Centralized Authorization Using a Directory Service, Part II
to the file /etc/sysconfig/network.
Restrict access to your new NIS server by creating a file /var/yp/securenets with the content:
# netmask # network 255.255.255.0 192.168.0.0
This is a crucial security step. The world is able to query your NIS server if you don't have this file.
The next step is to define the things you would like to put into NIS. For the purpose of authorization, the /etc/group and /etc/passwd files as well as something called netgroup are sufficient. However, many more things are possible. To get an idea, have a look at the file /var/yp/Makefile on your NIS server.
Below, I show how the three files I've mentioned are configured to be distributed by way of NIS.
Adjust the Makefile generating the NIS map database files:
# cp /var/yp/Makefile /var/yp/Makefile.save # vi /var/yp/Makefile
Change the following two entries from true to false to prevent the merging of passwd and shadow files as well as group and gshadow files:
Change the directory name where NIS should look for its data sources:
YPSRCDIR = /etc/NIS YPPWDDIR = /etc/NIS
Comment all files from which the NIS databases should not be built. I left only these three files:
GROUP = $(YPPWDDIR)/group PASSWD = $(YPPWDDIR)/passwd NETGROUP = $(YPSRCDIR)/netgroup
Comment the line starting with all: that contains the list of all potential NIS maps. Add the new line:
all: passwd group netgroup
Watch out for TAB characters. In a Makefile, you must use only TAB characters, not spaces, to indent commands.
Now, create the data source directory defined in the Makefile:
# mkdir /etc/NIS/ # chmod 700 /etc/NIS
and put a passwd file in there:
# grep -v '^root' /etc/passwd > /etc/NIS/passwd
You should remove not only the root account but all system accounts from this file and leave only the real user accounts.
If you still are using /etc/passwd with encrypted passwords, it now is time to convert them to Kerberos 5, as described in the previous article [LJ, February 2005]. If you don't do this, your encrypted passwords are exposed on the network when the passwd file is distributed to the slave NIS servers or to the NIS clients.
Now, collect the local /etc/passwd files from all the machines that are to be members of your new NIS domain. Remove all system accounts and then merge them together with:
% cat passwd_1 passwd_2 passwd_3 ... > passwd_merge
Remove all duplicate entries with this command:
% sort passwd_merge | uniq > passwd_uniq
Check the consistency of the remaining entries with:
% cut -d':' -f1 passwd_uniq | sort | uniq -c | \ egrep -v "\s*1"
If this produces any output, you have two different entries with the same account name. If the difference is not in the UID or GID field, simply decide on one of the entries and remove the other one. If the difference is the UID or GID field, you need to resolve this conflict, which can be rather complex.
Another consistency check is to see whether any two different accounts have the same UID, which is the case if this command:
% cut -d':' -f3 passwd_uniq | sort | uniq -c | \ egrep -v "\s*1"
produces any output; the second number in the output is the duplicate UID. Resolving this conflict again can be rather complex. Do the same kind of merging and checking for all your /etc/group files.
Copy the resulting files to /etc/NIS/passwd and /etc/NIS/group. I will return to the netgroup file later. Leave it out for now.
Now, start your master NIS server with:
# service ypserv start
Initialize the NIS maps with the command:
# /usr/lib/yp/ypinit -m
and follow the printed instructions.
In order to have all the NIS maps available to your NIS master server, you probably want to set up this machine as an NIS client as well. Make sure this NIS client can bind only to the NIS master as server in order to prevent circular dependencies when booting all your machines, as after a power outage.
Practical Task Scheduling Deployment
July 20, 2016 12:00 pm CDT
One of the best things about the UNIX environment (aside from being stable and efficient) is the vast array of software tools available to help you do your job. Traditionally, a UNIX tool does only one thing, but does that one thing very well. For example, grep is very easy to use and can search vast amounts of data quickly. The find tool can find a particular file or files based on all kinds of criteria. It's pretty easy to string these tools together to build even more powerful tools, such as a tool that finds all of the .log files in the /home directory and searches each one for a particular entry. This erector-set mentality allows UNIX system administrators to seem to always have the right tool for the job.
Cron traditionally has been considered another such a tool for job scheduling, but is it enough? This webinar considers that very question. The first part builds on a previous Geek Guide, Beyond Cron, and briefly describes how to know when it might be time to consider upgrading your job scheduling infrastructure. The second part presents an actual planning and implementation framework.
Join Linux Journal's Mike Diehl and Pat Cameron of Help Systems.
Free to Linux Journal readers.Register Now!
- SUSE LLC's SUSE Manager
- My +1 Sword of Productivity
- Murat Yener and Onur Dundar's Expert Android Studio (Wrox)
- Managing Linux Using Puppet
- Non-Linux FOSS: Caffeine!
- Doing for User Space What We Did for Kernel Space
- SuperTuxKart 0.9.2 Released
- Parsing an RSS News Feed with a Bash Script
- Google's SwiftShader Released
- Rogue Wave Software's Zend Server
With all the industry talk about the benefits of Linux on Power and all the performance advantages offered by its open architecture, you may be considering a move in that direction. If you are thinking about analytics, big data and cloud computing, you would be right to evaluate Power. The idea of using commodity x86 hardware and replacing it every three years is an outdated cost model. It doesn’t consider the total cost of ownership, and it doesn’t consider the advantage of real processing power, high-availability and multithreading like a demon.
This ebook takes a look at some of the practical applications of the Linux on Power platform and ways you might bring all the performance power of this open architecture to bear for your organization. There are no smoke and mirrors here—just hard, cold, empirical evidence provided by independent sources. I also consider some innovative ways Linux on Power will be used in the future.Get the Guide