System Administration Guide: IP Services

ProcedureHow to Set Up Oracle Solaris DHCP Clients as NIS+ Clients

A DHCP client system that is to be an NIS+ client must use credentials that belong to another NIS+ client system in the NIS+ domain. This procedure only produces credentials for the system, which apply only to the superuser logged in to the system. Other users who log in to the DHCP client system must have their own unique credentials in the NIS+ server. These credentials are created according to a procedure in the System Administration Guide: Naming and Directory Services (NIS+).

  1. Create the credentials for a client by typing the following command on the NIS+ server:

    # nisgrep nisplus-client-name cred.org_dir > /tmp/file

    This command writes the cred.org_dir table entry for the NIS+ client to a temporary file.

  2. Use the cat command to view the contents of the temporary file.

    Or, use a text editor.

  3. Copy the credentials to use for DHCP clients.

    You must copy the public key and private key, which are long strings of numbers and letters separated by colons. The credentials are to be pasted into the command issued in the next step.

  4. Add credentials for a DHCP client by typing the following command:

    # nistbladm -a cname=" dhcp-client-name@nisplus-domain" auth_type=DES \
    auth_name="unix.dhcp-client-name@nisplus-domain" \
    public_data=copied-public-key \ 

    For the copied-public-key, paste the public key information that you copied from the temporary file. For the copied-private-key, paste the private key information that you copied from the temporary file.

  5. Remote copy files from the NIS+ client system to the DHCP client system by typing the following commands on the DHCP client system:

    # rcp nisplus-client-name:/var/nis/NIS_COLD_START /var/nis
    # rcp nisplus-client-name:/etc/.rootkey /etc
    # rcp nisplus-client-name:/etc/defaultdomain /etc

    If you get a “permission denied” message, the systems might not be set up to allow remote copying. In this case, you can copy the files as a regular user to an intermediate location. As superuser, copy the files from the intermediate location to the proper location on the DHCP client system.

  6. Copy the correct name service switch file for NIS+ by typing the following command on the DHCP client system:

    # cp /etc/nsswitch.nisplus /etc/nsswitch.conf
  7. Reboot the DHCP client system.

    The DHCP client system should now be able to use NIS+ services.

Example 16–1 Setting up an Oracle Solaris DHCP Client System as an NIS+ Client

The following example assumes that you have one system nisei, which is an NIS+ client in the NIS+ domain You also have one DHCP client system, dhow, and you want dhow to be an NIS+ client.

(First log in as superuser on the NIS+ server)
# nisgrep nisei cred.org_dir > /tmp/nisei-cred
# cat /tmp/nisei-cred
# nistbladm -a cname="" \
auth_type=DES auth_name="" \
public_data=46199279911a84045b8e0c76822179138173a20edbd8eab4 \
# rlogin dhow
(Log in as superuser on dhow)
# rcp nisei:/var/nis/NIS_COLD_START /var/nis
# rcp nisei:/etc/.rootkey /etc
# rcp nisei:/etc/defaultdomain /etc
# cp /etc/nsswitch.nisplus /etc/nsswitch.conf
# reboot

The DHCP client system dhow should now be able to use NIS+ services.

Example 16–2 Adding Credentials With a Script

If you want to set up a large number of DHCP client systems as NIS+ clients, you can write a script. A script can quickly add the entries to the cred.org_dir NIS+ table. The following example shows a sample script.

#! /usr/bin/ksh  
# Copyright (c) by Sun Microsystems, Inc. All rights reserved. 
# Sample script for cloning a credential. Hosts file is already populated  
# with entries of the form dhcp-[0-9][0-9][0-9]. The entry we're cloning 
# is dhcp-001. 
i in 002 003 004 005 006 007 008 009 010 011 012 013 014 015 016 017 018 019
     print - ${HOST}${i}         
     #nistbladm -r [cname="${HOST}${i}.${DOMAIN}."]cred.org_dir         
     nistbladm -a cname="${HOST}${i}.${DOMAIN}." \
         auth_type=DES auth_name="unix.${HOST}${i}@${DOMAIN}" \
         public_data=${PUBLIC_DATA} private_data=${PRIVATE_DTA} cred.org_Dir
exit 0