NIS vs. LDAP

[Olivier Masse]

Currently I have a homemade solution to replicate passwords to my 50+ servers. I'm looking into something more supportable in the long term. I'm with 11iv2 and plan on moving to 11iv3 sometime next year.

NIS+ has been removed since 11iv3. NIS is still available and would be enough for my needs but I'll spare all the security issues that could arise from it (even if using IP Filter or IPSec).

I know nothing about LDAP. But the LDAP-UX client does seem to be well-supported and documented by HP. I could set up a small OpenLDAP server just for my HP-UX domain and be through with it. I don't care if the server component is open-source as long as it works.

1. Is using NIS in 2008 a good idea? I think not but I'm open to any argument in favor of NIS, if there are any. It's easy to setup, for one.

2. Is setting up a dedicated LDAP server, only to host HP-UX accounts (and possibly Apache passwords as well), easy to do? Any reading suggestions on the subject?

Points will be awarded, thanks.

P.S. We have a corporate LDAP server somewhere but I'd rather stay away from it, for various reasons (red tape among others)... So don't suggest this avenue please.

[TTr]

How reliable, effective and manintenable is your homemade solution?

I use NIS with a bunch of 11.23 servers. It works fine but because I have password aging (the comma based in the password string) there are some minor issues with the password aging. I had to maintain the 10.20 NIS master because of it and still one minor issue remains. I don't know what NIS looks like in 11.31. I wish it made a come back with added encryption etc.
I don't use shadow passwords so I don't know if NIS can handle them. It may be as simple as adding /etc/shadow in the list of NIS maps.

I also looked at LDAP but it is much more involved. There is an LDAP/NIS gateway but that is to help during the migration. You need to do a lot of reading and get comfortable with the LDAP structures that you have to create to accomodate the standard UNIX password/roup structure. Maintaining an LDAP environment is not trivial either.
HP provides the Red Hat directory server (Netscape porting with Red Hat label) for HP-UX.

[Patrick Wallek]

I would go for an LDAP server. If you want to set up one just for your HP-UX servers, that would be OK.

NIS is good but if you are covered by any of the audit standards, HIPPA, Sarbanes-Oxley, possibly PCI, then NIS will never pass an audit.

[Patrick Wallek]

To add to TTr's comments:

NIS on Sun Solaris had the capability to have the shadow file as an NIS map. However, at that time it did not work with HP-UX. That was probably due to the fact that HP-UX had no /etc/shadow file support at that time. The last I worked with it to any extent was about 7 years ago though.

Now that HP-UX has /etc/shadow support, the NIS shadow map **MAY** work. You would need to read up on NIS on HP-UX and see.

I think I would still go for LDAP though.

[TTr]

I just took a quick look at

http://docs.hp.com/en/5992-2187/5992-2187.pdf

and support for shadow passwords is added. I hope encryption is added next.

[Olivier Masse]

Indeed administring an LDAP server does not seem trivial, but enduring a SOX audit with a basic NIS server would scare the hell out of me!

As for Red Hat Directory Server: I actually never noticed that HP had bundled this in HP-UX since a while, I thought it was a third party product. Since it's an "official" product and it's released by HP, I like this. Guess I have some reading to do...

Thanks

[TwoProc]

I use the very same thing - an LDAP server for just the Unix computers. I did this because of the security issues of NIS and NIS+, plus I was informed that it was going away.

[DougStrasburg]

Olivier,

You might want to consider using Kerberos for authentication. As security is becoming more of an issue it seems more are turning to a combination Kerberos/LDAP solution with MS Active Directory as a repository. Kerberos is used for authentication while the LDAP capability (schema) of ADS is extended to hold the Unix account (Posix) information. You might also check the "mod_auth" modules for Apache for LDAP and Kerberos. (e.g., mod_auth_kerb)

[Steven E. Protter]

Shalom,

1. Is using NIS in 2008 a good idea? I think not but I'm open to any argument in favor of NIS, if there are any. It's easy to setup, for one.

No. If you are not currently using it, it would be advised to avoid this technology for the reasons you have stated.

2. Is setting up a dedicated LDAP server, only to host HP-UX accounts (and possibly Apache passwords as well), easy to do? Any reading suggestions on the subject?

There are several working versions of an LDAP server for HP-UX in depot form on http://software.hp.com

It may not be easy to do the setup, but it is possible for you to build a system without integrating to windows.

SEP

[TwoProc]

Re: 2) Easy to do.

No, LDAP for the first isn't particularly easy. It's not particularly daunting either.

We just decided it was the right thing to do, so we went ahead and spent the time to learn it , assemble it, and then implement it.

[Olivier Masse]

Thanks to everyone