Getspnam and nis

I have a cluster with NIS setup for username and password. Due to legacy issue, we wrote our own PAM modules to "dispatch" the password checking to various modules, for example, if the password starts with ##, we use kerberos, and if it starts with ###, we send it to an OTP checker, otherwise, it's a crypt password. This works fine before Sol 10, but with Sol 10, it stopped working.
When using nis, if the password field is a crypt password, getspnam returns the entry, but if the password starts with ## or ###, getspnam returns NULL. If I put the entry in /etc/passwd and /etc/shadow, getspnam returns the entry without any problem.
getpwnam has no problem finding the entry whether using nis or local file, and it doesn't matter if the password starts with ## or not.
I'm using Solaris 8 5/08 on X86. I also tried it on sparc and it has the same behavior.
What am I missing?
James Tuan

Is this still an issue?
Cheers,
Andreas

Similar Messages

N2L urgent help on DS5.2 and NIS

Ok,
I have managed to migrate all my NIS data to sunone directory server and it works fine.
I have now setup a private network to work on the N2L project. I have setup a copy of the directory service on one box, on the other I have set up as a nis master.
Now comes the part that is killing me off, and I have been working on this for days.
1. Running the inityp21 to setup nis mapings and proxy users,
2. ypstop
3. ypserv -r
Now here is the problem it propergates all my ldap to nis maps fine, but not he passwd part. so when I start nis up it gives me :
makedbm: could not open /var/yp/blah/LDAP_passwd.byname dbm file
However all the other maps are there I can ypcat host/ehters etc etc....
I have check the permisions on the proxyagent and it can see all the user and userPasswds....No problem..
What am I doing wrong here it is really killing me off.
Please help me...
Thnks in advance

You don't say what WiFi networks you are trying to connect to, only, "I find WIFI signals, connect to them and the signal appears...". Just because a WiFi network is not locked does not mean that it is usable by every device. Those networks are protected by other mechanisms than simple passwords. The symptoms you describe, apparent connection but no internet, are what you will see if you try to connect to these.
Perhaps some more details might be useful in suggesting anything. Are you trying to use a hotel network? Which one?

Sharing /usr/local and NIS server and client

I have two sun v880 with solaris 9 one is nis server and other nis client . The nis master sharing /usr/local with nis client. I need that one sun will be backup from other, if one stop working other continuos. What is que best practice for to do this, stop de nis service and copy /usr/local of one to other? Change nis client to nis slave? I don't have experience with solaris.

Do you only have 2 machines total?
You discuss two separate services: NIS and filesharing.
For NIS, all that is required is that you set up a slave. The slave continues to serve data (but not update it) while the master is down.
Sharing /usr/local is different. If it's just these 2 machines, instead of NFS I might set up rsync to copy the data over periodically.
Darren

CDE login and NIS

I installed NIS on two client Ultra 5's, but cannot login using CDE's dtlogin. I can remotely login via ssh, but at dtlogin it fails saying: "Login incorrect: please try again". The generic login failure message. I installed the client by doing the following:
# domainname test
# domainname > /etc/defaultdomain
Modified /etc/nswitch.conf to add "nis"
# /usr/sbin/ypinit -c (giving the name of the NIS server)
#/usr/lib/netsvc/yp/ypbind
I'm missing something, but I'm not sure what it is. Do I need to copy and modify one (or more) of the /usr/dt/config files? Thanks.
Bob

Never mind! I had run "/etc/init.d/dtlogin reset" which had done nothing.
I ended up running
# /etc/init.d/dtlogin stop
# /etc/init.d/dtlogin start
That fixed it .
Bob

Wlauth and nis/nisplus

We are still running BEA Weblogic 5.1, but are in the process of
upgrading to the latest 7.x server. My question is does wlauth work
with NIS/NIS+ on Weblogic 5.1 or 7.x? Any help would be greatly
appreciated.
Thanks,
Steve

u can only solve this problem with programming...
It took me a long while to perfect that dang thing..
so i am not giving the code away..
i setup a permissions based deal using c code
and did something of the following...
if user = ability to work
then
if arg is not a buffer overflow.. and if the user has permissions
then run the command...
it is different than sudo because it checks file data before running it.. among other things...
to make sure someone didn't modify any C program.. you also remove their ability to su..

