Re: NIS and shadow passwords

Mike Segel wrote: > Chao Y. Din wrote: > > > > NIS and NIS+ on Solaris work. They do not blow the security away. > [I wrote] > > > However NIS kinda blows the security away. > > > Can you say ypcat ? :-) > > > (Although that is supposed to be fixed in NIS+ right?) > > Gee, under NIS, if I do a YPCAT passwd, I'm pretty sure I can > get your passwd file. Mike, You probably know something that I don't understand. I don't know how to get passwd file through YPCAT. In fact, I still have not figured out what is the source of Sun's public key for NIS+. But that is not the point. (BTW, NIS+ does not necessarily be NIS compatible.) Just because NIS/NIS+ is free with Solaris, does not mean NIS/NIS+ should be implemented. When discussing NIS/NIS+, I assume there is a requirement that cannot be met without using NIS/NIS+. If we have no special requirements, why both with NIS/NIS+. If the original post discussed the requirement for implementing NIS and accessing shadow passwords, we probably wouldl not have the argument. The project I worked before utilized NIS+ to meet a requirement -- using single account and single password to log into all database servers (more than 10). Do you have a more "cost-effective" way than NIS/NIS+? I can come up two alternatives: (1) using unicenter and (2) writing our own code to create account, change password, delete account, make sure all accounts/passwords on all servers are in sync, ... etc. Unicenter is quite expensive. Even though CSC can get Unicenter for free (training is free too), our client still objected to it because of the cost. Once CSC contract with the client is over, our client must pay a large amount of money to use it. As to develop our own code to handle the requirement, I am sure we will create more security holes than YPCAT. > Now, with a room full of suns/hps/pentiums running linux, etc ... > armed with crypt() (The fast one ;-) How long do *you* think it > would take before I could break your passwd using brute force? Does this issue unique to NIS/NIS+? Secondly, NIS+ has additional security level that does not exist in NIS. If users can live with multiple accounts/passwords, we don't need to discuss NIS at all. > Of course, I could use a dictionary first to get all the easy ones. > > To me, this is a security risk. > Of course on suns, any sun without a stored firmware passwd, I > could still do some serious damage even if NIS+ didn't allow ypcat. > > So, you're right, ypcat doesn't pose a security threat. ;-) > (My point being security is a relative concept.) > > -Mikey. > BTW, No, I'm not paranoid, EVERYONE *IS* out to get me 8^) Chao Y. Din