Quote:>I> >Your problem is that the local passwd file is still the default.
>> It's easy to change. Just edit /etc/nsswitch.conf. But why is this
>> default a problem?
>Because existing users get their passwords out of synch. I tried, and
>found that changing password by the user didnot get reflected centrally,
>and the synched passwords were unsynched.
This never happens here. Maybe your setup (permissions of NIS+
tables) is not correct.
[...]
Quote:>I wasnt suggesting removing them, just the users accounts. The point is I
>couldnt find anywhere to say EXPLICITLY which accounts (other than root)
>should be left local.
Install one machine, and just look in the standard /etc/passwd.
But you are right, documentation could be better here. I never
found any hint why 'smtp' has to be there.
Quote:>> > then you must reset all the user passwords (and then synch with
>> >the network password).
>> Why? User login information should only be in NIS+ databases.
>Not if you have passwd: files nisplus.
No. I use this on most of our machines, and ALL users are found
ONLY inside NIS+. 'files' are only used for standard system
accounts. This entry means: first check /etc/passwd and if you
don't find the searched name there, look in NIS+ database.
Quote:>> >However, after this it works. Note, though that
>> >this might*up your email for a while, and you have to unsecure your
>> >system until all the users change their new passwords.
>Of course one can change every account to have a hard to crack passwd...
I have some problems understanding, why you get 'out of sync' with
the users passwords. We never had such a problem here. Could you
please explain your problem with some more details?
[...]
Quote:>> >o Also there is no way to deny a user access to a machine in a particular
>> >domain.
>> Try reading the man page of nsswitch.conf. Look for 'Interaction with
>+/- syntax'
> One has to switch back to NIS compat mode - which seems a bit retrograde
>- not too mention perhaps unlikely on 2.5 systems that require the
>installation of a seperate NIS Tranistion kit.
No, no. You don't have to switch to NIS compat mode. You just use
the old NIS syntax for your /etc/passwd. You don't have to install
NIS Tranistion kit.
Here what I'm using for some machines:
/etc/nsswitch.conf:
...
passwd: compat
passwd_compat: nisplus
group: files nisplus
...
/etc/passwd
root:x:0:1:root:/:/sbin/sh
[all this mysterious accounts]
wib:x:90:14:Willi Burmeister:/home/wib:/bin/ksh
+:x:60002:60002:::/bin/false
This gives me access and looked out all other
[...]
Quote:>The point is, that it is *NOT DOCUMENTED* explicitly. I'm sure if you take
>a bunch of machines out of their boxes, or maybe even an existing set of
>NIS machines, then the transition works. My experience, is that it less
>well documented for a bunch of workstations with pre-existing users using
>DNS.
Ok, you are right. The documentation is not the best in all points.
Maybe a professional it not the best to check a books usefullness
for beginners :-)
Willi
by