Solaris - Moving off NIS to something better


 
Thread Tools Search this Thread
Operating Systems Solaris Solaris - Moving off NIS to something better
# 8  
Old 01-08-2018
Yes, still running Solaris 8 (end of extended support 2012) and 9 servers (end of extended support 2014) means security is not a top priority in your shop.

Moving to LDAP is definitely the recommended way to provide secure distributed authentication but that's not something you do overnight.

Is your environment only using Solaris or also other Unix/Linux OSes?

Do you already have an ldap service somewhere? Does it already contains entries for your unix users?

Do you require a commercially supported solution?

Last edited by jlliagre; 01-08-2018 at 08:29 AM..
This User Gave Thanks to jlliagre For This Post:
# 9  
Old 01-10-2018
Quote:
Originally Posted by jlliagre
Yes, still running Solaris 8 (end of extended support 2012) and 9 servers (end of extended support 2014) means security is not a top priority in your shop.

Moving to LDAP is definitely the recommended way to provide secure distributed authentication but that's not something you do overnight.

Is your environment only using Solaris or also other Unix/Linux OSes?

Do you already have an ldap service somewhere? Does it already contains entries for your unix users?

Do you require a commercially supported solution?
Well I'm a contractor whos been brought in the last few months....

Solaris and also RedHat. But they also have Windows - but its likely they will want to keep windows separate.

Yes it needs to be commercially supported.
# 10  
Old 01-10-2018
Quote:
Originally Posted by psychocandy
But they also have Windows - but its likely they will want to keep windows separate.
What Windoze calls "Active Directory" is in fact a (very stripped-down*) ) LDAP domain with Kerberos V authentication. You can use a regular LDAP domain to feed info to the Windoze domain because it is essentially the same.

I hope this helps.

bakunin

___________
*) What i mean by that is that, for instance, a usual attribute for a user record is "login shell", which usually points to /usr/bin/ksh, /usr/bin/bash or something alike. In the original "Active Directory" this entry misses and because you cannot change the structure in Windoze you cannot use the Active directory information to authenticate UNIX/Linux users. You will (and should) do it the other way round therefore.
# 11  
Old 01-10-2018
Quote:
Originally Posted by psychocandy
Well I'm a contractor whos been brought in the last few months....

Solaris and also RedHat. But they also have Windows - but its likely they will want to keep windows separate.

Yes it needs to be commercially supported.
The only Oracle fully supported solution is to use ODSEE (simplest because there is a specific command designed to ease the configuration: idsconfig) or OUD. Some other LDAP servers would work but AD probably won't.

Last edited by jlliagre; 01-10-2018 at 03:46 PM..
# 12  
Old 01-10-2018
Hi,

Out of interest: what is the actual brief from the client, or aim of the project ? You mentioned in your first post the desire to replace NIS with "something better". Is there some specific thing that NIS isn't doing for them, or is the aim just to replace all unsupported systems (of which the NIS server is one) with currently-supported ones ?
# 13  
Old 01-10-2018
Having authentication data travelling unencrypted on the network is likely sufficient to urge admins to look for something else.
# 14  
Old 01-19-2018
Quote:
Originally Posted by drysdalk
Hi,

Out of interest: what is the actual brief from the client, or aim of the project ? You mentioned in your first post the desire to replace NIS with "something better". Is there some specific thing that NIS isn't doing for them, or is the aim just to replace all unsupported systems (of which the NIS server is one) with currently-supported ones ?
Two reasons:-

1) They have the impression NIS isnt working properly anyway. (They wont delete users because it went wrong once).

2) Replace unsupported systems.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

Deleting NIS user Solaris 8

ypcat passwd | grep "user" - shows the user userdel "user" says "user does not exist" What am I doing wrong? (1 Reply)
Discussion started by: psychocandy
1 Replies

2. Solaris

Ssh onto Solaris servers (which uses NIS)

Sys admin has provided me username and password and advised that solaris uses nis (and then I've been given hostnames). I've downloaded putty but it gives me authentication failure. Nothing special I have to do if its NIS authentication? (1 Reply)
Discussion started by: psychocandy
1 Replies

3. UNIX for Advanced & Expert Users

Move NIS Server Solaris 10 to CentOS7

Hi, I hope somebody can help me. I wand to Move my NIS server on Solaris 10 (there are 2 Slaves on Linux) to CentOS7. Do you have any procedures or experience to do this? Thanking in anticipation! (2 Replies)
Discussion started by: Penguin99
2 Replies

4. Solaris

Solaris 10 NIS client configuration

Hi, I have a Solaris 10 machine and trying to connect it to a Linux NIS Server. Up till now I have set up NIS so that it does find the NIS server and gets the user list. Automounter also mounts some directories from an NFS server. However, I can't get it to map the shadow passwords (they... (4 Replies)
Discussion started by: dop
4 Replies

5. Solaris

Nis startup in Solaris 8

Hello How can I check to see when nis server is starting? I look at /etc/rc2.d/ but I don't see it in there. Every time we have power outage problem. I have to start autof service manual. So I think it might have to do with nis server services. (1 Reply)
Discussion started by: congngo
1 Replies

6. Solaris

How to do the Loadbalancing on NIS Server in Solaris 10 sparc

We set-up master/slave servers for NIS on Solaris10 Sparc. We are trying to synchronize them in such a way that if one server is down then other server would pick-up and also do load balancing. We are stuck on this part. Do you have any documentation or point to the documentation where we get some... (1 Reply)
Discussion started by: anandp14
1 Replies

7. Solaris

Solaris 10 NIS Client

Hi all, Recently i have implemented NIS functionality in solaris 10 and i have created server and client with user in server side by giving useradd -d /export/home/user1 -m -s /bin/sh user1 after that I went to /var/yp dir and give /usr/ccs/bin/make so that it will refelect to client... (2 Replies)
Discussion started by: esungoe
2 Replies

8. UNIX for Advanced & Expert Users

Moving NIS master to new machine

I am running a DNS/NIS server on and older 2.6 system. I would like to move it to a newer system running Sol9. I have not found a good HOWTO and was looking for some advice. Thanks in advance. Dave (4 Replies)
Discussion started by: dlalonde
4 Replies

9. UNIX for Dummies Questions & Answers

linux redhat and solaris NIS+

Hello all, I am wondering if anyone had success with installing a redhat linux (PC box) on a Solaris NIS+ network. I have gotten information on how to do this but have been unsuccessful. The information that I have gotten is a little out dated and is not 100%. ... (0 Replies)
Discussion started by: larry
0 Replies

10. UNIX for Advanced & Expert Users

Solaris NIS+ and RedHat NIS+

Hello all, I'm not sure if this is the right forum, but I would like to know if Redhat running NIS ( not NIS +) would have conflict with Solaris running NIS+. Currently I am running NIS+ on Solaris but will be adding RedHat to the network. I seem to be unable to find and information regarding... (2 Replies)
Discussion started by: larry
2 Replies
Login or Register to Ask a Question