Dhcp and nis

I have Solaris 10 installed on an x-86 box with 2 nics installed.
I am trying to configure one nic to use dhcp and access the internet as well as on the 2nd nic have an nis network that has a static ip range that will be a master to 3 other clients. Is this possible? I've been able to configure the primary nic with dhcp to go out to the net, but wasn't very successful with NIS on nic 2. Seeking advice on this.
Thanks

Is this still an issue?
Cheers,
Andreas

NIS/YP and /etc/master.passwd

I'm trying to get a bundle of servers (10.4.10 Server) configured to use NIS for their local authentication. This is required in order for myself and our other unix admins to gain access to the host in a standard way.
I can get the machine to authenticate of NIS (using the Directory Services app), however it then lets ALL users log in.
I need to make the standard +@netgroup:::::: directives work in /etc/passwd or /etc/master.passwd - however it appears that the OS is completely ignoring these files - despite having ticked the box for "Use BSD local files (/etc) for authentication" in the NIS configuration window.
I've tried restricting access with various combinations of the BSD Local Files and NIS Domain check boxes being checked.
If "Use NIS domain for authentication" is checked, then all users can log in (via ssh). If not, no users can. So I figure I should not use NIS for auth, but instead use local files and then specify that certain netgroups are allowed in. This also does not work.
On all my other unix hosts, we use something like this in /etc/passwd:
+sysadminnetgroup::::::
+::::::/bin/false
Thus creating the effect of allowing all our sys admins, and denying all other users. This works brilliantly, since we do want some users to access certain hosts (i.e. a couple of public hosts for the students programming in C) - but don't want them accessing everything. I can't just set their shell in NIS to /bin/false for this reason.
In short, how can I make my macs auth from NIS, but then restrict which users can actually log in?

Applying that same thing to the rest of the commands, and I finally got it done. Thanks so much.
It's weird that whatever she did to make it so this had to be done was fixed by just doing these commands.

Solaris 10 NIS Client user account home directory

Hi all,
I am newbie of NIS in solaris and i am setting up NIS(central authentication of user) ,So related to this i have setup and server and client but
i am getting problem while accessing user account in client side.
in client side i can login user which i have created in server but it is not able to find its home dir .even though i added user with the -m option on server and home dir of user is created in server side .
*(No directory! Logging in with home=/)*which i have created in NIS server.
also i am not able to create any directories or files in the client system it says.
bash-3.00$ mkdir a
mkdir: Failed to make directory "a"; Permission deniedBoth the server and client have same domainname and NIS service is also running properly.
on the server side this is the entry of the /etc/auto_home
# Copyright 2003 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
# ident "@(#)auto_home 1.6 03/04/28 SMI"
# Home directory map for automounter
+auto_home
* SS09:/export/home/&here SS09 is the NIS server name and i can see it both server and client side .
bash-3.00$ ypwhich
SS09
bash-3.00$
bash-3.00$
bash-3.00$ svcs nis/client
STATE STIME FMRI
online 11:53:05 svc:/network/nis/client:defaultSo please help me regarding this ...
Thanks
anuj
Edited by: anuindia on Apr 16, 2009 11:02 PM
Edited by: anuindia on Apr 16, 2009 11:03 PM

Look over on http://docs.sun.com for the NIS guide for your version of Solaris.
alan

Windows 7 and Installation Booting.

I have a strange problem here. i searched everywhere about it. but nothing in my hand.
so im opening bootcamp wizard everything is ok. i did partitioning and after mount the win 7 dvd. mac rebooted. i passed white bios screen and staying in the empty black screen with blinking white cursor. i tried this with 2 different windows 7 dvd. one of them x86 and another one is x64. but i could install vista and xp. what can i do about it.

Biggest issue for now is going online and just how secure Windows 7 along with 3rd party products are, and problems with the new UAC.
http://social.technet.microsoft.com/Forums/en-US/w7itprosecurity/thread/36046fff -ffc4-43f4-bce6-8f5f011f9296
Avast, Kaspersky seem to be the two best bets, though I wonder how much AV software does to protect. Windows 7 was running fine until a Norton 360 3.0 beta 110 live update; and there are problems with a "Symantec Service Framework" process and other features for now.
So I bought SuperAntiSpyware (SAS) to go along.
One reason for having two installs of Windows 7 (and keys) so I can test "A" on one system before applying it to "B" and I need to get better with system restore images.
The one issue has been my 2006 Mac Pro doesn't support the EFI boot screen the Windows 7 DVD (and Vista SP1 DVD) implement. I can install Windows from inside one of my three Windows OS without needing to boot from DVD and get around that.
Knowing more about Norton (yes, but Symantec's 2009 AV and NIS really do run better than Kasperky and AVG and no trouble on my systems) but it will be awhile. I would prefer they have just an AV beta for Windows 7 and then add on more, instead their "360" is trying to do too many things and too new.... Windows 7 has enough changes it will take time and work for any vendor.

