passwd Question.

[brian_31]

Hi Team:

We are running a security software which is mandatory for all of our servers. It flags the /etc/passwd file (because it looks for a shadow file may be). It does not flag /etc/passwd.nis. We are using NIS and we cannot go trusted. Is there a way we can create a shadow file so that we get thru this audit?? We can't go NIS+ as we have committed to NIS with lot of development work based on that.Please help.

Thanks
Brian.

[Rodney Hills]

You may want to start using "ldap". The integration tools have options to work with NIS.

You can do a search on this forum for discussions regarding ldap.

-- Rod Hills

[Patrick Wallek]

I, too, have had that problem with security audits on my HP machines running NIS.

To answer your question, NO, there is NOT any option to create a password shadow file without going trusted, which you can't do because of NIS.

Unfortunately, that's the way it is.

[Martin Johnson]

Check into ldap.

HTH
Marty

[A. Clay Stephenson]

Sorry, unless you can go to NIS+ there is no good answer. I suspect that your security software is actually looking an the passwd field inside /etc/passwd and if it sees no passwd or a passwd hash if views this as insecure. It probably expects an impossible value (e.g. '*') before it considers the passwd file to be secure.

[brian_31]

Hi Clay:

It is true that it looks for the shadow files and the * entry in the password file. But what is strange is while there are 1000+ users in /etc/passwd.nis it does not complain about the users's passwd in passwd.nis but complains about a couple of users' passwd in /etc/passwd for poor passwd combination. Wonder why?

Thanks
Brian.

[A. Clay Stephenson · Accepted solution]

That makes perfect sense. The file /etc/passwd.nis means nothing to the OS; /etc/passwd is all that matters. No programs (passwd functions) are going to look in passwd.nis for authenication. In fact, passwd.nis just happens to be your source file for the NIS passwd map (I'm guessing here since it could be named anything). In many cases, the source file for the passwd map is simply /etc/passwd on the NIS master server.

[brian_31]

Thanks Clay:

Got it. I can even name it as passwd.brian and make changes to the respective makefile to effect the changes is it not? Makes sense. So there is really there is nothing we can do to the few /etc/password users (basis sys group) that are getting flagged 'coz there is no shadow file. Is there not even a workaround for this that we can get thru with.

Thanks
Brian.