Identity Management for UNIX

Identity Management for UNIX

Identity Management for UNIX makes it easy to integrate users of Windows operating systems into existing UNIX environments. It provides manageability components that simplify network administration and account management across both platforms.

With Identity Management for UNIX, you can:

  • Manage user accounts and passwords on Windows and UNIX systems by using Server for Network Information Service (NIS).

  • Automatically synchronize passwords between Windows and UNIX operating systems by using Password Synchronization.

For details about Identity Management for UNIX, see Overview of Identity Management for UNIX.

In this section

Checklist: Deploying Server for NIS

Checklist: Deploying Password Synchronization

Overview of Identity Management for UNIX

Identity Management for UNIX: How To...

Server for NIS

Password Synchronization


Checklist: Deploying Server for NIS

Server for NIS enables a Microsoft Windows–based Active Directory Domain Services (AD DS) domain controller to administer UNIX Network Information Service (NIS) networks. Server for NIS allows you to migrate existing NIS maps from your UNIX-based NIS servers into the AD DS schema, and manage map data by using either command-line or Windows GUI-based tools.

Notes

Server for NIS can only be installed on an AD DS domain controller.

 | Step | Reference
Check box | Read about deploying Server for NIS. | Overview of Server for NIS
Check box | Migrate Network Information Service (NIS) maps to AD DS. | Checklist: Migrating NIS Maps to Active Directory Domain Services
Check box | Set how often maps are propagated to subordinate (also known as slave) NIS servers. | Changing the frequency of map updates
Check box | Review and, if needed, add or remove UNIX subordinate servers in the domain. | Adding or removing UNIX subordinate servers
Check box | As needed, install Server for NIS on other domain controllers, which are automatically configured as subordinate servers. | Install Identity Management for UNIX Components
Check box | Install Password Synchronization on all other domain controllers. This ensures that when a user's password is changed, the password is updated across the domain. Server for NIS receives the updated passwords when the data is replicated to the domain controller. | Install Identity Management for UNIX Components

Additional references

For more information about Server for NIS, see:

  • The Windows Server TechCenter for Active Directory Domain Services (http://go.microsoft.com/fwlink/?LinkId=48547)


Checklist: Migrating NIS Maps to Active Directory Domain Services

Notes

Migration consists of the following three steps:

  1. Migrate the NIS maps to a Windows-based server.

    • Using the command line

      Identity Management for UNIX includes a command-line tool called nis2ad to migrate maps from UNIX-based NIS servers to AD DS–based Server for NIS.

    • Using the migration wizard

      The NIS Data Migration wizard in Identity Management for UNIX extracts the information necessary to perform the migration. Even when using the migration wizard, however, you must complete steps 2 and 3, which follow.

    The migration wizard and the nis2ad command read map data from NIS map source files, which are the plain text files from which the NIS map databases are compiled. These source files must be located in a location that can be accessed by the domain controller during migration, such as on a disk on the domain controller or in a shared directory accessible by the domain controller.

  2. Inform the existing subordinate (also known as slave) NIS servers of the new master NIS server.

    After the migration, the original UNIX-based NIS server must send an update of maps to all subordinate NIS servers with the name of the new master server in the maps.

  3. Disable the original NIS server.

UNIX-based subordinate NIS servers can continue to work as before; however, they receive map updates from the Windows-based computer instead of the UNIX-based computer. Client computers continue to get NIS maps or data from the new master.

Step Reference
Check box

Read more about Network Information Service (NIS) migration.

Understanding NIS Data Migration

Check box

Back up your Windows domain controllers, or use a test domain controller.

Check box

Log on as a member of the Domain Administrators group.

Check box

Identify the NIS domain to migrate and how it will be migrated, keeping in mind the following:

  • You can migrate only one NIS domain at a time, but you can merge the NIS domain with a previously migrated NIS domain.

  • If you do not merge the domain, you can preserve the existing domain name or create a new name for the migrated domain.

  • You should migrate an NIS domain to only one AD DS domain.

