NIS Security-set C2 Security to hide the password hash value

In an insecure NIS instance, The ypcat passwd command can be used on any machine to view the hash values of all NIS accounts. This poses a security risk. After C2 Security is set, ypcat passwd can see that the original hash value of the password is replaced by # logname, which can prevent the password hash from being stolen. You only need to perform a few steps to set C2 Security in the existing NIS Environment:

Operations required on the master server:
# Cd/nis
# Mkdir security
# Mv shadow security/passwd. adjunct
# Cd/var/yp
#/Usr/ccs/bin/make passwd. adjunct
Ctrl ^ C
The execution will stop here and press Ctrl + C to exit. Because there is no map of the passwd. adjunct file on the slave when pushing to slave, the push will not go up;

Perform the following operations on all slave servers:
#/Usr/lib/netsvc/yp/ypxfr-h master-server passwd. adjunct. byname

Then return to the master server and continue executing the previous unfinished command:
#/Usr/ccs/bin/make passwd. adjunct
At this time, you can push it to the slave;

Restart the yp service:
#/Usr/lib/netsvc/yp/ypstop
#/Usr/lib/netsvc/yp/ypstart

Note:
1. If the shadow in the NIS directory is copied to the security directory using cp instead of mv, the new password will be changed to the shadow file when passwd or yppasswd is used, instead of the new passwd. the adjunct file, even if the yp service is restarted, is still like this. The shadow password is used for Logon. The shadow file is changed when you change the password.

2. If shadow exists in the original NIS directory, the system will not update or push the passwd if the passwd file is not modified in advance during make passwd, on all machines, passwd still displays the password hash, which does not play a hidden role. On the contrary, if the shadow file does not exist, even if the passwd file does not change, the system also updates and pushes the passwd file each time you make passwd.

3. If the yp service is not restarted, Permission denied may occur when the password is changed.

4. the test shows that make passwd. adjunct is not required when adding users.

1. Configure the NIS server and client in RHEL 5
2. How to configure an instance for NIS on RHEL
3. RHEL5.1 Master/Slave NIS server configuration and Testing