Ooops, I did not see the first response. Heh, anyway, both methods work.

Ok! One more Quick Doubt. If I set up a password for a new user using passwd and do a make, the user can log in initially with the password. If he changes his password and does a passwd would it just change the /etc/shadow file or will ypxfr and ypupdate take care of updating the NIS maps when some one does a passwd.


Thanks.

I believe if he is one any machine but the master NIS server it will change his NIS password. If it is done on the Master NIS server it will only affect the local /etc/shadow file unless that is your actual NIS map. (ie: you did not move it to a subdirectory somewhere)

You can explicitly specify what password to change as well:

passwd -r files   # this will only affect the local /etc/passwd and /etc/shadow files.
passwd -r nis     # will change NIS password
yppasswd          # will change NIS password

Do a 'man passwd' for a full list of options.

-Chuck

I understand that a Solaris system running as a NIS client will automatically route password changes through NIS, so that changes are made to the NIS passwd file. We reset user's passwords for them using the passwd command as root on the NIS master.

However if the client is of another flavour you may have to use the yppasswd command (Irix for certain) as passwd only affects the local files.

Yea, under Linux you will have to use yppasswd. I was assuming you were using Solaris since this was the Solaris group.

Hope this help.
CC

Ok I am increasing 20 more points as I didnt want to create a new thread. ypcat passwd as a normal user is showing the encrypted passwords. Does NIS believes that all its users to be good?  (or) Am I missing something here?

Thanks..

ypcat merely lists the values in the corresponding NIS map. So doing a 'ypcat passwd' is essential the same as 'cat /etc/passwd' on a non-NIS system.

Every user retured from 'ypcat passwd' is a valid NIS user provided the user has a corresponding entry in the shadow file on this NIS server and it is not locked. Also, if you are using netgroups you can also control user access.

As root, just try to 'su - <username>' of a user that is only defined in NIS.

Oh yea, one last thing. Each nis client needs to have /etc/nsswitch.conf updated to use nis.

-Chuck

That's NIS, NIS+ is more secure, and easier to manage. I agreed with the following statements:

#------------------------------------------------------------------------------------------------------
With NIS you get the encrypted passwords in a publicly readable NIS
      map, so you loose the security you got with /etc/shadow where the
      passwords were not readable by ordinary users.  With NIS any user can
      ypcat passwd and save the output to file. And then run crack....
      Besides, if you don't have a properly set up firewall, then anyone on
      the net who can guess your NIS domain name can connect to your NIS
      servers and fetch the maps...
      
      With NIS+ it depends on the authentication level. If it runs at the
      lowest level (or NIS compatibility mode) security is no better than
      with NIS. In a pure NIS+ environment you have access bits on each
      table, row column and cell. So the encrypted passwd field in the passwd
      map will only be readable to admin users and the user who owns the
      password.  Ordinary users will not see other users encrypted
      passwords.  The NIS+ servers also requires that the client machines
      authenticate themselves before they can do NIS+ lookups.

To read the Full DOC:

http://aa11.cjb.net/sun_managers/1999/11/msg00543.html

#-------------------------------------------------------------------------------------------------------

Information about how to setup NIS+ and use it (step by step instructions, very good):

http://www.eng.auburn.edu/users/rayh/solaris/NIS+_FAQ.html

Ok! As soon as posted this Encrypted password thing I logged on to some machine which uses NIS(other domain) and did a ypcat passwd. I can even get the root password ,ofcourse so is the one I am on.  So the bottomline is either believe your users to be good/upgrade to NIS+. My /etc.nsswithc.conf is good.

Thanks.

I couldnt accept 2 answers one for the make and for the ypcat passwd. Both of you guys are great!