Set any required map options and specify which NIS maps to create using the all target, for example:

all:
passwd group auto.home
# hosts rpc services netid protocols mail \
# netgrp shadow publickey networks ethers bootparams printcap \
# amd.home auto.local. passwd.adjunct \
# timezone locale netmasks

This example allows NIS to create maps for the /etc/passwd, /etc/group, and /etc/auto.home files. By default, the information from the /etc/shadow file is merged with the passwd maps, and the information from the /etc/gshadow file is merged with the group maps.

For more information, see the comments in /var/yp/Makefile.

If you intend to use Kerberos authentication instead of NIS authentication, change the values of MERGE_PASSWD and MERGE_GROUP to false:

MERGE_PASSWD=false
MERGE_GROUP=false

If you configure any NIS slave servers in the domain, set the value of NOPUSH to false:

NOPUSH=false

If you update the maps, this setting allows the master server to automatically push the maps to the slave servers.

Start the ypserv service and configure it to start after system reboots:

# service ypserv start
# chkconfig ypserv on

The ypserv service runs on the NIS master server and any slave servers.

If the server will act as the master NIS server and there will be at least one slave NIS server, start the ypxfrd service and configure it to start after system reboots:

# service ypxfrd start
# chkconfig ypxfrd on

The ypxfrd service speeds up the distribution of very large NIS maps from a NIS master to any NIS slave servers. The service runs on the master server only, and not on any slave servers. You do not need to start this service if there are no slave servers.

Start the yppasswdd service and configure it to start after system reboots:

# service yppasswdd start
# chkconfig yppasswdd on

The yppasswdd service allows NIS users to change their password in the shadow map. The service runs on the NIS master server and any slave servers.

Edit /etc/sysconfig/network and add the following entries that define the ports on which the ypserv and ypxfrd services listen:

YPSERV_ARGS="-p 834"
YPXFRD_ARGS="-p 835"

These entries fix the ports on which ypserv and ypxfrd listen.

Allow incoming TCP connections to ports 111 and 834 and incoming UDP datagrams on ports 111 and 834 from the local network:

# iptables -I INPUT -s subnet_addr/prefix_length -p tcp \
  -m state --state NEW -m tcp --dport 111 -j ACCEPT
# iptables -I INPUT -s subnet_addr/prefix_length -p tcp \
  -m state --state NEW -m tcp --dport 834 -j ACCEPT
# iptables -I INPUT -s subnet_addr/prefix_length -p udp \
  -m udp --dport 111 -j ACCEPT
# iptables -I INPUT -s subnet_addr/prefix_length -p udp \
  -m udp --dport 834 -j ACCEPT
# service iptables save

In the example, subnet_addr/prefix_length specifies the network address, for example 192.168.1.0/24.

portmapper services requests on TCP port 111 and UDP port 111; ypserv services requests on TCP port 834 and UDP port 834.

On the master server, if you run the ypxfrd service to support transfers to slave servers, allow incoming TCP connections to port 835 and incoming UDP datagrams on port 835 from the local network:

# iptables -I INPUT -s subnet_addr/prefix_length -p tcp \
  -m state --state NEW -m tcp --dport 835 -j ACCEPT
# iptables -I INPUT -s subnet_addr/prefix_length -p udp \
  -m udp --dport 835 -j ACCEPT
# service iptables save

Allow incoming UDP datagrams from the local network on the port on which yppasswdd listens:

# iptables -I INPUT -s subnet_addr/prefix_length -p udp \
  -m udp --dport `rpcinfo -p | gawk '/yppasswdd/ {print $4}'` -j ACCEPT

Edit /etc/rc.local and add the following line:

iptables -I INPUT -s subnet_addr/prefix_length -p udp \
  -m udp --dport `rpcinfo -p | gawk '/yppasswd/ {print $4}'` -j ACCEPT

This entry creates a firewall rule for the yppasswdd service when the system reboots. If you restart yppasswdd, you must correct the iptables rules manually unless you modify the /etc/init.d/yppasswdd script.