Trusted systems, LDAP and autofs

[Jim Krol]

I normally work in an untrusted environment using NIS as the name server. I have been thrust into an environment that uses trusted systems. I know NIS is a No-No in trusted systems and I would like to know what are my options for replaceing NIS in a trusted environment. NIS+ is a possibility, but it is becomeing an anacronism. LDAP looks like a current technolgy, and should serve the purpose for most of the NIS maps. The one map I didn't see mentioned in the LDAP documentation was the automount (autofs) maps. In my NIS environment most NFS mounts are determined by NIS auto.XXXX maps. Can this be done using LDAP? Is there another solution to get the same functionality as NIS in a trusted system environment.

Thanks,
Jim Krol
james.krol@boeing.com

[Steven E. Protter]

I think you're getting most of your NIS functionality by going LDAP.

You will probably have to change your methodology with regards to autofs and NFS.

I may be wrong.

Where I want to back you up is the LDAP decision. NIS+ is very complex and less and less people are using it. The NIS+ section was the last section we did back in sysadmin school. It was done on Friday and half the class chose to go to their airplanes rather than learn it and do the excercize.

That was a number of years ago.

LDAP is the right decision in my opinion based on the facts presented.

SEP

[Bob Neal-Joslin]

Hi Jim,

Version B.03.30 of LDAP-UX supports co-existance with Trusted Systems.

Version B.04.00 of LDAP-UX includes support for AutoFS, pending an updated release of the AutoFS code as well. Further details are available in the LDAP-UX release notes, which are downloadable at http://docs.hp.com/en/internet.html#LDAP-UX%20Integration. Here's a snippit of the relevant information:

In order to support automount information in LDAP on HP-UX 11i v1, you must obtain and install Enhanced AutoFS version B.11.11.0509.1. This version of Enhanced AutoFS is planned to be made available in September 2005.

The Enhanced AutoFS product can be downloaded from software.hp.com and is registered as the "ENHAUTO" product. It can be downloaded from: http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=ENHAUTO

[Don Mallory]

If you've got multiple systems, (obvious, you're using NIS), you're probably also limiting access to some systems by some users.

LDAP gives an all or nothing sort of access. If you are in the directory, you have access to the server.

Make sure you look at the pam_authz modules as well. Pre LDAPUX 4.0 it only supported netgroups and localised entries in the /etc/password (+username grants acess, not there or -username denies).

With 4.0, the @groupname was supposed to be added and should support the Windows Active Directory 'memberOf' function as well.

Unfortunatley I haven't had time to test 4.0 as of yet. I went quite far with 3.3, spiffy, but we have the same automouter, issues and the issue above that were show stoppers for the time being.

Waiting patiently for that new AutoFS.

Don