NIS -- LDAP

Hello,
We have about 20 "Solaris 10" hosts.
All are Sparcs and NIS clients to a Solaris Sparc NIS server.
We also have a Linux LDAP server (with many Linux LDAP clients).
We should like to convert the NIS clients to LDAP clients of this LDAP server.
Perhaps someone could help me to save (a lot of?) time to setup the Solaris "ldapclient init" command if this is possible at all from the following information:
The Linux client's Yast configuration file "ldap.conf" looks like this:
host ldap
base o=emi
ldap_version 3
pam_check_host_attr yes
pam_password crypt
ssl start_tls
pam_filter objectclass=posixAccount
nss_base_passwd ou=people,o=emi
nss_base_shadow ou=people,o=emi
nss_base_group ou=group,o=emi
I have tried many "ldapclient init" calls, but all failed
My LDAP knowledge still is very low. But I'm pressed for time.
I expect that there are some more tasks to do. But to see the ldapclient command which fits to the ldap.conf file surely would be a great help.
Thanks in advance

There's a book at http://docs.sun.com called "Solaris Administration Guide: Naming and Directory Services (DNS, NIS and LDAP)". This will answer a lot of your questions.
The file you're looking for is /var/ldap/ldap_client_file. Unforntunately, it's a "chicken and egg" design. The ldapclient program creates this file when you use the "init" option. But, the ldap_cachemgr daemon actually updates it from the LDAP specified in the file. The ldapclient program also creates /var/ldap/ldap_client_cred. This contains the credentials that ldap_cachemgr uses to authenticate with the server.
What I do is modify the LDAP and then SIGHUP ldap_cachemgr, avoiding the use of ldapclient. I used ldapclient to build the cred file and get the initial LDAP settings and file format. After that, I've never used it.
HTH,
Roger S.

NIS+/LDAP-Gateway Nis+ Credentials lost after some time

Hello,
I have configured an NIS+ Server with NIS compatibility under Solaris. Then I have installed an Sun Directoryserver on the same machine and populatet the LDAP-tables with the rpc.nisd gateway. Everything works fine. Even with TLS-Encryption.
The Server works perfect and the LDAP-Clients and NIS+ and NIS-Clients work too.
But after some days you can do an niscat cred.org_dir on the Server and the Nis+-Credentials are ok. 5 seconds later you do the same niscat in the same shell and the cred.org_dir table is only half filled. When you repeat the Command again, all NIS+-Credentials are lost and the server is death.
I have the same problem with the Directory Server 5.1 on Solaris 9 sparc, on Solaris 10 beta x86, on Solaris 10 beta sparc and with directoryserver 5.2 on Solaris 10 final sparc.
I think it is a Problem with the NIS+LDAPmapping file or the rpc.nisd configuration.
Please help me.
With friendly Greetings from Germany
Ralf

There's a book at http://docs.sun.com called "Solaris Administration Guide: Naming and Directory Services (DNS, NIS and LDAP)". This will answer a lot of your questions.
The file you're looking for is /var/ldap/ldap_client_file. Unforntunately, it's a "chicken and egg" design. The ldapclient program creates this file when you use the "init" option. But, the ldap_cachemgr daemon actually updates it from the LDAP specified in the file. The ldapclient program also creates /var/ldap/ldap_client_cred. This contains the credentials that ldap_cachemgr uses to authenticate with the server.
What I do is modify the LDAP and then SIGHUP ldap_cachemgr, avoiding the use of ldapclient. I used ldapclient to build the cred file and get the initial LDAP settings and file format. After that, I've never used it.
HTH,
Roger S.

NIS authentication from login window issues?

Hi,
I've a bunch of new iMacs that arrived this week, and I'm trying to get them integrated into our existing network, using NFS mounted /home and NIS for authentication, but I'm have some issues ...
NFS mounting: no problem, this works just fine, and is mounted on boot
NIS: this is where I start having issues, ypwhich shows the correct server, ypcat passwd can get the passwd from remotely and shows everything, and I can login using ssh or even sudo to an NIS user without any issues, HOWEVER, I can't login from the login window, I just get the window doing its little shake showing an authentication failure, and nothing seems to show up in the log files to indicate what the problem may be.
Anyone got any further ideas as to what to check? I have a number of older macs that are able to do this fine, just the newly arrived ones are having these problems

Did you tell the system to authenticate against NIS?
Just because you're bound to a directory server, that doesn't mean you'll automatically use that server for logins.
Check Directory Access -> Authentication and make sure your NIS configuration is listed in the directories used for authentication.
The order of entries here is important, too. They're following in a top-down fashion until the first match is found. This means that if you have a user 'joe' in the local domain, an Open Directory server and in NIS and you're checking in that order, it will authenticate the user against the local account and the Open Directory account before it checks NIS, and if the username is found in one of those two options it won't query the NIS server at all.

