NIS/LDAP and ypcat passwd

[Jim Krol]

I have been reading through the documentation for HP's NIS/LDAP Gateway product.

One reason we are looking into alternative authentication services is that standard NIS allows a full view of the NIS password file.

It is not clear in the NIS/LDAP documentation about whether NIS clients attached to the NIS/LDAP domain can run: ypcat passwd. If so, does that mean the 2nd field, the password field is still viewable? What would the NIS clients see when a 'ypcat passwd' is run?

[Sean OB_1]

Ted,

I don't know the answer to that question. But I believe that NIS+ resolves this issue.

Sean

[Shannon Petry]

If your running an NIS/LDAP gateway then the answer is yes and no, depending on what your doing.

If the passwords are in NIS, then you can ypcat passwd|grep user. If the LDAP contains the auth mechanism, then PAM queries LDAP for auth information.

Both LDAP and YP store passwords in a salted encrypted fashion. I can use LDAP queries just as easy as ypcat to view information. LDAP supports more options, but I have not seen it do enough to make it worth all the headaches yet.

Regards,
Shannon

[Bob Neal-Joslin]

Hi,

If you're using pure NIS with the NIS/LDAP gateway, then the password field is not hidden (though it is hashed, per the comments in the other threads.) The NIS/LDAP gateway tries to make LDAP appear as an NIS server. So from a client perspective, there is no change. The reason being is that the PAM_UNIX authenitcation system needs access to the "crypt"ed password. However, it is possible to use PAM_LDAP instead of PAM_UNIX for authentication. In this case, the a password is kept on the directory server and need not be visible to the HP-UX host. Note that PAM_LDAP is only available on the 11.00+ versions of HP-UX (not availble on 10.20 or earlier.)

I would carefully consider before choosing NIS+. Sun has made annoucements of the discontinuance of NIS+.

Bob

http://docs.hp.com/hpux/internet