Skip Navigation Links | |
Exit Print View | |
Oracle Solaris Administration: IP Services Oracle Solaris 10 1/13 Information Library |
Part I Introducing System Administration: IP Services
1. Oracle Solaris TCP/IP Protocol Suite (Overview)
2. Planning Your TCP/IP Network (Tasks)
3. Introducing IPv6 (Overview)
4. Planning an IPv6 Network (Tasks)
5. Configuring TCP/IP Network Services and IPv4 Addressing (Tasks)
6. Administering Network Interfaces (Tasks)
7. Configuring an IPv6 Network (Tasks)
8. Administering a TCP/IP Network (Tasks)
9. Troubleshooting Network Problems (Tasks)
10. TCP/IP and IPv4 in Depth (Reference)
13. Planning for DHCP Service (Tasks)
14. Configuring the DHCP Service (Tasks)
15. Administering DHCP (Tasks)
16. Configuring and Administering the DHCP Client
Differences Between DHCPv4 and DHCPv6
How DHCP Client Protocols Manage Network Configuration Information
How the DHCPv4 Client Manages Network Configuration Information
How the DHCPv6 Client Manages Network Configuration Information
Enabling and Disabling a DHCP Client
ifconfig Command Options Used With the DHCP Client
Setting DHCP Client Configuration Parameters
DHCP Client Systems With Multiple Network Interfaces
How to Enable a DHCPv4 Client to Request a Specific Host Name
17. Troubleshooting DHCP (Reference)
18. DHCP Commands and Files (Reference)
19. IP Security Architecture (Overview)
21. IP Security Architecture (Reference)
22. Internet Key Exchange (Overview)
24. Internet Key Exchange (Reference)
25. IP Filter in Oracle Solaris (Overview)
27. Introducing IPMP (Overview)
28. Administering IPMP (Tasks)
Part VI IP Quality of Service (IPQoS)
29. Introducing IPQoS (Overview)
30. Planning for an IPQoS-Enabled Network (Tasks)
31. Creating the IPQoS Configuration File (Tasks)
32. Starting and Maintaining IPQoS (Tasks)
33. Using Flow Accounting and Statistics Gathering (Tasks)
Oracle Solaris systems support the following name services: DNS, NIS, NIS+, and a local file store (/etc/inet/hosts). Each name service requires some configuration before it is usable. The name service switch configuration file (see nsswitch.conf(4)) must also be set up appropriately to indicate the name services to be used.
Before a DHCP client system can use a name service, you must configure the system as a client of the name service. By default, and unless configured otherwise during system installation, only local files are used.
The following table summarizes issues that are related to each name service and DHCP. The table includes cross-references to documentation that can help you set up clients for each name service.
Table 16-1 Name Service Client Setup Information for DHCP Client Systems
|
You can use the NIS+ name service on Oracle Solaris systems that are DHCP clients. However, if your DHCP server can provide different addresses at different times, this partially circumvents one of the security-enhancing features of NIS+, the creation of Data Encryption Standard (DES) credentials. For the sake of security, configure the DHCP server to provide the same address all the time. When you set up an NIS+ client that is not using DHCP, you add unique DES credentials for the client to the NIS+ server. There are several ways to create credentials, such as using the nisclient script or the nisaddcred command.
NIS+ credential generation requires a client to have a static host name to create and store the credentials. If you want to use NIS+ and DHCP, you must create identical credentials to be used for all the host names of DHCP clients. In this way, no matter what IP address and associated host name that a DHCP client receives, the client can use the same DES credentials.
The following procedure shows you how to create identical credentials for all DHCP host names. This procedure is valid only if you know the host names that DHCP clients use. For example, when the DHCP server generates the host names, you know the possible host names that a client can receive.
A DHCP client system that is to be an NIS+ client must use credentials that belong to another NIS+ client system in the NIS+ domain. This procedure only produces credentials for the system, which apply only to the superuser logged in to the system. Other users who log in to the DHCP client system must have their own unique credentials in the NIS+ server. These credentials are created according to a procedure in the System Administration Guide: Naming and Directory Services (NIS+).
