Configuring NIS+ Servers to Accept Only New Security Mechanism Credentials

When converting from a lower grade security mechanism to a higher one, the maximum security benefit is achieved by configuring the NIS+ servers to only accept credentials of the new higher grade security mechanism type. Do this only after the servers have been successfully configured to authenticate by using the old and the new mechanism.

Before configuring any system to authenticate by using the new mechanism exclusively, the cached directory objects must be refreshed to include the keys for the new mechanism and verified with nisshowcache.

Configuring NIS+ Servers to Accept Only New Security Mechanism Credentials – Example

Run nisauthconf(1m) on each NIS+ server and reboot. In this example, the NIS+ server will be configured to only accept authentication of dh640-0 credentials.

server#  nisauthconf dh640-0
server# /etc/reboot

Optionally, the directory objects can now be updated to remove the old public keys. This should be done from the master server and nisupdkeys(1m) should be run once for each directory served by the servers authenticating only with the new security mechanism. In this example, the directories to be updated are doc.com, org_dir.doc.com., and groups_dir.doc.com.

masterserver#    nisupdkeys doc.com.
            (screen notices not shown)
masterserver#  nisupdkeys org_dir.doc.com.
            (screen notices not shown)
masterserver#    nisupdkeys groups_dir.doc.com.