NIS Authentication fails

I want to auth to a NIS server but can't get it to work.
I setup in the Directory Utility "BSD Flat file and NIS", entered the domain name & ip address, and checked boxes "User and Group in BSD local node" and "Use NIS domain for authentication"
If I run at $ domainname
I get the correct reply of "vanderplex" When I try "sudo ypbind -d" I get:
ypbind: ypbindprocdomain2 vanderplex
ypbind: dead domain vanderplex
I believe the NIS server is funtional, I have a few other OS's that use it.
I've never been able to get a MAC to use NIS. Will my luck ever change?

I've just installed Lion and have exactly the same issue. My NIS server is running Solaris and has been working just fine for almost a year with Snow Leopard.
Once Lion had completed its installation, there was a message at the login window to the effect of Network Logins were unavailable. So I tail -f'ed /var/log/opendirectoryd.log while su'ing to my network user and it has numerous "failed to get YP map list".
Like Ben, I can successfully dump the contents of NIS tables using ypcat and ypmatch, so the bits of wet string are basically OK. What actually isn't OK is the authentication bit!
To be blunt, and I'm keeping this at PG13, this is absolutely fscking useless, and a show-stopper for me. How the h e l l this bug got past QA is beyond me. I was going to hold off from the 10.7.0 "upgrade" until 10.7.1 was released, but iCal and Address Book constantly (and I mean, constantly!) crashing forced my hand.
Thoroughly disgusted, I'm going back to Snow Leopard until Apple fixes this huge bug.

What are your experiences in integrating Windows AD and Linux

I got into a job with a domain of about 70 Windows PCs and about 100 Linux machines.
The domains are quite old, and I mean Samba 4 and NIS old. Obviously one wants something newer, as in AD on the Windows side and Kerberos/LDAP on the Linux side. Preferably with a single user-database.
Question to the more experienced members:
Should I go
- Windows based and use something like an OpenLDAP Proxy for the Linux-LDAP
or
- Samba 4 based AD with the same
or
- Any of the above with Linux attributes added to the user entries in LDAP
What are thoughts and experiences on this? Especially is Samba 4 stable enough to be used in a production environment? What experiences with having Linux machines running in AD directly or via LDAP Proxy/Kerberos Proxy?

1. Thsi contribution is not discussion, it is question. So better category is needed.
2. Samba forum is better platform for topics llike Samba stability. Your infrastructure is much closer to Linux one.
3. As you has landed in Windows Server forum, I would recommend using Windows Server 2012 R2. This is stable and reliable. Homogeneous infrastructure brings less headaches that hybrid one.
Regards
Milos

Firefox 34 and Norton Internet Security (Version 21 ff) Don't Like Each Other and It's Not the Toolbar!

I have discovered that Norton Internet Security (and Norton 360 as well) version 21 and after conflicts with Firefox version 33.0 and later. I have been running the latest Firefox 34 version. When I upgraded on two of my computers to the latest version of NIS (version 21) Firefox (version 34) froze; indeed it locked up the entire computer. I therefore installed Google Chrome and everything worked fine. I can reproduce this error with Firefox like the flip of a switch; it is very consistent! The conflict, by the way, does not go away by disabling the Norton toolbar. I want to continue to use Firefox, and not Chrome, but I don't want the browser to freeze the machine. I run Windows 7 Professional. Do you have any suggestions?

Oh... I spoke too soon. I went into my office today and ran Norton 360 (Version 21.6) and Firefox 34.0.5 thinking that all would be well because I shut off Hardware Acceleration. Boy, was I wrong. Norton 360 crashed with the Windows message: "Norton 360 has stopped working; it will be shut down." I immediately shut down the computer (even though someone was actually in my office at the time), rebooted, no longer ran Firefox and did a complete virus scan. All is well if I do not use Firefox 34. And so.... I am going to make my life easier and simply move over to Chrome at least on my office machine. I just don't see any other way out of this predicament. I do this reluctantly because Chrome is much slower than Firefox is especially the way I run it. Firefox 34 and NIS Version 21.6 just don't like each other.
Thanks for your help. It's been a good thread even though I could never figure this out.
Needs more help.

Getspnam and nis

Similar Messages

Maybe you are looking for