# nisgrep nisplus-client-name cred.org_dir > /tmp/file
This command writes the cred.org_dir table entry for the NIS+ client to a temporary file.
Or, use a text editor.
You must copy the public key and private key, which are long strings of numbers and letters separated by colons. The credentials are to be pasted into the command issued in the next step.
# nistbladm -a cname=" dhcp-client-name@nisplus-domain" auth_type=DES \ auth_name="unix.dhcp-client-name@nisplus-domain" \ public_data=copied-public-key \ private_data=copied-private-key
For the copied-public-key, paste the public key information that you copied from the temporary file. For the copied-private-key, paste the private key information that you copied from the temporary file.
# rcp nisplus-client-name:/var/nis/NIS_COLD_START /var/nis # rcp nisplus-client-name:/etc/.rootkey /etc # rcp nisplus-client-name:/etc/defaultdomain /etc
If you get a “permission denied” message, the systems might not be set up to allow remote copying. In this case, you can copy the files as a regular user to an intermediate location. As superuser, copy the files from the intermediate location to the proper location on the DHCP client system.
# cp /etc/nsswitch.nisplus /etc/nsswitch.conf
The DHCP client system should now be able to use NIS+ services.
Example 16-1 Setting up an DHCP Client System as an NIS+ Client
The following example assumes that you have one system nisei, which is an NIS+ client in the NIS+ domain dev.example.net. You also have one DHCP client system, dhow, and you want dhow to be an NIS+ client.
(First log in as superuser on the NIS+ server) # nisgrep nisei cred.org_dir > /tmp/nisei-cred # cat /tmp/nisei-cred nisei.dev.example.net.:DES:unix.nisei@dev.example.net:46199279911a84045b8e0 c76822179138173a20edbd8eab4:90f2e2bb6ffe7e3547346dda624ec4c7f0fe1d5f37e21cff63830 c05bc1c724b # nistbladm -a cname="dhow@dev.example.net." \ auth_type=DES auth_name="unix.dhow@dev.example.net" \ public_data=46199279911a84045b8e0c76822179138173a20edbd8eab4 \ private_data=90f2e2bb6ffe7e3547346dda624ec4c7f0fe1d5f37e21cff63830\ c05bc1c724b # rlogin dhow (Log in as superuser on dhow) # rcp nisei:/var/nis/NIS_COLD_START /var/nis # rcp nisei:/etc/.rootkey /etc # rcp nisei:/etc/defaultdomain /etc # cp /etc/nsswitch.nisplus /etc/nsswitch.conf # reboot
The DHCP client system dhow should now be able to use NIS+ services.
Example 16-2 Adding Credentials With a Script
If you want to set up a large number of DHCP client systems as NIS+ clients, you can write a script. A script can quickly add the entries to the cred.org_dir NIS+ table. The following example shows a sample script.
#! /usr/bin/ksh # # Copyright (c) by Sun Microsystems, Inc. All rights reserved. # # Sample script for cloning a credential. Hosts file is already populated # with entries of the form dhcp-[0-9][0-9][0-9]. The entry we're cloning # is dhcp-001. # # PUBLIC_DATA=6e72878d8dc095a8b5aea951733d6ea91b4ec59e136bd3b3 PRIVATE_DATA=3a86729b685e2b2320cd7e26d4f1519ee070a60620a93e48a8682c5031058df4 HOST="dhcp-" DOMAIN="mydomain.example.com" for i in 002 003 004 005 006 007 008 009 010 011 012 013 014 015 016 017 018 019 do print - ${HOST}${i} #nistbladm -r [cname="${HOST}${i}.${DOMAIN}."]cred.org_dir nistbladm -a cname="${HOST}${i}.${DOMAIN}." \ auth_type=DES auth_name="unix.${HOST}${i}@${DOMAIN}" \ public_data=${PUBLIC_DATA} private_data=${PRIVATE_DTA} cred.org_Dir done exit 0