diff --git a/en_US.ISO8859-1/books/handbook/advanced-networking/chapter.sgml b/en_US.ISO8859-1/books/handbook/advanced-networking/chapter.sgml index 9408f97a01..0a33266ff6 100644 --- a/en_US.ISO8859-1/books/handbook/advanced-networking/chapter.sgml +++ b/en_US.ISO8859-1/books/handbook/advanced-networking/chapter.sgml @@ -4105,7 +4105,7 @@ nis_client_enable="YES" account should also be a member of the group wheel. If there is something wrong with NIS, this account can be used to log in - remotely, become root, and fix things. + remotely, become root, and fix things. @@ -4132,7 +4132,7 @@ nis_client_enable="YES" &man.ypserv.8; and retrieve the contents of your NIS maps, provided the remote user knows your domainname. To prevent such unauthorized transactions, &man.ypserv.8; supports a - feature called securenets which can be used to restrict access + feature called securenets which can be used to restrict access to a given set of hosts. At startup, &man.ypserv.8; will attempt to load the securenets information from a file called /var/yp/securenets. @@ -4275,13 +4275,13 @@ basie&prompt.root; users and/or machines. On larger networks, you will forget to bar some users from logging onto sensitive machines, or you may even have to modify each - machine separately, thus losing the main benefit of NIS, + machine separately, thus losing the main benefit of NIS: centralized administration. The NIS developers' solution for this problem is called netgroups. Their purpose and semantics can be compared to the normal groups used by &unix; file - systems. The main differences are the lack of a numeric id + systems. The main differences are the lack of a numeric ID and the ability to define a netgroup by including both user accounts and other netgroups. @@ -4311,22 +4311,22 @@ basie&prompt.root; - alpha, beta + alpha, beta Normal employees of the IT department - charlie, delta + charlie, delta The new apprentices of the IT department - echo, foxtrott, golf, ... + echo, foxtrott, golf, ... Ordinary employees - able, baker, ... + able, baker, ... The current interns @@ -4346,27 +4346,27 @@ basie&prompt.root; - war, death, famine, pollution + war, death, famine, pollution Your most important servers. Only the IT employees are allowed to log onto these machines. - pride, greed, envy, wrath, lust, sloth + pride, greed, envy, wrath, lust, sloth Less important servers. All members of the IT department are allowed to login onto these machines. - one, two, three, four, ... + one, two, three, four, ... Ordinary workstations. Only the real employees are allowed to use these machines. - trashcan + trashcan A very old machine without any critical data. Even the intern is allowed to use this box. @@ -4376,7 +4376,7 @@ basie&prompt.root; If you tried to implement these restrictions by separately blocking each user, you would have to add one - -user line to each system's + -user line to each system's passwd for each user who is not allowed to login onto that system. If you forget just one entry, you could be in trouble. It may @@ -4392,7 +4392,7 @@ basie&prompt.root; machine, you will only have to define login restrictions for netgroups. If a new user is added, you will only have to add the user to one or more netgroups. Those changes are - independent of each other; no more for each combination + independent of each other: no more for each combination of user and machine do... If your NIS setup is planned carefully, you will only have to modify exactly one central configuration file to grant or deny access to machines. @@ -4492,7 +4492,7 @@ ellington&prompt.user; ypcat -k netgroup.byuser get the list of netgroups for a user. The client setup is quite simple. To configure the server - war, you only have to start + war, you only have to start &man.vipw.8; and replace the line +::::::::: @@ -4502,15 +4502,15 @@ ellington&prompt.user; ypcat -k netgroup.byuser +@IT_EMP::::::::: Now, only the data for the users defined in the netgroup - IT_EMP is imported into - war's password database and only + IT_EMP is imported into + war's password database and only these users are allowed to login. - Unfortunately, this limitation also applies to the ~ + Unfortunately, this limitation also applies to the ~ function of the shell and all routines converting between user names and numerical user IDs. In other words, cd ~user will not work, - ls -l will show the numerical id instead of + ls -l will show the numerical