Migrating NIS to Active Directory Domain Services

Check box

Make sure that the source files for the NIS maps that you want to migrate can be accessed by the computer running the NIS Data Migration Wizard. (NIS map source files are the plain text files from which the NIS map databases are compiled.) You can make the files available to the Windows-based computer by using network file system (NFS), or by copying them to the Windows-based computer through File Transfer Protocol (FTP). All standard and nonstandard map source files should be in the same directory.

Understanding NIS Data Migration

Check box

Determine which standard NIS maps to migrate, and the directory paths to the map source files, keeping in mind the following:

  • You can migrate maps in steps, that is, migrate one map first, then another, and so on.

  • You should migrate the passwd map before migrating other maps (such as group or shadow maps) that rely on it.

  • You must migrate the networks map before migrating netmasks.

Migrating and Managing Standard and Non-standard Maps

Check box

Determine any nonstandard NIS maps to migrate, their formats, and the directory paths to their map source files. All standard and nonstandard map source files should be in the same directory.

Migrating and Managing Standard and Non-standard Maps

Check box

Examine NIS map source files for multiple entries having the same primary key (for example, more than one user with the same user identifier (UID) in the passwd file) and eliminate the duplicate primary keys.

Resolving Migration Conflicts

Check box

Determine AD DS containers to which you will migrate the NIS domain.

Check box

Decide on the strategy to migrate using one of the following two alternatives. If there are conflicts between the existing map entry and the entry being migrated during the migration process, you can choose one of the following methods:

  • Overwrite the existing entry with data from the entry being migrated.

  • Preserve data from the existing entry and ignore the entry being migrated.

  • Resolve conflicts by changing the Windows account name in Active Directory. If objects of different types have the same name, the names of both objects are changed before the data is migrated.

Best Practices for Server for NIS

Check box

Determine whether you want to run the NIS Data Migration wizard first without migrating to examine all events that will take place during migration (recommended), or migrate all data the first time the wizard is run. The migration wizard can be configured to log all the migration steps without actually migrating the data to Active Directory.

Best Practices for Server for NIS

Check box

Migrate NIS maps to Active Directory on a computer running Windows Server and Active Directory.

Migrating NIS domains

Check box

Review the log files after migration for errors or conflicts. Resolve log conflicts and migrate the resolved entries again.

Resolving Migration Conflicts

Check box

Configure any UNIX NIS subordinate (also known as slave) servers to use Server for NIS as the master NIS server.

Configuring a UNIX NIS Server to Use Server for NIS as the Master Server

Check box

Configure any UNIX NIS client computers to use Server for NIS as the master NIS server.

Configuring UNIX Clients to Use Server for NIS as the Master Server

Check box

Set the passwords of new Windows user accounts (created as a result of the NIS migration) to a known, temporary value, inform the users of the temporary password and instruct them to change their Windows password as soon as possible.

Additional references

For more information about Server for NIS, see:

  • The Windows Server TechCenter for Active Directory Domain Services (http://go.microsoft.com/fwlink/?LinkId=48547)


Checklist: Deploying Password Synchronization

Password Synchronization helps integrate Windows and UNIX networks by simplifying the process of maintaining secure passwords in both environments. With Password Synchronization, you install utilities on your network's UNIX-based computers that detect user password changes on Windows-based computers or domains, then automatically update passwords on every UNIX host on which the users have accounts. You can also configure Password Synchronization to change the user's Windows password when the user's UNIX password is changed.

Notes

You can install Password Synchronization in any of the following three scenarios.

  • You want to synchronize passwords in an NIS domain for which the master server is a Windows-based computer running Server for NIS. See Setting up Password Synchronization for use with an NIS domain (Server for NIS master server) in this topic.

  • You want to synchronize passwords in an NIS domain for which the master server is a UNIX-based NIS server. See Setting up Password Synchronization for use with an NIS domain (UNIX-based master server) in this topic.

  • You want to synchronize passwords for users of standalone UNIX-based hosts who connect to Windows computers. See Setting up Password Synchronization for use with standalone UNIX-based hosts in this topic.

