What is NIS?
Network Information Service (NIS) is used for keeping a centralized repository of users, hostnames and other useful information in a computer network. In single server UNIX environments, the list of users and groups is usually kept in a file such as /etc/passwd. Using NIS adds a "global" directory which is used for authenticating users from any host on the network.
Install the Packages:
Install the yp-tools, ypbind and ypserv rpm packages on the server.
[root@nissrv1 /]# rpm -qa |grep ypbind
ypbind-1.12-5.21.6
[root@ nissrv1 /]# rpm -qa |grep ypserv
ypserv-2.8-7
[root@ nissrv1 /]# rpm -qa |grep yp-tools
Edit the /etc/sysconfig/network file We need to add the NIS domain name we wish to use in the /etc/sysconfig/network file.
For this example, we will call the domain "LINUX-NIS".
#/etc/sysconfig/networkNISDOMAIN="LINUX-NIS" Note: Use Non-FQDN Names.Edit /etc/hosts file as well to make the server using Non-FQDN name.NIS servers also need to be NIS clients themselves, so we will have to edit the yp.conf to point this file towards the server itself, or localhost.
# /etc/yp.conf - ypbind configuration fileypserver 127.0.0.1
NIS Server Daemons:The following is a list of NIS server daemons and their functionality.
DAEMON NAME | PURPOSE |
portmap | The foundation service for RPC |
yppasswdd | Allows users to change their NIS passwords |
ypserv | NIS server daemon |
ypbind | NIS client daemon |
ypxfrd | The NIS map transfer daemon |
Starting the NIS Server Related Daemons:
We now need to start a couple of the NIS daemons in the /etc/init.d directory. In this case we will only be starting the portmap, yppasswdd, and ypserv daemons so that we can initialize the NIS domain.On RHEL we would issue the following commands:
[root@nissrv1]# /etc/init.d/portmap startStarting portmapper: [ OK ] [root@nissrv1]# /etc/init.d/yppasswdd startStarting YP passwd service: [ OK ] [root@nissrv1]# /etc/init.d/ypserv startSetting NIS domain name LINUX-NIS: [ OK ]Starting YP server services: [ OK ] [root@nissrv1]# chkconfig portmap on[root@nissrv1]# chkconfig yppasswdd on[root@nissrv1]# chkconfig ypserv on
We need to make sure these daemons are running before continuing to the next step. We can use the rpcinfo command to do this: [root@nissrv1]# rpcinfo -p localhost
program vers proto port 100000 2 tcp 111 portmapper 100000 2 udp 111 portmapper 100009 1 udp 681 yppasswdd 100004 2 udp 698 ypserv 100004 1 udp 698 ypserv 100004 2 tcp 701 ypserv 100004 1 tcp 701 ypserv
The ypbind and ypxfrd might be listed as running, even though they do not start properly until after the initialization of the NIS domain. If they are running, we will restart these daemons after the domain initialization is completed.Initializing the NIS Domain:
Now that we have decided on the name of the NIS domain, we will have to use the ypinitcommand to create the associated authentication files for the domain. We will be prompted for the name of the NIS server, which in this case is nis-server.
[root@nissrv1]# /usr/lib/yp/ypinit -m
At this point, we have to construct a list of the hosts which will run NIS servers. nissrv1 is in the list of NIS server hosts. We must continue to add the names for the other hosts, one per line. When we are done with the list, simply type "a". next host to add: nissrv1next host to add:The current list of NIS servers looks like this:nissrv1Is this correct? [y/n: y] yWe need a few minutes to build the databases...Building /var/yp/LINUX-NIS/ypservers...Running /var/yp/Makefile...gmake[1]: Entering directory `/var/yp/LINUX-NIS'Updating passwd.byname...Updating passwd.byuid...Updating group.byname...Updating group.bygid...Updating hosts.byname...Updating hosts.byaddr...Updating rpc.byname...Updating rpc.bynumber...Updating services.byname...Updating services.byservicename...Updating netid.byname...Updating protocols.bynumber...Updating protocols.byname...Updating mail.aliases...gmake[1]: Leaving directory `/var/yp/LINUX-NIS'nissrv1 has been set up as a NIS master server.
Now we can run ypinit -s nissrv1 on all slave servers (If we have any slave NIS servers). Note: Make sure portmap is running before trying this step or you'll get errors, such as:
failed to send 'clear' to local ypserv: RPC: Port mapper failureUpdating group.bygid...
You will have to delete the /var/yp/LINUX-NIS directory and restart portmap, yppasswd, and ypserv before you'll be able to do this again successfully.Start The ypbind and ypxfrd Daemons:
On Redhat, you can now start the ypbind and the ypxfrd daemons because the NIS domain had been initialized and the files have been created.
[root@nissrv1]# /etc/init.d/ypbind startBinding to the NIS domain: [ OK ]Listening for an NIS domain server.
[root@nissrv1]# /etc/init.d/ypxfrd startStarting YP map server: [ OK ]
[root@nissrv1]# chkconfig ypbind on
[root@nissrv1]# chkconfig ypxfrd on
Verify the Daemons Are Running:
All the NIS daemons use RPC port mapping and, therefore, are listed using the rpcinfo command when they are running correctly.
[root@nissrv1]# rpcinfo -p localhost program vers proto port 100000 2 tcp 111 portmapper 100000 2 udp 111 portmapper 100003 2 udp 2049 nfs 100003 3 udp 2049 nfs 100021 1 udp 1024 nlockmgr 100021 3 udp 1024 nlockmgr 100021 4 udp 1024 nlockmgr 100004 2 udp 784 ypserv 100004 1 udp 784 ypserv 100004 2 tcp 787 ypserv 100004 1 tcp 787 ypserv 100009 1 udp 798 yppasswdd 600100069 1 udp 850 fypxfrd 600100069 1 tcp 852 fypxfrd 100007 2 udp 924 ypbind 100007 1 udp 924 ypbind 100007 2 tcp 927 ypbind 100007 1 tcp 927 ypbind
Adding New NIS Users:
New NIS users can be created by logging into the NIS server and creating the new user account. Edit passwd and shadow files on NIS directory to add user accounts. Once this is complete, you then have to update the NIS domain's authentication files by executing the make command in the /var/yp directory.
This procedure makes all NIS-enabled, nonprivileged accounts become automatically accessible via NIS, not just newly created ones. It also exports all the user's characteristics stored in thepasswd and group files, such as the login shell, the user's group, and home directory.
You can check to see if the user's authentication information has been updated by using theypmatch command, which should return the user's encrypted password string.
[root@nissrv1]# ypmatch nisuser passwdnisuser:$1$d6E2i79Q$wp3Eo0Qw9nFD/::504:100::/home/nisuser:/bin/bash
You can also use the getent command, which has similar syntax. Unlike ypmatch, getentdoesn't provide an encrypted password when run on an NIS server, it just provides the user's entry in the passwd file. On a NIS client, the results are identical with both showing the encrypted password. [root@nissrv1]# getent passwd nisusernisuser:x:504:100::/home/nisuser:/bin/bashCourtesy:LazysystemAdmin