Security Issues NIS Management

• Occasionally, you will need to force a rebuild and push of some of the NIS maps. The simplest way is to change the timestamp of the corresponding source file there is no need to modify the file itself, and then to follow the usual procedure for a map update. Of course, everything happens at the master server, for example: touch etcpasswd cd varyp make passwd •

17.3.4 Security Issues

NIS is an extremely helpful network service and is widely used and supported by all UNIX flavors. However, it is also fair to say that NIS does have some inherent security holes that make it more vulnerable to potential intruders. The NIS security drawback is so acute that sometimes NIS is not even allowed to be considered as an option. This is the case with networks where security is the most important issue and has the highest priority. There is no magic formula to define the security boundaries for the safe NIS usage. This decision remains to the designers and administrators of each individual subnetwork; there is always a tradeoff between NIS advantages and disadvantages. The following text points to the two major NIS−related security issues. The first disadvantage is that NIS makes all encrypted passwords visible. Even though NIS servers and clients hide local encrypted passwords in the etcshadow file, making them invisible to potential intruders, NIS advertise them on the network. NIS uses encrypted passwords for the authentication of NIS users, and they are transferred over the network within the NIS passwd map — first when it is pushed to slave servers, but also whenever an NIS client queries for the password to authenticate a specific user. The fact that the passwd map includes encrypted passwords also means that any user can read the map and get this data. For example: ypcat passwd tthacker:aQ0mpUfu7OuGs:2889:1034:Tom Thacker:hometthacker:binksh selliott:eDZUQCN5X3ylY:2873:1034:Sam Elliott:homeselliott:binksh lcreasey:BcJdCeqYm7O8U:2530:1034:Lean Creasey:homelcreasey:binksh jjohnsto:RNJtQ4wiaBBs:3036:1019:John Johnston:homejjohnsto:binksh ..... ..... root:J.WEn2PxKhlbg:0:1:Operator::binksh ..... ..... This command will display all data about all NIS users, including the encrypted passwords; even the superuser data at the master server will be posted. For an intruder, this is a good starting point to try to break a password. 420 Let us suppose an intruder has built a fake NIS server in your network. This server is not in the ypservers map, but this map only restricts pushing of the data from the master server toward slave servers. The fake server has fake maps, sufficient to break into the client host. Once the intruder gains control of the real client host, the rest of the job becomes much easier. It should not be easy to build a fake server in the network that you administer. Regular checkups should prevent such attempts. But to prevent something you must first be aware of such a possibility, and that was the purpose of this text.

17.3.5 A Few NIS Stories