Centralized Authorization Using a Directory Service, Part II

Get a handle on administering who can log in where, with a proven, reliable centralized directory.

to the file /etc/sysconfig/network.

Restrict access to your new NIS server by creating a file /var/yp/securenets with the content:

# netmask       # network
255.255.255.0   192.168.0.0

This is a crucial security step. The world is able to query your NIS server if you don't have this file.

The next step is to define the things you would like to put into NIS. For the purpose of authorization, the /etc/group and /etc/passwd files as well as something called netgroup are sufficient. However, many more things are possible. To get an idea, have a look at the file /var/yp/Makefile on your NIS server.

Below, I show how the three files I've mentioned are configured to be distributed by way of NIS.

Adjust the Makefile generating the NIS map database files:

# cp /var/yp/Makefile /var/yp/Makefile.save
# vi /var/yp/Makefile

Change the following two entries from true to false to prevent the merging of passwd and shadow files as well as group and gshadow files:

MERGE_PASSWD=false
MERGE_GROUP=false

Change the directory name where NIS should look for its data sources:

YPSRCDIR = /etc/NIS
YPPWDDIR = /etc/NIS

Comment all files from which the NIS databases should not be built. I left only these three files:

GROUP       = $(YPPWDDIR)/group
PASSWD      = $(YPPWDDIR)/passwd
NETGROUP    = $(YPSRCDIR)/netgroup

Comment the line starting with all: that contains the list of all potential NIS maps. Add the new line:

all:	passwd group netgroup

Watch out for TAB characters. In a Makefile, you must use only TAB characters, not spaces, to indent commands.

Now, create the data source directory defined in the Makefile:

# mkdir /etc/NIS/
# chmod 700 /etc/NIS

and put a passwd file in there:

# grep -v '^root' /etc/passwd > /etc/NIS/passwd

You should remove not only the root account but all system accounts from this file and leave only the real user accounts.

If you still are using /etc/passwd with encrypted passwords, it now is time to convert them to Kerberos 5, as described in the previous article [LJ, February 2005]. If you don't do this, your encrypted passwords are exposed on the network when the passwd file is distributed to the slave NIS servers or to the NIS clients.

Now, collect the local /etc/passwd files from all the machines that are to be members of your new NIS domain. Remove all system accounts and then merge them together with:

% cat passwd_1 passwd_2 passwd_3 ... > passwd_merge

Remove all duplicate entries with this command:

% sort passwd_merge | uniq > passwd_uniq

Check the consistency of the remaining entries with:


% cut -d':' -f1 passwd_uniq | sort | uniq -c | \
egrep -v "\s*1"

If this produces any output, you have two different entries with the same account name. If the difference is not in the UID or GID field, simply decide on one of the entries and remove the other one. If the difference is the UID or GID field, you need to resolve this conflict, which can be rather complex.

Another consistency check is to see whether any two different accounts have the same UID, which is the case if this command:


% cut -d':' -f3 passwd_uniq | sort | uniq -c | \
egrep -v "\s*1"

produces any output; the second number in the output is the duplicate UID. Resolving this conflict again can be rather complex. Do the same kind of merging and checking for all your /etc/group files.

Copy the resulting files to /etc/NIS/passwd and /etc/NIS/group. I will return to the netgroup file later. Leave it out for now.

Now, start your master NIS server with:

# service ypserv start

Initialize the NIS maps with the command:

# /usr/lib/yp/ypinit -m

and follow the printed instructions.

In order to have all the NIS maps available to your NIS master server, you probably want to set up this machine as an NIS client as well. Make sure this NIS client can bind only to the NIS master as server in order to prevent circular dependencies when booting all your machines, as after a power outage.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Part I Please

shann's picture

can you post the link for the Part I of this article?

thanks & regards
shann
massoo@30gigs.com
massoo@gmail.com

Links

Pasamio's picture

Central Authentication with Kerberos 5
http://www.linuxjournal.com/article/7336 (Part I)

Centralized Authorization Using a Directory Service
http://www.linuxjournal.com/article/7334 (Part II)

AFS - A Secure Distributed Filesystem
http://www.linuxjournal.com/article/7521 (Part III)

Was a bit confusing since the article titles are all different.

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState