<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40"> <head> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"> <meta name=ProgId content=Word.Document> <meta name=Generator content="Microsoft Word 10"> <meta name=Originator content="Microsoft Word 10"> <link rel=File-List href="cid:filelist.xml@01C3CCD2.B3D86E50"> <o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="time"/> <o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="PersonName"/> <o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="date"/> <o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="City"/> <o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="place"/>  <style>  </style>  </head> <body lang=EN-US link=blue vlink=purple style='tab-interval:.5in'> <div class=Section1> Pedro,<o:p></o:p> <o:p> </o:p> Your suggestion is definitely correct. <st1:City><st1:place>NIS</st1:place></st1:City> is not that secure. We may implement LDAP in the future when the number of machines gets bigger.<o:p></o:p> <o:p> </o:p> I searched Google again and found some information about shadow password with <st1:City><st1:place>NIS</st1:place></st1:City>. The idea is to mangle the shadow password and make them not to be displayed when ‘ypcat passwd’ is issued. With Fedora, and I believe with other Linux as well, you can modify /var/yp/Makefile to create shadow.byname <st1:City><st1:place>NIS</st1:place></st1:City> database. With Fedora, it is quite easy to do this by just setting “MERGE_PASSWD=false” so that the shadow encrypted code will not be merged with the password file in ypcat information. If we modify /etc/nsswitch.conf and /etc/ypserv.conf to enable the mangle shadow password, ypcat command will no longer display the encrypted password.<o:p></o:p> <o:p> </o:p> Your suggestion about LDAP usage is absolutely another option in long run.<o:p></o:p> <o:p> </o:p> Thank you so much for sharing your idea.<o:p></o:p> <o:p> </o:p> Qi<o:p></o:p> <o:p> </o:p> <o:p> </o:p> > From: Pedro Fernandes Macedo <a href="mailto:webmaster@margo.bijoux.nom.br">webmaster@margo.bijoux.nom.br</a><o:p></o:p> <o:p> </o:p> > Pedro Fernandes Wrote:<o:p></o:p> >>>><o:p></o:p> From my experience with <st1:City><st1:place>NIS</st1:place></st1:City> authentication , what you want is <o:p></o:p> impossible. In the university where I work , we're slowly preparing the <o:p></o:p> machines to use ldap authentication , as a security measure. We've had <o:p></o:p> enough problems with <st1:City><st1:place>NIS</st1:place></st1:City> , as any user can ypcat passwd and get all <o:p></o:p> passwords and maybe try to crack them. For this reason , we have a <o:p></o:p> strict policy regarding passwords and we try to crack weak passwords weekly. If you want security (at the expense of taking longer to configure the <o:p></o:p> server) , I suggest you to use ldap. Fedora has a excelent support to <o:p></o:p> ldap auth configuration (using redhat-config-authentication).<o:p></o:p> <o:p> </o:p> <<<<<o:p></o:p> <o:p> </o:p> > From: "<st1:PersonName>Qi Chen</st1:PersonName>" <qi.chen@jpl.nasa.gov><o:p></o:p> > To: <fedora-list@redhat.com><o:p></o:p> > Subject: Use shadow like password with <st1:City><st1:place>NIS</st1:place></st1:City> on Fedora<o:p></o:p> > Date: <st1:date Month="12" Day="26" Year="2003">Fri, 26 Dec 2003</st1:date> <st1:time Hour="17" Minute="16">17:16:19</st1:time> -0800<o:p></o:p> > Reply-To: fedora-list@redhat.com<o:p></o:p> ><o:p></o:p> ><o:p></o:p> > I have just installed Fedora. I have configured <st1:City><st1:place>NIS</st1:place></st1:City> server/client ok. <o:p></o:p> > However, when I type command 'ypcat passwd', I can see the encrypted <o:p></o:p> > password in the output, which is no good and is not what I want. I <o:p></o:p> > would like to have no encrypted password showing up when I type <o:p></o:p> > command 'ypcat passwd'.<o:p></o:p> ><o:p></o:p> > Then I changed the /etc/nsswitch.conf file with<o:p></o:p> ><o:p></o:p> > passwd: compat<o:p></o:p> > shadow: compat<o:p></o:p> ><o:p></o:p> > and modified /etc/ypserv.conf file as following:<o:p></o:p> ><o:p></o:p> > # The following, when uncommented, will give you shadow like <o:p></o:p> > passwords. # Note that it will not work if you have slave <st1:City><st1:place>NIS</st1:place></st1:City> servers <o:p></o:p> > in your # network that do not run the same server as you.<o:p></o:p> ><o:p></o:p> > # Host : Domain : Map : Security<o:p></o:p> > #<o:p></o:p> > * : * : passwd.byname : port<o:p></o:p> > * : * : passwd.byuid : port<o:p></o:p> ><o:p></o:p> > I restarted ypserv and ypbind. However, the ypcat command still shows <o:p></o:p> > the shadow password. I am using ypserv-2.8.3 and glibc-2.3.2-101.<o:p></o:p> ><o:p></o:p> > Do I miss anything? Please help if you know the answer.<o:p></o:p> ><o:p></o:p> > -Qi<o:p></o:p> <o:p> </o:p> </div> </body> </html>