YABAN (Yet Another Blog About NIS) - Part 2 - NIS Master setup
NIS Master Setup and Required software
We are now ready to get started with the actual configuration of NIS in our little Data Center. The config files involved for a NIS Master setup is:
/etc/yp.conf/etc/sysconfig/network
/etc/ypserv.conf
/etc/nsswitch.conf
/etc/idmapd.conf
/var/yp/securenets
/etc/hosts.allow
/var/yp/ypservers (will be created and populated by ypinit)
Check if ypserv is installed in all machines using NIS.
If it is not installed use yum install ypserv to install it, or use the rpm to install it directly. You don’t have yum configured you can just go to public-yum.oracle.com, It has all the details and it’s just one command to run as root.
You also need nfs-utils and yp-tools but they would typically already be there. If not install with:
yum install nfs-utilsyum install yp-tools
2. Define Domain Name and Servers servicing the domain
NIS needs a NIS domain name to service. This domain name is used when a client broadcasts it’s request for info. You can view NISDOMAIN and domainname as simple group names used for NIS members. It is not recommended that you use the network/dns (us.oracle.com in my example here) domain name defined for the compute nodes as NISDOMAIN.
NISDOMAIN and domainname only referes to NIS/YP configurations. It has nothing to do with the computers real dns domain. This is true for linux and the recommendation is to NOT set them to be the same as the dns domain as it can make debugging more complicated.
However, for Solaris I’m told that NISDOMAIN & domainname must be set to be the same as the DNS domain of the computer.
Edit /etc/yp.conf to add the name of the NIS domain and the NIS servers (master and slaves). Additionally you can define the IP/hostname to use for the ypserver process, by default ypserver will bind to IP that hostname resolves to. If you define the ypserver, note that the slave server(s) should use the slave server IP/hostname for ypserver (it should point to itself).
Example (this shows the NIS Master):
domain us.oracle.com server nis1.us.oracle.com
domain us.oracle.com server nis2.us.oracle.com
3. Define NIS Domain for the compute node
Edit /etc/sysconfig/network to define the NIS Domain that will be used by the compute node.
NETWORKING=yes
NETWORKING_IPV6=no
HOSTNAME=nis1
NISDOMAIN=us.oracle.com
domainname=us.oracle.com
This definition ensures that the NISDOMAIN and domainname is set when the server starts.
The only time the NIS domain is set is if you have ypbind enabled (e.g.”chkconfig ypbind on” & “service ypbind start”). The ypbind script will scan /etc/sysconfig/network, /etc/sysconfig/ypbind or /etc/yp.conf so you can put the NISDOMAIN definition in any of those files.
4. Validate configuration for ypserv
Edit /etc/ypserv.conf to ensure the following entries exist.(File normally exists with the specified entries defined by default. However, it is possible that it may not have these entries until the service is started)
dns: nofiles: 30
xfr_check_port: yes
* : * : shadow.byname : port
* : * : passwd.adjunct.byname : port
5. Define how lookups reference NIS
You will likely need to add the sections identified in bold (they are not located together in the file)
passwd: files nis
shadow: files nis
group: files nis
automount: files nis nisplus
aliases: files nis nisplus
6. Limit Access to specific subnets
This configuration authorizes only a single subnet to authenticate with the NIS server. It is optional but strengthens the security of NIS.
Create /var/yp/securenets Add the following lines:
host 127.0.0.1
255.255.255.0 192.168.24.0
You can also specifically list the hosts (instead of the subnet range as shown above) allowed to authenticate with NIS.
7. Specify Hosts allowed to access NIS maps
Edit /etc/hosts.allow to specify IP addresses allowed. Example:
# hosts.allow This file describes the names of the hosts which are
# allowed to use the local INET services, as decided
# by the ‘/usr/sbin/tcpd’ server.
#
portmap : 127. : allow
portmap : 192.168.24. : allow
portmap : ALL : deny
Here again, the IPs specified would be specific to your deployment. Purpose of the above setting is to force the NIS lookup to only use the specified network. This becomes more important when we look at ExaLogic where you have several networks in the rack.
8. Restart rpcidmapd service
Prior to starting the rpcidmapd service, edit /etc/idmapd.conf to define the domain name.
[General]
Verbosity = 0
Pipefs-Directory = /var/lib/nfs/rpc_pipefs
Domain = us.oracle.com
Nobody-User = nobody Nobody-Group = nobody
[Translation] Method = nsswitch
To restart the service, type at the command prompt
service rpcidmapd restart
Stopping RPC idmapd: [ OK ]
Starting RPC idmapd: [ OK ]
9. Configure services to auto start on boot
At the command prompt enter:
service portmap start
chkconfig portmap on
chkconfig ypserv on
chkconfig yppasswdd on
chkconfig ypxfrd on
chkconfig ypbind on
chkconfig rpcidmapd on
If hostname does not resolve to the IP address you want ypserver to run on then you need to temporarily redefine hostname to a value that resolves to the desired IP. On compute nodes the hostname typically resolves to the Management IP (1 GB) interface. By setting hostname to the private IB hostname one could use ypserver on that network instead.
To create the NIS maps, enter at command prompt
Verify that /var/yp/ypservers has the master and slave servers defined. The process in step 10 should have added them. If not add them in manually.
[root@nis1 ~]# more /var/yp/ypservers
nis1.us.oracle.com
nis2.us.oracle.com
[root@nis1 ~]#
12. Start All NIS Services
At the command prompt enter:
service portmap restart
service rpcidmapd restart
service ypserv start
service ypbind start
service yppasswdd start
service ypxfrd start
Next, setting up one or more slaves