View source for YP / NIS / NIS+ notes

{{#addbodyclass:tag_tech}}
{{ShellsAndAdmin}}

YP (Yellow Pages) / NIS (Network Information Service) is an RPC-style system that lets you synchronize system configuration between hosts, and seems primarily used specifically to handle simple centralized '''accounts''' {{comment|(for logins, or or just to keep UIDs and GIDs synchronized)}}.


Generally, NIS and YP refers to version 2, NIS+ to NIS version 3, but not everyone uses the terms very precisely, so check.


Upsides: 
* eases managementy in, say, a cluster or just using NFS, or a bunch of workstations you want to cooperate tightly.

Downsides:
* it's an extra step on top of your usual per-host management (some parts are relatively manual)
* doesn't scale very nicely to very large setups,
* not all implementations are terribly secure
...so in large setups also see other systems<!--, such as those based on [[LDAP]]-->.

<!--
YP has a learning curve, largely because when you centralize users, you often also want to another half dozen other things.
-->


==What it can do==
<!--

: '''Centralized authentication'''
A server node's /etc/passwd, /etc/shadow, /etc/group, and such are parsed into a format YP likes, 
and served via ypserv {{comment|(with possible extra hosts running it as duplication/backup)}}.


: '''Other auth'''
Other services that require authentication may need to be set up and/or synchronized as well.

For example, you can tell [[Samba]] to authenticate from NIS.



: '''Centralized account storage'''

You may well want to network-mount user's home directory.

It helps to put all the user accounts on NFS storage.
Aside from avoiding any synch problems related to individual home dirs and documents,
it also means you don't have to do backups from each client machine.

It does mean you have to deal with NFS (auto)mounts.

NIS helps here, because NFS and other network filesystems depend on the UID/GID meanings being consistent between hosts.



: '''trust between hosts'''
In specific situation, such as clusters,
you may wish for passwordless login (also scp/sftp/rsync) to all other nodes, using trust via SSH keypairs

This is simple when homedirs are remote-mounted (e.g. with NFS), 
because it comes down to making an account trust ''itself''.


-->

==Concepts==
<!--

NIS version 2 is often referred to as yp or nis,
NIS version 3 is often referred to as nisplus or nis+

* Map

-->
==Parts==
<!--
* ypserv - looks in local NIS map, serves it
* ypinit - sets up NIS map
* yppasswdd - daemon that yppasswd connects to. (stores to file, which has the same format as /etc/passwd{{verify}})

* ypbind - a daemon that various other commands connect to, and which itself contacts a ypserv
* yppush - instructs slave servers to update their maps
** reads servers from /var/yp/DomainName/ypservers.{dir,pag}
* ypcat - prints a NIS map
* ypmatch - prints keys from within NIS map [http://h30097.www3.hp.com/docs/base_doc/DOCUMENTATION/V50A_HTML/MAN/MAN1/0439____.HTM]
* yppasswd - change password for user
* yppoll - via ypserv
* ypupdated - updates information in NIS map

* ypset - points host to specific server

* ypwhich - identify master for a NIS map



* ypxfr - transfer NIS map from server to local


makedbm 




In more detail:
* NIS clients run ypbind (responsible for knowing how to contact the server)
** which will contact the server(s) listed in /etc/yp.conf
** (note: many NIS servers are also NIS clients)

* <tt>/etc/nsswitch.conf</tt> is used to hook the relevant lookups to use YP instead of (or before) its local files.

* yp_bind() call, which itself contacts
** local ypbind
** local portmap
** remote ypserv


See e.g. [http://www.linux-nis.org/nis-howto/HOWTO/settingup_client.html this about setting up clients]




-->

==Problems==
<!--

===Slowness===
YP can be slow to handshake, which can slow down other things, such as UID/GID resolution.

Since it's generally configured 
For some things you can make it use local files before nos

-->

===ypserv: refused connect from &lt;ip&gt; to procedure  ypproc_''something''===

<!--
Primarily points to connection problems, for example:
* portmap isn't running on one side.

* multiple subnets on a server, not all serve maps

* If the listed client point is &ge;1024, look at <tt>ypserv.conf</tt> (and its man page) - you may have rules set to <tt>port</tt>, where you probably want <tt>none</tt>



The bracketed part of the error can also be an indication.
* nisname,passwd.byname;0

* -1 seems to signal something doesn't exist -- which in some cases is a client checking ''whether'' it exists so is not a problem ''if'' 


Specific lookups (UID, GID, )
 ypproc_match

Occasional:
 ypproc_all
 ypproc_domain





http://people.csse.uwa.edu.au/ryan/tech/nis.html

http://techpubs.sgi.com/library/dynaweb_docs/0620/SGI_Admin/books/NIS_AG/sgi_html/

https://wiki.archlinux.org/index.php/NIS

http://www.linux-nis.org/doc/nis.debian.howto


http://www.tldp.org/HOWTO/NIS-HOWTO/settingup_client.html


http://wiki.eri.ucsb.edu/sysadm/NIS
-->