NIS netgroup problem

[jerry1]

We are transitioning to a new DNS domainname.

When changing the hp box to new DNS domain
the NIS netgroup map quits working for
that host even when netgroup entry has
been update with the new FQHN. This is
for accessing nfs dirs that are 750.

The fix is to put anon=0 and access=hostname
in exports.

Any other host in the same dns domain as the
nfs server and nis server can read/write
to the 750 dirctory without the anon=0 or
access=hostname. Only the netgroup hp9000
in exports access=hp9000 is needed.

What is the deal with separate domains and
nis/nfs access?

[A. Clay Stephenson · Accepted solution]

On one of the "bad" hosts, do a ypcat netgroup. If that fails then NIS is not working (in a different subnet and haven't done a ypset?) but more likely your netgroup is using short hostnames and now that the domain has changed the hostname lookup is failing.

[jerry1]

Correction, only the hostname is needed
in the nfs exports not anon=0.

[jerry1]

Clay, all systems are bound okay.
/etc/resolv.conf has new dns domainname
in search line. nslookup works okay.

[A. Clay Stephenson]

Okay then what do your netgroup triples look like? (hostname,user,domainname). I am not asking what is the structure of the source file for the netgroup map but rather what does ypcat report since that is what really counts.

Don't assume that because nslookup works that NIS netgroup hostname expansion works the same way.

[jerry1]

All checks out.

ypwhich shows bound to correct server.
ypcat netgroup shows netgroup and host as:

hp9000 (host.new.domain.com,,)


exports file on nfs server:

/exportdir -anon=65534,access=hp9000


Don't remember why 65534 was in there.
May have to do with HP Advanced Server software sharing out to PC's.

[A. Clay Stephenson]

65534 (OxFFFE) is the twos-complement representation of -2 expressed as a 16-bit signed integer. You would know (and care about) two-complements had you ever done any assembly programming --- but you young whippersnappers is spoiled. -2 is the NFS convention for the UID of an anonymous user.

Without researching this, I think your netgroup problem is related to your domainname (as reported by the domainname command). Note: While there are DNS domains and NIS domains the two have nothing to do with each other.

[Peter Nikitka]

Hi,

the hostname in the netgroup-triple needs to be in the format in the nsswitch.conf is configured for 'host'-resolves. If you have configured just DNS, FQN-entries are ok

Since using switching of the name resolution in nsswitch.conf, I added every host, where this could occur in 'simple' AND 'FQN'-format.

mfG Peter