NIS domain and DNS domain

by Jamie Thingelst » Sat, 25 Jan 1997 04:00:00

I want to make sure I'm correct on this... the NIS domain of a Solaris
machine is completely independent of its domain name(s) it is known by
in the DNS system, right?

I.e., if machine is named foo.bar.com it doesn't have to be in NIS
domain bar.com right?

--
Jamie Thingelstad, CTO (Fax) 612.832.5926 (Voice) 612.832.9445x24
Concerto Technologies 7600 France Ave South, St. 106, Edina, MN 55435

Top

1. More on NIS+ domain != DNS domain & Secure NFS

Setting up a test domain where the NIS+ domain is not the DNS domain,
(it appears as far as principles go, always use the NIS+ domain).

Thus for the network comprising:

cambot.cat.pdx.edu (master)
joel.cat.pdx.edu
gypsy.cat.pdx.edu

NIS+ domain == "catz.com."; I have the credentials (`niscat cred`) :

49e42a410408d088a5560a7804ce1fbdf494b2c309f8065c
b6f68ca4c2636379f84decc4b7b3b95bc4934ade2d2432d4
e01ca13dd9b468ed6119ac73eac9ce15e50903dd9400ea99

and one user:

eric.catz.com.:LOCAL:11476:100:
b5343717119389c003b303c779fd1072fc60405d6ed053ae

to represent:

eric:fq...sig:11476:100:Eric Berggren:/u/eric:/bin/csh:10176:-1:-1:-1:-1::0

Which seems to work (except the occasional NIS+ fatal error: 19 brought
up in a previous article).

Now trying to work with secure NFS.

On gypsy.cat:/etc/dfs/dfstab :

share -F nfs -o sec=dh /disk/cache/sekrat

attempting to mount on joel.cat:

# mount -o secure gypsy.cat.pdx.edu:/disk/cache/sekrat /mnt
fsaddtomtab: stat /mnt: Invalid argument

unix: NOTICE: authdes_refresh: unable to encrypt conversation key for user (uid 0), rpc status 16

in addition to :

unix: NOTICE: authdes_refresh: unable to encrypt conversation key for user (uid 11476), rpc status 16

(when going through automount) to syslog.

running snoop on an adjacent host shows a number of NIS+ references :

joel.cat.pdx.edu -> cambot.cat.pdx.edu NIS+ C FindDir "com."
cambot.cat.pdx.edu -> joel.cat.pdx.edu NIS+ R FindDir [Not Found, no such name]

which are the only NIS+ calls made (among normal looking NFS calls,
with Auth=des)

Manuals/FAQs state that merely setting the "secure" (or "sec=dh") option
on both endds is all that is needed under NIS+ as all the necessary
credentials exist.

Relavent entries in nsswitch.conf contain:

passwd: files nisplus
hosts: dns files
publickey: nisplus

on all hosts (hosts map is _empty_).

So what am i overlooking here ?

thanx,
-eric

--
Eric Berggren | "Parts of this product may be derived from
Portland State University | from UNIX and Berkeley 4.3 BSD systems..."

2. IPX RIP/SAP routing between ppp and eth

3. NIS domain names and DNS domain names not matching.

4. Solaris 8 and ipseckey

5. Must NIS+ domain = DNS domain ??

6. How to merge two columns of numbers from two different files?

7. NIS+ domain VS. DNS domain