CDNWiki - View Source: KnowledgeBase/FreeBSD/NIS4Jails

Note: You are viewing an old version of this page. View the current version.
On host:

Assuming NIS domain name 'cdn-mtumishi' and a master of 'master.mtumishi.cyberleo.net':

/etc/rc.conf:
<code brush="bash">
# Jail networking
gateway_enable="YES"
cloned_interfaces="lo1"
ipv4_addrs_lo1="10.4.4.1-7/24"

# NIS stuff
#nisdomainname="cdn-mtumishi"
rpcbind_enable="YES"
rpcbind_flags="-h 10.4.4.1"
nis_server_enable="YES"
nis_server_flags="-h 127.0.0.1 -h 10.4.4.1"
nis_yppasswdd_enable="YES"
nis_yppasswdd_flags="-a -v"
nis_client_enable="YES"
nis_client_flags="-m -S cdn-mtumishi,master"
</code>

/etc/hosts:
<code brush="plain">
10.4.4.1 master.mtumishi.cyberleo.net master
10.4.4.* other jail names
</code>

Populate /var/yp/master.passwd with the master list; same format as /etc/master.passwd

Populate /var/yp/ypservers with the list of servers; currently fqdn and short-dn
<code brush="plain">
master.mtumishi.cyberleo.net master.mtumishi.cyberleo.net
master master
</code>

Populate /var/yp/securenets with the network information
<code brush="plain">
# allow connections from local host -- mandatory
127.0.0.1     255.255.255.255
# allow connections from private subnet
10.4.4.0 255.255.255.0
</code>

Populate /var/yp/netgroup according to your allocation policy:
<code brush="plain">
# Group definitions
U-ADMINS        (,adminusername,cdn-mtumishi) (,anotheradmin,cdn-mtumishi)
U-EVERYONE      U-ADMINS (,mortaluser,cdn-mtumishi) (,anothermortal,cdn-mtumishi)

# Host definitions
H-MASTER        U-ADMINS
H-PUB           U-EVERYONE
H-MAIN          U-ADMINS (,mortaluser,cdn-mtumishi)
</code>

Then invoke 'make' in /var/yp to populate NIS databases. Remember to invoke 'make' after changing anything that might be exported; look in /var/yp/cdn-mtumishi for details.

Then start services rpcbind, ypserv, yppasswdd, ypbind in that order.

Append to host /etc/master.passwd the magic import string, which will import all authorized users as-is, and all other users with a replacement 'nologin' shell:
<code brush="plain">
+@MASTER:::::::::
+:::::::::/usr/sbin/nologin
</code>

Append to host /etc/group the magic import string, which will import all groups and star out their passwords:
<code brush="plain">
+:*::
</code>

Use ypwhich to see what the current ypbind is bound to; use ypcat passwd to retrieve a map from NIS. Use ypchsh to try and change information.

----

When creating a new jail, do this:


In master:
Add H-SHORTHOSTNAME to /var/yp/netgroup and assign ADMINS and whomever else should have access

In jail:

append /etc/rc.conf
<code brush="bash">
nisdomainname="cdn-mtumishi"
nis_client_enable="YES"
nis_client_flags="-m -S cdn-mtumishi,master"
</code>

append /etc/hosts
<code brush="plain">
10.4.4.1 master.mtumishi.cyberleo.net master
</code>

patch /etc/nsswitch.conf
<code brush="diff">
-hosts: files dns
+hosts: files nis dns
</code>

append /etc/master.passwd
<code brush="plain">
+@H-SHORTHOSTNAME:::::::::
+:::::::::/usr/sbin/nologin
</code>

append /etc/group
<code brush="plain">
+:*::
</code>

configure pam_exec to create home directories upon first user login
haven't figured this one out yet.