1. NIS Concepts and Configuration
Version A.01
H3065S Module 11 Slides

2. 9/4/2018
Why Use NIS?
NIS provides for single point administration of system configuration files.
NIS ensures consistency of files across the LAN.
Files maintained by NIS include:
/etc/hosts
/etc/passwd
/etc/group
others
Clients .
All clients share a common
set of configuration files.
Server
a673109

3. NIS Maps /etc/passwd passwd.byname MAP passwd.byuid MAP Indexed
9/4/2018
NIS Maps
chris:101:…
scott:102:…
abby:103:…
/etc/passwd
passwd.byname MAP
passwd.byuid MAP
Indexed by
Name
abby abby:103:…
chris chris:101:…
scott scott:102:…
Indexed by
UID
101 chris:101:…
102 scott:102:…
103 abby:103:…
NIS maps are indexed databases created by NIS.
NIS creates one or more indexed maps per ASCII configuration file.
Additional, customized maps can be created if desired.
a673110

4. NIS Domains Each node can belong to a maximum of one domain.
9/4/2018
NIS Domains
Each node can belong to a maximum of one domain.
Nodes in a domain share a common set of maps.
Domains can span multiple networks.
Server
NIS Maps
Client
NIS Domain
a673111

5. NIS Roles NIS Domain Master Server Clients Slave Server 9/4/2018
NIS Maps
ASCII Files
Master Server
Clients
NIS Maps
Slave Server
a673112

6. NIS Startup Files Sample File /etc/rc.config.d/namesvrs 9/4/2018
/sbin/init
/etc/inittab
/sbin/rc
Start Scripts
Configuration File
/sbin/rc2.d/*
/etc/rc.config.d/namesvrs
Run Scripts
Sample File
/sbin/init.d/nis.server
/etc/rc.config.d/namesvrs
/sbin/init.d/nis.client
NIS_MASTER_SERVER=1
NIS_SLAVE_SERVER=0
NIS_CLIENT=1
NIS_DOMAIN=
YPBIND_OPTIONS=“” .
YPSET_ADDR=“”
nis_master
nis.slave
nis_client
defaults
nis domain
ypbind.options
address of nis server
a6988

7. NIS Daemons NIS Server NIS Slave NIS Client
9/4/2018
NIS Daemons
NIS Server
NIS Slave
NIS Client
ASCII Files
NIS Maps
NIS Maps
portmap (HP-UX and earlier)
rpcbind (HP-UX and beyond)
portmap (HP-UX and earlier)
rpcbind (HP-UX and beyond)
portmap/rpcbind
ypbind
ypserv
ypserv
keyserv
ypxfrd
ypxfrd
rpc.yppasswdd
keyserv
rpc.ypupdated
ypbind
keyserv
ypbind
a673114

8. Configuring NIS — Major Steps
9/4/2018
Configuring NIS — Major Steps
1. Create an NIS master server.
a. domainname [domain]
b. ypinit -m
(Answer questions.)
c. vi /etc/rc.config.d/namesvrs
(Edit appropriate NIS variables.)
d. shutdown -r
2. Create an NIS slave server (optional).
b. ypinit -s [master_server]
3. Create the NIS clients.
a. vi /etc/rc.config.d/namesvrs
b. shutdown -r
a673115

9. Changing Passwords on an NIS Node
9/4/2018
Changing Passwords on an NIS Node 3 2 1
passwd.byname
NIS Maps
/etc/passwd
passwd
passwd.byuid
NIS Maps
Client
Master Server
$ passwd
Changing passwd for jim
Old NIS password: *****
New Password: ******
Retype new password: ******
1. An NIS user issues the passwd command to change his or her password.
2. The /etc/passwd file on the NIS master server is updated to reflect the new password.
3. The corresponding NIS maps are regenerated
to reflect the new password.
a673116

10. Updating and Propagating Maps on the Master Server
9/4/2018
Updating and Propagating Maps on the Master Server 4 3 2 1
# /var/yp/ypmake hosts
vi /etc/hosts
ypmake hosts
hosts.byname
NIS Maps
hosts.byaddr
NIS Maps
/etc/hosts
Master Server
Slave
1. The system administrator adds a new host to the /etc/hosts file.
2. The ypmake hosts command is executed on the NIS master server.
3. The corresponding NIS maps are regenerated
to reflect the new entries.
4. The NIS maps are automatically pushed to
any slave servers (if they exist).
# vi /etc/hosts
[Modify contents and save]
# /var/yp/ypmake hosts
a673117

11. Fetching Maps from the Master Server
9/4/2018
Fetching Maps from the Master Server
NIS Slave
NIS Maps
NIS Master
ASCII Files
NIS Maps
The ypxfr command
- copies an NIS map from the master server to a slave
- must be invoked on the slave server
- transfers the map only if the master copy is more recent than the local copy
The ypxfr command can be executed
- interactively, running the command on the slave server
- periodically, running the command from cron on each slave server
- periodically, running the yppush command on the master server (yppush on the master server calls ypxfr on the slave)
a673118

12. Restricting Access to NIS Clients and Slave Servers
9/4/2018
Restricting Access to NIS Clients and Slave Servers
/etc/nsswitch.conf
/etc/passwd
passwd: files nis
group: files nis
root:...
user1:...
user2:...
Who can log in?
all users in local passwd file
all users in NIS passwd map
/etc/nsswitch.conf
/etc/passwd
passwd: compat
group: compat
root:...
user1:...
user2:...
+hubert
+cleo
Who can log in?
all users in local passwd file
cleo and hubert from NIS map
a673119

13. Restricting Access to the Master Server
9/4/2018
Restricting Access to the Master Server
Use an alternate password file as the source for the password
maps and reduce /etc/passwd on the master server.
1. Create an alternate password file as the source for the maps.
2. Reduce the /etc/passwd file and add escape entries.
3. Add passwd:compat and group: compat to
/etc/nsswitch.conf.
4. Modify YPPASSWDD_OPTIONS in /etc/rc.config.d/namesvrs.
5. Stop and start NIS server functionality.
6. Modify the PWFILE variable in /var/yp/ypmake.
7. Rebuild and propagate the new password maps.
a6989

14. NIS+ versus NIS Advantages of NIS+ NIS+ works with trusted systems.
9/4/2018
NIS+ versus NIS
Advantages of NIS+
NIS+ works with trusted systems.
A host in any domain can access information (hosts, usernames) in
other domains.
The scalability of NIS+ is unlimited; there is no limit to number of domains.
NIS+ is not limited by subnet boundaries; a server on every subnet is
not necessary.
NIS+ contains greater security, including passwords for clients to join
a domain
Disadvantages of NIS+
NIS+ features are complex.
Certain NIS+ administrative tasks are complex.
a673121

15. sales.acme.com Domain (Subdomain)
9/4/2018
Sample NIS+ Namespace
acme.com Domain (Root Domain)
Client
Client
Root Master Server
Root Replica Server
Client
Client
Client
Client
Master Server
Replica Server
Master Server
Replica Server
Client
Client
Client
Client
engr.acme.com Domain
(Subdomain)
sales.acme.com Domain (Subdomain)
a673122