YPSERV(8)

NAME
ypserv - NIS database server

SYNOPSIS
ypserv [-dns] [-debug] [-k] [-p port]

DESCRIPTION
NIS is an RPC-based service designed to allow a number of UNIX-based machines to share a common set of configuration files. Rather than requiring a system administrator to update several copies of files such as /etc/hosts, /etc/passwd and /etc/group, which tend to require frequent changes in most environments, NIS allows groups of computers to share one set of data which can be updated from a single location.

ypserv is the server that distributes NIS databases to client systems within an NIS domain. Each client in an NIS domain must have its domainname set to one of the domains served by ypserv using the domainname(1) command. The clients must also run ypbind(8) in order to attach to a particular server, since it is possible to have serveral servers within a single NIS domain.

The databases distributed by ypserv are stored in /var/yp/[domainname] where domainname is the name of the domain being served. There can be several such directories with different domainnames, and ypserv can handle them all.

The databases, or maps as they are often called, are created by /var/yp/Makefile using several system files as source. The database files are in db(3) format to help speed retrieval when there are many records involved. In FreeBSD, the maps are always readable and writable only by root for security reasons. Technically this is only necessary for the password maps, but since the data in the other maps can be found in other world-readable files anyway, it doesn't hurt and it's considered good general practice.

ypserv is started by /etc/rc if it has been enabled in /etc/sysconfig.

SPECIAL FEATURES
There are some problems associated with distributing FreeBSD's password database via NIS: FreeBSD normally only stores encrypted passwords in /etc/master.passwd, which is readable and writable only by root. By turning this file into an NIS map, this security feature would be completely defeated.

To make up for this, the FreeBSD version of ypserv handles the master.passwd.byname and master.basswd.byuid maps in a special way. When the server receives a request to access either of these two maps, it will check the TCP port from which the request originated and return an error if the port number is greater than 1023. Since only the superuser is allowed to bind to TCP ports with values less than 1024, the server can use this test to determine whether or not the access request came from a privileged user. Any requests made by non-privileged users are therefore rejected.

Furthermore, the getpwent(3) routines in FreeBSD's standard C libarary will only attempt to retrieve data from the master.passwd.byname and master.passwd.byuid maps for the superuser: if a normal user calls any of these functions, the standard passwd.byname and passwd.byuid maps will be accessed instead. The latter two maps are constructed by /var/yp/Makefile by parsing the master.passwd file and stripping out the password fields, and are therefore safe to pass on to unprivileged users. In this way, the shadow password aspect of the protected master.passwd database is maintained through NIS.

NOTES

  Limitations
There are two problems inherent with password shadowing in NIS that users should be aware of:

1.  The 'TCP port less than 1024' test is trivial to defeat for users with unrestricted access to machines on your network (even those machines which do not run UNIX-based operating systems).

2.  If you plan to use a FreeBSD system to serve non-FreeBSD clients that have no support for password shadowing (which is most of them), you will have to disable the password shadowing entirely by uncommenting the UNSECURE=True entry in /var/yp/Makefile. This will cause the standard passwd.byname and passwd.byuid maps to be generated with valid encrypted password fields, which is neccesary in order for non-FreeBSD clients to perform user authentication through NIS.

  Security
ypserv has support for Wietse Venema's tcpwrapper package built in, though it is not compiled in by default since the tcpwrapper package is not distributed with FreeBSD. However, if you have libwrap.a and tcpd.h, you can easily recompile ypserv with them, thereby enabling its 'securenets' features: you can configure ypserv to only handle resquests from machines listed in the tcpwrapper configuration files, which would help limit vulnerability to the first limitation listed above.

  NIS servers that are also NIS clients
Care must be taken when running ypserv in a multi-server domain where the server machines are also NIS clients. It is generally a good idea to force the servers to bind to themselves rather than allowing them to broadcast bind requests and possibly become bound to each other: strange failure modes can result if one server goes down and others are dependent upon on it. (Eventually all the clients will time out and attempt to bind to other servers, but the delay involved can be considerable and the failure mode is still present since the servers might bind to each other all over again).

Refer to the ypbind(8) man page for details on how to force it to bind to a particular server.

OPTIONS
The following options are supported by ypserv:

-dns
    This option affects the way ypserv handles yp_match requests for the hosts.byname and hosts.byaddress maps. By default, if ypserv can't find an entry for a given host in its hosts maps, it will return an error and perform no further processing. With the -dns flag, ypserv will go one step further: rather than giving up immediately, it will try to resolve the hostname or address using a DNS query. If the query is successful, ypserv will construct a fake database record and return it to the client, thereby making it seem as though the client's yp_match request succeeded.

    This functionality is provided for compatiblity with SunOS 4.1.x, which has brain-damaged resolver functions in its standard C library that depend on NIS for hostname and address resolution. FreeBSD's resolver can be configured to do DNS queries directly, therefore it is not necessary to enable this option when serving only FreeBSD NIS clients.

-debug
    Run the server in debugging mode: the server does not background itself and prints copious debugging output to stderr for each request that it revceives.

-k  This flag is provided for compatibility with SunOS 4. The ypbind(8) command in SunOS 4 apparently expects to obtain a response from an NIS v1 server. Starting ypserv(8) with the -k flag causes it to register itself as an NIS v1 server and respond to DOMAIN_NONACK requests. Note carefully: this is merely a kludge (hence the 'k') to pacify SunOS 4's ypbind(8) command: attempts to make the server actually handle NIS v1 queries will undoubtedly fail quite miserably.

-p port
    Normally, ypserv will bind itself to a randomly chosen TCP port when it is first started. This option can be used to force the server to bind to a particular port instead.

FILES
/var/yp/[domainname]/[maps]
    The NIS maps.
/etc/host.conf
    Resolver configuration file.

SEE ALSO
ypbind(8), yppasswdd(8), yppush(8), ypxfr(8), ypcat(1), yp(8), db(3)

LICENSE
This program is covered by the GNU Public License version 2.

AUTHOR
Peter Eriksson <pem@signum.se> (original version)
Bill Paul <wpaul@ctr.columbia.edu> (port to FreeBSD and various changes)