ID instead of the username and find . -user joe -print will fail with No such user. To fix this, you will have to import all user entries without allowing them @@ -4524,7 +4524,7 @@ ellington&prompt.user; ypcat -k netgroup.byuser Import all entries but replace the shell with /sbin/nologin in the imported entries. You can replace any field - in the passwd entry by placing a default value in your + in the passwd entry by placing a default value in your /etc/master.passwd. @@ -4532,7 +4532,7 @@ ellington&prompt.user; ypcat -k netgroup.byuser Make sure that the line +:::::::::/sbin/nologin is placed after +@IT_EMP:::::::::. Otherwise, all user - accounts imported from NIS will have /sbin/nologin as their + accounts imported from NIS will have /sbin/nologin as their login shell. @@ -4559,8 +4559,8 @@ ellington&prompt.user; ypcat -k netgroup.byuser interns. The IT interns are allowed to use the normal workstations and the less important servers; and the IT apprentices are allowed to login onto the main servers. You - add a new netgroup IT_INTERN, add the new IT interns to this - netgroup and start to change the config on each and every + add a new netgroup IT_INTERN, add the new IT interns to this + netgroup and start to change the configuration on each and every machine... As the old saying goes: Errors in centralized planning lead to global mess. @@ -4568,11 +4568,11 @@ ellington&prompt.user; ypcat -k netgroup.byuser be used to prevent situations like these. One possibility is the creation of role-based netgroups. For example, you could create a netgroup called - BIGSRV to define the login + BIGSRV to define the login restrictions for the important servers, another netgroup - called SMALLSRV for the less + called SMALLSRV for the less important servers and a third netgroup called - USERBOX for the normal + USERBOX for the normal workstations. Each of these netgroups contains the netgroups that are allowed to login onto these machines. The new entries for your NIS map netgroup should look like this: @@ -4594,7 +4594,7 @@ USERBOX IT_EMP ITINTERN USERS The first of them adds a netgroup with the accounts allowed to login onto this machine, the second one adds all other accounts with /sbin/nologin as shell. It - is a good idea to use the ALL-CAPS version of the machine name + is a good idea to use the ALL-CAPS version of the machine name as the name of the netgroup. In other words, the lines should look like this: @@ -4606,7 +4606,7 @@ USERBOX IT_EMP ITINTERN USERS /etc/master.passwd ever again. All further changes can be handled by modifying the NIS map. Here is an example of a possible netgroup map for this - scenario with some additional goodies. + scenario with some additional goodies: # Define groups of users first IT_EMP (,alpha,test-domain) (,beta,test-domain) @@ -4671,7 +4671,7 @@ TWO (,hotel,test-domain) maps. If you forget to do this, the new user will not be able to login anywhere except on the NIS master. For example, if we needed to add a new user - jsmith to the lab, we would: + jsmith to the lab, we would: &prompt.root; pw useradd jsmith &prompt.root; cd /var/yp @@ -4713,7 +4713,7 @@ TWO (,hotel,test-domain) server even though they may never actually need it (and they may persist in broadcasting in search of one even after they receive a response from a v2 server). Note that while support for normal - client calls is provided, this version of ypserv does not handle + client calls is provided, this version of ypserv does not handle v1 map transfer requests; consequently, it cannot be used as a master or slave in conjunction with older NIS servers that only support the v1 protocol. Fortunately, there probably are not any @@ -4723,7 +4723,7 @@ TWO (,hotel,test-domain) NIS Servers That Are Also NIS Clients - Care must be taken when running ypserv in a multi-server + Care must be taken when running ypserv in a multi-server domain where the server machines are also NIS clients. It is generally a good idea to force the servers to bind to themselves rather than allowing them to broadcast bind requests and possibly @@ -4781,7 +4781,7 @@ nis_client_flags="-S NIS domain,serverThe format of passwords already in /etc/master.passwd will not be updated until - a user changes their password for the first time after + a user changes his password for the first time after the login capability database is rebuilt. Next, in order to ensure that passwords are encrypted with the