The etcnetgroup File DatabasesNIS Maps

The format of NIS maps is known as ndbm; the ndbm format is suitable for fast machine searching, but it is not readable; NIS maps are adopted to machines, not to human beings. Each NIS map actually includes two files identified with the extensions dir and pag. We will return to the ndbm format later. Once NIS is running, references to the local administrative files are handled in two fundamentally different ways: The NIS maps replace files; local files are ignored. These include the following files: ethers, netmasks, networks, protocols, rpc, services, and netgroup the last one is a special case. 1. NIS maps append to some files; the files are read first, and only if the appropriate entry is not found will the NIS maps be queried. These include the following files: passwd, bootparams, group, and aliases. 2. Traditionally to append an NIS map, the corresponding file had to include an NIS marker entry as the last configuration line. This is a special entry that starts with the plus sign +, followed by the colon separator to make it fit the syntax of the file. The plus sign indicates that more data can be found in the corresponding NIS map. Even for modern UNIX flavors that handle this differently, the plus sign does no harm. By appending an NIS map to the file, it is possible to specify local configuration data applicable only to the specific client−host and make it different from other NIS hosts. In this case, centralized NIS databases include global data, while needed exceptions could easily be realized through the local data. For example, certain users could be authenticated only locally and have access only to certain hosts, not to each host in the NIS domain. Make sure that the superuser authentication is always provided locally, independently of the NIS settings. The root password is too sensitive an issue to be uniform all over the network. If it were, the root password from the master server would be valid everywhere; it would be too much

17.2.5.1 The etcnetgroup File

One of the first network−specific issues that NIS addressed was the so−called network group. In the network environment, there is a real need to group and uniquely identify users from different hosts and different parts of the network because they share something in common; they could be involved in the same project, or share the same information space, or whatever. NIS offered a solution in the form of the netgroup. The NIS map netgroup was introduced, as well as the new source configuration file for that purpose etcnetgroup. Obviously this file has a sense only if NIS is running, and more precisely, the file has 412 The basic format of an entry in the etcnetgroup file is: groupname member [member] … where groupname Any name assigned to a netgroup. member An item included in the group, which can be: Another netgroup • Individual item defined by the triple: hostname, username, domainname • An omitted argument in the domainname field indicates the netgroup is valid in the current NIS domain; a hyphen − in the hostname and username fields means that no value is included.

17.3 NIS Management

Once NIS is set, it works quite well, hidden from users and in some ways even hidden from administrators. However, as everything else, NIS also requires maintenance — checking the NIS status and modifying and updating the NIS database are regular administrative duties. NIS is an extremely useful network service, but sometimes NIS can cause a lot of headaches. Usual UNIX commands cannot be efficiently used; that is why NIS has introduced a number of new commands to handle NIS processes and maps in order to make this management easier. Today these commands are mostly standard on every UNIX platform. A brief survey of some useful NIS−specific commands follows.

17.3.1 yp Commands

The NIS−specific commands we will call them yp −related commands live in several directories, most often bin, usrsbin, and usrlibnetsvcyp. It is very easy to recognize these commands; they start with the prefix yp. The following table briefly describes the commands the command layout is from Solaris 2.x; some differences are possible on other UNIX flavors: yp Command Description binypcat Prints all values in an NIS map; the −k option is required for the ypservers map: ypcat −k ypservers binypmatch Prints values of selected keys in an NIS map, for example to display password data for the user bjl: 413