NIS

[ben_43]

Hi There:

We have 1 NIS Master and 3 Slaves. We are planning for a scenario where if the Master is down we should be able to add the users. We cannot add any users to the /etc/passwd so the only choice would be to make the next slave server as master. My questions would be
1. what are the steps that we should do to make one of the 3 slaves as master.
2. what are the steps that we should do when the master is up again.
3.Is it possible to automate the steps.
4.Implications.
Can someone help please.

Thanks
Joe.

[S.K. Chan · Accepted solution]

This is what I think you need to do to convert your slave to master. I have not try it before but I think it's very close. Please test it by setting a separate domainname in your environment before you do this on your "real" NIS domain. OK .. assumptions made ..
- Slave and master are in the same subnet.
- No additional maps are configured (eg: automounter maps), means no edits are needed for files like /usr/sbin/ypinit,/var/yp/Makefile and /var/yp/ypmake.
- Backups of latest map files on master exists.
- Master is now down and all your clients are binding to the existing slaves.

On one of your slave
=====================
# domainname
==> Double check, make sure domainname is correct.
# vi /etc/rc.config.d/namesvrs
==> Enable "NIS_MASTER_SERVER" bit.

Restore all the files that NIS manages from tape. Some of those files are/may-be ..
/etc/passwd
/etc/group
/etc/hosts
/etc/protocols
/etc/netgroup
/etc/networks
/etc/services
.....

# cd /var/yp
# mv engr engr.org
==> Say "engr" is your domainname. What you're doing here is saving/renaming the NIS DB directory.
# cd /
# /usr/sbin/ypinit -m
==> Initializing and rebuild the NIS DB. I think it'll prompt for you to enter the hostnames of all your slaves. After this you should see /var/yp/engr created with all your maps in it.

# /sbin/init.d/nis.server stop
# /sbin/init.d/nis.client stop
# /sbin/init.d/nis.server start
# /sbin/init.d/nis.client start
==> Restart client and server processes.
# ypwhich
==> Should show that it's bindind to itself because this is now the master. If it shows that it is binding to another slave, you need to restart "nis.server" on that slave. Then restart "nis.server" on this server (the master).

That's all !! Now when your "dead" master wakes up just turn it into slave first. Once verified everything runs fine, you can take your own time to swap both of them later. Just follow the same steps above. As far as automating it, I suppose you can write a script based on the above.

[ben_43]

Thanks SK:

The only point on when the dead master comes up it would try to become master. So when it comes up should i go into single user mode and make these changes.(to have it as slave). Also what will happen to the maps that were created when the master was down?? I mean how will the master be in sync with the standby master?? before it becomes the master?

Thanks
Ben J

[S.K. Chan]

The only point on when the dead master comes up it would try to become master. So when it comes up should i go into single user mode and make these changes.(to have it as slave).
==> Yes, I'm assuming worst case scenario whereby your master server had some hardware problem and needs manually intervention when it's back in operation.

Also what will happen to the maps that were created when the master was down??
==> These maps will reside in your "used-to-be-slave-now-master" server. All files (eg: /etc/passwd, etc, etc) will get updated here.

I mean how will the master be in sync with the standby master?? before it becomes the master?
==> When the "original-master" becomes a slave the NIS DB will always get updated (/var/yp/). Is those files that were managed by NIS that needs to be transferred over when you decide to swap the two servers.

[ben_43]

Thanks again.
1. What was the purpose of creating a new NIS DB directory on the used-to-be-slave?

2. After the master comes up what NIS DB would it use. I am not clear of what it is doing?

Thanks
Ben J

[S.K. Chan]

1. What was the purpose of creating a new NIS DB directory on the used-to-be-slave?
==> If you look at the difference in /var/yp/ between the master and the slave, you will see for each map (take for example "passwd" map) there is an additional file in the master not found in the slave, that file is "passwd.time". Other DB files..
passwd.byname.dir
passwd.byname.pag
passwd.byuid.dir
passwd.byuid.pag
are the same in size and timestamp. So to answer you question, everytime a "new" master is setup the NIS DB has to be re-created ("ypinit -m"). You cannot use the existing /var/yp/ which is used for the slave.

2. After the master comes up what NIS DB would it use. I am not clear of what it is doing?
==> It would use the DB that you have re-created from all the "latest" files that are managed by NIS. By running "ypinit -m" it rebuilt the NIS DB in /var/yp/.

[ben_43]

Hi SK:

Sorry for the delay in reply. I needed some clarification on the "tape" part.

1. Is it even possible to recover files from one machine to a different one thru tape?
2. What would be an alternate solution if the tape devices are not connected to the current slaves?

Thanks
Ben J

[S.K. Chan]

Hi Joe, please no apology :)
=> In my 1st reply I'm assuming you have some kind of backup on your NIS master. What I do here is (on top of the regular backup-to-tape process) I backed up those files managed by NIS and all other NIS related config files (eg: /usr/sbin/ypinit,/var/yp/Makefile and /var/yp/ypmake, /etc/rc.config/namesvrs) to a separate location on another server. That way I can get them faster when needed. When you convert one of your slave to master all you need are the files mentioned, so the recovery-from-tape will be a partial recovery. As long as you have a tape drive conected on any Unix box, you can always remotely access it. The drive does not need to be local. For eg:
# frecover -f venus:/dev/rmt/0m -I /tmp/index
==> Recover "index" file from a tape drive attached to host "venus".

