|Skip Navigation Links|
|Exit Print View|
|Oracle Solaris Administration: Naming and Directory Services Oracle Solaris 11 Information Library|
This section includes information about setting user passwords, adding new users to an NIS domain, and assigning users to netgroups.
For more information, see How to Obtain Administrative Rights in Oracle Solaris Administration: Security Services.
# useradd userID
where userID is the login ID of the new user. This command creates entries in the /etc/passwd and /etc/shadow files on the master NIS server.
To create an initial password that the new user can use to log in, run the passwd command.
# passwd userID
where userID is the login ID of the new user. You will be prompted for the password to assign to this user.
The map source files on your master server should be in a directory other than /etc. Copy and paste the new lines from the /etc/passwd and /etc/shadow files into the passwd map input files on the server. See Password Files and Namespace Security for additional information.
For example, if you added the new user brown, the line from /etc/passwd that you would copy to your passwd input file would look like the following.
The line for brown that you would copy from /etc/shadow would look like:
For security reasons, do not keep user entries in the NIS master server /etc/passwd and /etc/shadow files. After copying the entries for the new user to the NIS map source files that are stored in some other directory, use the userdel command on the master server to delete the new user.
For example, to delete the new user brown from the master server's /etc files, you would enter the following.
# userdel brown
For more information about userdel, see the userdel(1M) man page.
After you have updated the passwd input file on the master server, update the passwd maps by running make in the directory containing the source file.
# userdel brown # cd /var/yp # /usr/ccs/bin/make passwd
After logging in, the new user can run passwd at any time to establish a different password.
% passwd username
The rpc.yppasswdd daemon starts automatically on the master server. Notice that when the -m option is given to rpc.yppasswdd, the make command is run in /var/yp immediately following a modification of the file. If you want to avoid having the make command run each time the passwd file is changed, remove the -m option from the rpc.yppasswd command in the ypstart script and control the pushing of the passwd maps through the crontab file.
NIS netgroups are groups (sets) of users or machines that you define for your administrative purposes. For example, you can create netgroups that do the following.
Define a set of users who can access a specific machine
Define a set of NFS client machines to be given some specific file system access
Define a set of users who are to have administrator privileges on all the machines in a particular NIS domain
Each netgroup is given a netgroup name. Netgroups do not directly set permissions or access rights. Instead, the netgroup names are used by other NIS maps in places where a user name or machine name would normally be used. For example, suppose you created a netgroup of network administrators called netadmins. To grant all members of the netadmins netgroup access to a given machine, you only need to add a netadmin entry to that machine's /etc/passwd file. Netgroup names can also be added to the /etc/netgroup file and propagated to the NIS netgroup map. See netgroup(4) for more detailed information on using netgroups.
On a network using NIS, the netgroup input file on the master NIS server is used for generating three maps: netgroup, netgroup.byuser, and netgroup.byhost. The netgroup map contains the basic information in the netgroup input file. The two other NIS maps contain information in a format that speeds lookups of netgroup information, given the machine or user name.
Entries in the netgroup input file are in the format: name ID, where name is the name you give to a netgroup, and ID identifies a machine or user who belongs to the netgroup. You can specify as many IDs (members) to a netgroup as you want, separated by commas. For example, to create a netgroup with three members, the netgroup input file entry would be in the format: name ID, ID, ID. The member IDs in a netgroup input file entry are in the following format.
([-|machine], [-|user], [domain])
Where machine is a machine name, user is a user ID, and domain is the machine or user's NIS domain. The domain element is optional and should only be used to identify machines or users in some other NIS domain. The machine and user element of each member's entry are required, but a dash (-) is used to denote a null. There is no necessary relationship between the machine and user elements in an entry.
The following are two sample netgroup input file entries, each of which create a netgroup named admins composed of the users hauri and juanita who is in the remote domain sales and the machines altair and sirius.
admins (altair, hauri), (sirius,juanita,sales) admins (altair,-), (sirius,-), (-,hauri), (-,juanita,sales)
Various programs use the netgroup NIS maps for permission checking during login, remote mount, remote login, and remote shell creation. These programs include mountd, and login. The login command consults the netgroup maps for user classifications if it encounters netgroup names in the passwd database. The mountd daemon consults the netgroup maps for machine classifications if it encounters netgroup names in the /etc/dfs/dfstab file. In fact, any program that uses the ruserok interface checks the netgroup maps for both machine and user classifications if they encounter netgroup names in the /etc/hosts.equiv or .rhosts file.
If you add a new NIS user or machine to your network, be sure to add them to appropriate netgroups in the netgroup input file. Then use the make and yppush commands to create the netgroup maps and push them to all of your NIS servers. See netgroup(4) for detailed information on using netgroups and netgroup input file syntax.