmatch <nisusername> <passwd> It will display the user name with an encrypted password. Configuration of the Client ● ● ● ● The authconfig program configures the NIS files after prompting for the IP and domain of the NIS server Once finished it will create the file – /etc/yp.conf It also adds the NIS domain to the file: – /etc/sysconfig/network This line: +:*::::: had to be added to the /etc/passwd file to direct it to the server. Running the Client ● Daemons that need to run Client Side – – – ● ypbind portmapper yppasswdd To ensure that the services start the next reboot you need to run: – chkconfig <NISSERVICE> on Problems ● An incorrect configuration in the – ● /var/yp/securenets prevented us from originally connecting from any computer other than lab2 Problems ● Packages were missing – ● Ran the Red hat package manager and added the packages Firewall was running by default which prevented connections to the server from some clients. – Disabled the firewall – Applications/system settings/security settings Security Issues ● ● restricting the server to static IP address removes some fear of hackers hacks/cracks included: – – running ypcat and cracking the passwd file obtaining passwd map with ypx ● guesses domain name to look like a box on the network Resources ● ● www.linuxhomenetworking.com www.eng.aunurn.edu