[ben_43]

Thanks SK. This has been a wonderful NIS walkthru, but i still have some clarifications to make. Here are my questions below....

1. I think this is the way (the steps that you provided) the NIS was setup initially (thru manual effort). Is there a way to "promote" the slave to master w/o the manual work???

2. About the frecover...I think we are running the make_recovery_A (back up og vg00) on the master. So the files you mentioned for NIS i think ahould be covered is it not?

3. Can you go thru all the files required to be copied from tape on the slave. I mean each file for what purpose..

4. Will the tape be accessable if the master is down?????

Thanks SK once again,

Regards
Ben J

[ben_43]

S.K. Are you there???? Pl. Advise.

Thanks
Ben J

[S.K. Chan]

1. Yeah, you're right it does look like the procedure that you would take to setup the master manually. Frankly I do not know of any other way to do this easily except for translating your steps into a script. I do not have that script since I have documented the recovery procedure quite thoroughly on my site.

2. Yes (provided all your files are in vg00 which I think they should be, if you leave all those files that NIS manages in their original location). You can try to extract some files (eg: /etc/group, /etc/passwd) from the tape on a different machine just to mke sure. For example (say the tape drive is /dev/rmt/0m)..
# mt -f /dev/rmt/0mn rew
==> Remember ..use "no rewind device 0mn". First rewind the tape t the beginning. This step may not be necessary.
# mkdir /tmp/testarea
# cd /tmp/testarea
# tar -xvf /dev/rmt/0mn etc/passwd
==> That should just extract "passwd" file and put it in /tmp/testarea.

3. Lets start with files that are managed by NIS. By default (meaning if you do not add any additional map into NIS to manage) you can look at /usr/sbin/ypinit, the "MASTER_MAPS" definition list and those files are ..
/etc/mail/aliases
/etc/auto_master
/etc/group
/etc/hosts
/etc/netgroup
/etc/netid
/etc/networks
/etc/passwd
/etc/protocols
/etc/publickey
/etc/rpc
/etc/services
/etc/vhe_list
/etc/ethers
/etc/netmasks
Now I'm sure not all files are used even though they are distributed when you pushed the maps. It does not matter. For example /etc/auto_master (for Automounter). If you do not use automounter then this map is not used.
Next (this may/may-not applies to your environment), are the NIS config files.
/etc/rc.config/namesvrs
==> If all you need to enable te NIS_MASTER bit then you may just decide to manually change it instead of recovering it from tape.
/usr/sbin/ypmake
/var/yp/ypmake
/var/yp/Makefile
==> These 3 files are only needed if you have modified them before to add additional maps that were not in the above list. For example, in my case I added /etc/auto_users (used for automounting) on top of the list of files that I need NIS to manage for me. So I will need those 3 files when I rebuild my master server.

4. Yes. See 2.

[S.K. Chan]

Hi again,
I forgot to include an additional step after you rewind the tape. Sorry ! That step is ..
# mt -f /dev/rmt/0mn fsf 1
Now you can do your tar extract from the recovery tape.

[ben_43]

Thanks SK. Real Help. But my guys here are looking for a process which should be an automated process of converting a slave to master. Let us see.

Thanks & Regards
Ben J

[ben_43]

SK

One more question. In the steps that you mentioned...

Do we need to re-start the NIS clients on the slave servers? If so why?? Please explain.



Thanks
Ben J

[S.K. Chan]

Hi Ben,
On the slave server that you have just converted to NIS master, the answer is yes because you want it to force it to bind to itself. On the other slaves the answer is "most probably no" because those slaves would know how to "self-adjust" if any of them is binding to the slave-that-was-converted-to-master. You can do this to confirm, after the conversion of your slave to a master, check the binding on the rest of the remaining slaves (do ypwhich), if they behave well you don't have to do anything. Hope that answer your question.

[ben_43]

Hi SK:

Hope you see this question!!!

We have decided to have the dead master (after it comes up) to be the slave permanently, so that the used-to-be-slave-now-master would be the permanent master. with that in mind let me know if the following steps would be OK when the dead master comes alive...

1. Go to single user mode.
2. edit /etc/rc.config.d/namesvrs file to change NIS_SLAVE_SERVER to 1 and NIS_MASTER_SERVER to 0
3. exit and save.
4. reboot.
Is this OK. Is the reboot required? Any other points i am missing. what about the maps???Kindly confirm the steps. It would be very useful

Thanks
Ben.

[S.K. Chan]

Hi Ben,
Not quite. It needs more work than that. First in the single user mode, lets set it up as NIS client first (ie in "namesvrs" file only set NIS_CLIENT="1"). Also make sure the escape sequence is added to /etc/passwd and /etc/group files. The reason is I'm NOT going to assume all the NIS DB files are intact.

