Generic accounts in NIS environment

[Rosli Ahmad]

Hi,
We are running NIS within multiple UNIX platforms and created a number of faceless accounts. For easy recognition & administration purposes, we have replaced the encrypted value of password columns in passwd file with *GENRCACCT*. Users would use sudo to login as these generic accounts.
Our problem is: these accounts can't rlogin to other HP hosts, but works fine for Sun and Linux machines. The .rhosts entry allows connection from all hosts ie. +@allsys .
Anybody has any suggestions on how to troubleshoot this?

Thanks.
-rosli-

[Kent Ostby]

My approach to troubleshooting it would be:

a) Put in one system name or IP address in with and try that.

If it works then the problem is in your format of the machine.

If it doesn't work then it doesn't like your

b) check permissions on the file
They should be 600.

c) my understanding of the "@" syntax is that you have to define a group using netgroup(4) that matches the name you use in the .rhosts file.

I'm not aware of an "allsys" construct unless this is a netgroup you have defined.

Hope that helps.

Best regards,

Kent M. Ostby

[Rosli Ahmad]

a) Put in one system name or IP address in with and try that.

If it works then the problem is in your format of the machine.

If it doesn't work then it doesn't like your

b) check permissions on the file
They should be 600.

c) my understanding of the "@" syntax is that you have to define a group using netgroup(4) that matches the name you use in the .rhosts file.

I'm not aware of an "allsys" construct unless this is a netgroup you have defined

a) I've tried that, it didn't work even with specific hostname & id.
b) permission is OK for rhosts.
c) Yes, we have an "allsys" netgroup, which constitute of other netgroups eg. allhp,allsun,allibm, etc.

Any other config files I should look into, other than .rhosts & host.equiv??

thanks.
-rosli-

[Dave Olker · Accepted solution]

Hi Rosli,

I seem to recall hearing of a situation with rlogin and the "*" character in the entrypted password field. I believe some rlogin implementations treat * as an "account disabled" type of character and won't allow logins to work with that password.

I'd suggest trying an encrypted password field value that doesn't contain a "*" character and see if that resolves the problem.

Regards,

Dave