Network Information Service
The
Network Information Service or
NIS is
Sun Microsystems' "
Yellow Pages" (YP)
client-server directory service protocol for distributing system configuration data such as user and
host names between
computers on a
computer network.
Sun licenses this technology to virtually all other Unix vendors.
As the name "
Yellow Pages" was a registered
trademark in the
United Kingdom of
British Telecom PLC for their (paper) commercial telephone directory, Sun changed the name of their system to NIS, though all the commands and functions still start with "yp".
NIS/YP is used for maintenance and distribution of a central directory of user and group information, hostnames, e-mail aliases and other text-based tables of information in a computer network. For example, in a common
UNIX environment, the list of users for
identification is placed in
/etc/passwd, and secret
authentication hashes in
/etc/shadow. NIS adds another "global" user list which is used for identifying users on any
client of the NIS domain.
Technically NIS can be configured to serve password data used to authenticate users against as well; however, not only is this cumbersome to do without resorting to
DES encrypted passwords (which are known to be weak) if multiple
OSs are in use, it also allows any NIS client to retrieve the whole password database for offline inspection.
Kerberos was designed to handle authentication in a more secure manner.
In many environments, other directory services such as
LDAP have come to replace NIS, which may be considered to be more modern and secure than NIS. As for example, the 'slapd'
daemon generally runs as a non-root user, and
SASL-based encryption of LDAP traffic is natively supported.
The
nameserver functionality NIS or LDAP can provide is probably better handled by
DNS servers when used on large
LANs, leaving just site-wide identification information for NIS master and slave systems to serve. However, some functions such as the distribution of netmask information to clients, as well as the maintenance of e-mail aliases, may still be performed by NIS or LDAP.
*
ypcat*
ypmatch*
ypwhich*
ypclnt*
yppasswd*
portmap*
TCP Wrappers*
Remote Procedure Call (RPC)
*
Name Service Switch (NSS)
*
Network File System (NFS)
*
Domain Name System (DNS)
*
Hesiod*
The NIS-HOWTO from the
Linux Documentation Project*
Van Emery:
Distributed Authentication System (DAS) Handbook*
Solaris 8 and Debian NIS howto Tim Gibbon
2003*
Kristy Westphal:
NFS and NIS Security Securityfocus article Jan. 22,
2001*
Red Hat Linux 9: Red Hat Linux Security Guide - 5.3. Securing NIS
