Centralized logins with NIS Eric Stolten Tim Meade Mark Sidnam

NIS ● Purpose of NIS – This enables centralized user logins across networks. – The centralized database allows users to login and change passwords in one location and have the changes reflected across all involved systems.

NIS ● Background Information – NIS was originally developed by Sun Microsystems under the name Yellow Pages. However, we are not allowed to use that trademarked name.

NIS vs. NIS+ ● NIS+ was supposed to be a more secure replacement to NIS providing security and easy implementation over large area networks. ● It is important to note that NIS+ is not the same project as NIS. It is a newer version released by Sun Microsystems.

NIS vs. NIS+ ● NIS+ increases security by using additional authentication methods. ● We chose to use NIS over NIS+ because of the small network size and stability.

NIS Server Configuration ● Necessary configuration. – #/etc/sysconfig/network NISDOMAIN=”lab2.research.cs.uofs.edu” – #/etc/yp.conf --This is the ypbind conf file ypserver

NIS Server Configuration ● Necessary running daemons – portmap – An RPC daemon. – yppasswd – allows NIS clients to change their passwords – ypserv -- The main NIS server – ypbind – The main NIS client – ypxfrd – Speeds up password database transfers.

Check for running Daemons ● It is helpful to check that our processes are running with rpcinfo -p localhost. – Output should produce something like tmp]# rpcinfo -p localhost program vers proto port tcp 111 portmapper udp 111 portmapper udp 681 yppasswdd udp 698 ypserv udp 698 ypserv tcp 701 ypserv tcp 701 ypserv

Initializing the NIS Domain ● To build our database, we must run the command /usr/lib/yp/ypinit -m ● This verifies the NIS domain name and generates password databases according to the entries in /etc/passwd ● We must rebuild the databases each time a user is added to the system.

Adding More Users ● After the initialization you need to run: – useradd ● Then run – passwd ● You can verify this by typing – ypmatch ● It will display the user name with an encrypted password.

Configuration of the Client ● The authconfig program configures the NIS files after prompting for the IP and domain of the NIS server ● Once finished it will create the file – /etc/yp.conf ● It also adds the NIS domain to the file: – /etc/sysconfig/network ● This line: +:*::::: had to be added to the /etc/passwd file to direct it to the server.

Running the Client ● Daemons that need to run Client Side – ypbind – portmapper – yppasswdd ● To ensure that the services start the next reboot you need to run: – chkconfig on

Problems ● An incorrect configuration in the – /var/yp/securenets ● prevented us from originally connecting from any computer other than lab2

Problems ● Packages were missing – Ran the Red hat package manager and added the packages ● Firewall was running by default which prevented connections to the server from some clients. – Disabled the firewall – Applications/system settings/security settings

Security Issues ● restricting the server to static IP address removes some fear of hackers ● hacks/cracks included: – running ypcat and cracking the passwd file – obtaining passwd map with ypx ● guesses domain name to look like a box on the network

Resources ● ●