Now when it comes up, verify that's is running as an NIS client ..
# ypwhich
# ps -ef|grep bind
==> It should only have one process ie "ypbind".
Once that's ok, you can proceed to configure this machine as a slave. First you might want to rename the NIS DB directory ..(say your domain name is "engr") because we want to create a fresh one.
# cd /var/yp
# mv engr engr.old

Now proceed with these steps to set it up as an NIS slave..
# domainname engr
# /usr/sbin/ypinit -s
=> This will copy the NIS DBs from Master.
# ll /var/yp/engr
=> Verify it.
# vi /etc/rc.config.d/namesvrs
=> Set NIS_SLAVE_SERVER=1,NIS_DOMAIN=engr
# /etc/shutdown -r -y 0
=> Reboot it.

When it comes, verify thst this is now a slave.
# ps -ef|grep bind
==> You should see 3 processes(ypserv,ypxfrd and ypbind)
Now you got it up and running !!

One final step (this may be optional but do it anyway). On the NIS master ..

# cd /var/yp/engr
# makedbm -u ypservers > ../nis-server-list
==> This extract the data from "ypservers". We need to check if the hostname of the slave server that you just configured is in here or not.
# vi ../nis-server-list
==> If not add the hostname of the slave.
# makedbm ../nis-server-list ypservers
==> Update the DB.
# /var/yp/ypmake
==> After this login to the Slave and make sure these files got updated (check its timestamp).
/var/yp/engr/ypservers.dir
/var/yp/engr/ypservers.pag
If they are not updated, push it again from the Master.
# yppush -v ypservers

Let me know if you need more help ..

[ben_43]

Thanks SK,

Three more doubts..

1. Also make sure the escape sequence is added to /etc/passwd and /etc/group files

I do not Understand the meaning of this statement.

2. makedbm -u ypservers > ../nis-server-list

what is ../nis-server-list ? i mean the ..?

3. After we change it to client from the single user mode should i press ctrl D to make the machine come up?

Thanks again,
Ben

[S.K. Chan]

1. This is the entry that looks like this ..(right at the end of the file)
in passwd file
--------------
+::0:0:::
in group file
-------------
+:
Take a look at your existing clients. In the passwd file it may also look like this instead..
+::-2:60001:::
OR
+::-2:-2:::
The first one (ie +::-2:60001:::) is the most secure one.


2. I'm just creating the "nis-server-list" file one level up from the current directory you're at. It does not matter, you can run it like so ..
# makedbm -u ypservers > /tmp/nis-server-list
and later
# makedbm /tmp/nis-server-list ypservers

3. Yes let it boot up as NIS client.

[ben_43]

Hi SK:

Now proceed with these steps to set it up as an NIS slave..
# domainname engr
# /usr/sbin/ypinit -s
=> This will copy the NIS DBs from Master.
# ll /var/yp/engr
=> Verify it.
# vi /etc/rc.config.d/namesvrs
=> Set NIS_SLAVE_SERVER=1,NIS_DOMAIN=engr
# /etc/shutdown -r -y 0
=> Reboot it. (IS THIS REQUIRED?????)

When it comes, verify thst this is now a slave.
# ps -ef|grep bind
==> You should see 3 processes(ypserv,ypxfrd and ypbind)
Now you got it up and running !!

SK..The reboot above is it a must. OR will a stop and start of nis.server will do?

Thanks
Ben.

[S.K. Chan]

Hi Ben,
It's not a must but recommended for a "cleaner" startup. However you should be able to use the startup script in /sbin/init.d. I would recommend stop nis.client also.
# /sbin/init.d/nis.client stop
Now start it up like so ..
# /sbin/init.d/nis.server start
# /sbin/init.d/nis.client start

[ben_43]

Hi SK:

1. This is the entry that looks like this ..(right at the end of the file)
in passwd file
--------------
+::0:0:::
in group file
-------------
+:
Take a look at your existing clients. In the passwd file it may also look like this instead..
+::-2:60001:::
OR
+::-2:-2:::
The first one (ie +::-2:60001:::) is the most secure one.

What is the significance of these +: entries for ex. if i have a group called gruop.ben then how would nis know what group it buils from. Can you please explain this..

thanks a lot,
Ben.

[S.K. Chan]

The +: entry means "include the NIS map in this file". That's why it's always at the last line as the lines above it takes precedence. Without it the system would not know where to look for if a username for example is not found in the local password file. It also tells the system to give an RPC call to the NIS server for information.

I did not quite understand your last question but I'll try to explain ..
You'll have to tell NIS which file you want to manage. It's just so happen that "/etc/group" is one of the file that NIS manages, so no additional "edits" are needed to the NIS distribution script (eg: /usr/sbin/ypinit,/var/yp/Makefile,/var/yp/ypmake). If you have additional map or file you want NIS to distribute (a good example is the automounter maps) then it will have to be included in the above files.

[Kevin Wright]

Ben, I suggest you buy a book that covers NIS if your going to be implementing it into your environment.