You're asking a lot of questions so this is going to be tough question to answer. I guess the easiest thing to do would be to share my NIS setup (yes even though I told you not to set one up, I have one setup in my LAN at home for testing purposes).
To start you'll need to have
yp-tools packages installed. You don't say what distro you're using, so I'm going to walk you through my setup on CentOS 5.x. I have Ubuntu 12.04 clients in my NIS domain so we can adjust this answer as needed down the road.
To keep things brief I'm going to be filtering out the comments in my config files and only showing you the lines that are actually doing anything. Again if you need clarification I can post them if need be.
This file sets up how I want my
ypserv to share the various NIS maps that I have. Below I'm limiting what IP subnets are allowed to access the various maps.
# more /etc/ypserv.conf |egrep -v "^#|^$"
192.168.1. : * : shadow.byname : none
192.168.1. : * : passwd.adjunct.byname : none
192.168.1. : * : passwd.byuid : none
192.168.1. : * : * : none
* : * : * : deny
* : * : * : none
I should mention that I learned how to set up NIS/YP from old Sun/Solaris guys so my approach might be a little off the path. They always used
passwd.adjunct files to house the actual passwords, so I do the same here.
setting NIS domain name
My NIS domain is called nis.bubba.home. Under Red Hat distros you'd typically set the NIS domain in this file:
/etc/sysconfig/network. Here's mine:
$ more /etc/sysconfig/network
With this entry when you run the
domainname command you should get the
Lots of people get confused by that command, it has nothing to do with the domain name of the host (bubba.net) it's the actual name of the NIS domain. See the domainname man page for more details.
This is the file that is used by clients (
ypbind) so that they know what server to connect to.
# more /etc/yp.conf |egrep -v "^#|^$"
domain nis.bubba.home server 192.168.1.101
This file controls what facilities will use NIS.
# more /etc/nsswitch.conf |grep nis |egrep -v "^#|^$"
passwd: files nis
shadow: files nis
group: files nis
hosts: files nis dns
networks: files nis
protocols: files nis
services: files nis
netgroup: files nis
automount: files nis
aliases: files nis
To try and keep things straight I set this directory up and populated it with the files from which my NIS maps will eventually be built from. This isn't a complete list but here are a couple of the files that I have in this directory:
auto.master, group, passwd, passwd.adjunct & shadow
In using passwd.adjunct the passwords get stored in that file and there is a reference (see above i.e. ##rhays) that says which line in the
passwd.adjunct goes with a particular user.
This directory is where the NIS server,
ypserv will share data from. There's a
Makefile there which you use to rebuild changes to maps as you edit the files in
This directory looks like this:
# ls | column
binding Makefile.orig nicknames RCS ypservers
Makefile Makefile.rpmnew nis.bubba.home securenets
Before we get into the
Makefile, the other files here that are of interest are the
securenets file. This can control what IP addresses and subnets are allowed to connect to this server. Here's my version of that file:
Here are some excerpts from my
Makefile to help show how things get pulled together. For starters these variables point to my map files.
YPSRCDIR = /etc/yp
YPPWDDIR = /etc/yp
YPBINDIR = /usr/lib/yp
YPSBINDIR = /usr/sbin
YPDIR = /var/yp
YPMAPDIR = $(YPDIR)/$(DOMAIN)
GROUP = $(YPPWDDIR)/group
PASSWD = $(YPPWDDIR)/passwd
SHADOW = $(YPPWDDIR)/shadow
ADJUNCT = $(YPPWDDIR)/passwd.adjunct
all: passwd group hosts rpc services netid protocols mail \
netgrp auto.master auto.home auto.packages auto.data1 auto.data2 \
auto.proj auto.vz_backups passwd.adjunct networks printcap
There are additional modifications that need to be made to the
Makefile based on the map files your particular environment is comprised of.
Bringing it all together
So when you've setup the map files, the config files, and installed all the necessary packages, you need to do the following:
$ cd /var/yp && make
$ /etc/init.d/ypserv start
$ /etc/init.d/ypbind start
# who's my domain master?
# what maps are available?
$ ypwhich -m
So should I be running NIS?
I still say no. It's ancient technology, has very poor security, and is ridiculously complicated. I posted this tutorial more to show you why you shouldn't use it rather than to encourage you to use it.
For the time invested in learning the details of NIS, you'd be better served in learning how to deploy LDAP.