Password Synchronization can be installed only on an Active Directory Domain Services domain controller.

Setting up Password Synchronization for use with an NIS domain (Server for NIS master server)

 | Step | Reference
Check box | Read about Password Synchronization. | Overview of Password Synchronization
Check box | Log on as a member of both the Schema Administrators and Enterprise Administrators groups. |
Check box | Install Password Synchronization on all domain controllers. | Install Identity Management for UNIX Components
Check box | Set the password encryption key. | Setting the password encryption key
Check box | Change other settings, as needed. Be sure to select the UNIX to Windows check box in the Direction of password synchronization area on the General tab of the Password Synchronization Properties dialog box. | Setting default synchronization; Setting computer-specific synchronization properties
Check box | Add UNIX-based computers with which passwords will be synchronized if they are not members of the Network Information Service (NIS) domain. For each computer, select the computer in the list, click Properties, clear the Synchronize password changes to this computer check box, select the Synchronize password changes from this computer check box, and then click OK. If you want to use non-default values, you can also specify values for the port number, encryption key, or both. | Adding or removing computers for synchronization

Setting up Password Synchronization for use with an NIS domain (UNIX-based master server)

 | Step | Reference
Check box | Read about Password Synchronization. | Overview of Password Synchronization
Check box | Log on as a member of both the Schema Administrators and Enterprise Administrators groups. |
Check box | Install Password Synchronization on the appropriate Windows-based computers. If the passwords of local accounts on a server are to be synchronized, install Password Synchronization on the server. If Windows domain passwords are to be synchronized, install Password Synchronization on all domain controllers. | Install Identity Management for UNIX Components
Check box | Set the password encryption key. | Setting the password encryption key
Check box | Change other settings, as needed. Be sure to select the UNIX to Windows check box in the Direction of password synchronization area on the General tab of the Password Synchronization Properties dialog box. | Setting default synchronization; Setting computer-specific synchronization properties
Check box | Add the Network Information Service (NIS) master server to the list of computers with which the Windows-based computer will synchronize passwords. | Adding or removing computers for synchronization
Check box | Add UNIX-based computers with which passwords will be synchronized if they are not members of the Network Information Service (NIS) domain. For each computer, on the General tab of the Add Computer dialog box, clear the Synchronize password changes to this computer check box, select the Synchronize password changes from this computer check box, and then click OK. If you want to use non-default values, you can also specify values for the port number, encryption key, or both. | Adding or removing computers for synchronization
Check box | Specify which users have permissions to synchronize passwords. | Controlling password synchronization for user accounts
Check box | Ensure that the Password Synchronization configurations on all domain controllers in the domain are identical. |

Configuring UNIX-based computers to work with Password Synchronization

Step Reference
Check box

Install and configure the Password Synchronization single sign-on daemon (SSOD) on the NIS master server. Be sure to change the default encryption key in the sso.conf file to match the Password Synchronization encryption key set in preceding steps before copying it to the server, and edit sso.conf to specify the following:

  • USE_NIS=1

  • NIS_UPDATE_PATH=Makefile_path, where Makefile_path is the path and name of the NIS makefile, such as /var/yp/Makefile

Install the Password Synchronization daemon on UNIX-based computers

Check box

Copy the sso.conf file from the NIS master server to the /etc directory of each computer on which the Password Synchronization PAM module is installed.

Check box

On each NIS client on which you installed the Password Synchronization pluggable authentication module (PAM), replace the yppasswd binary file with a link to the passwd binary file, and then edit the /etc/nsswitch.conf file to change the passwd and shadow lines of the file, as shown:

passwd:  files [NOTFOUND=continue] nis
shadow:  files [NOTFOUND=continue] nis

Install Identity Management for UNIX Components

Check box

Start the Password Synchronization daemon on the NIS master server.

Start or stop Identity Management for UNIX components

Setting up Password Synchronization for use with standalone UNIX-based hosts

 | Step | Reference
Check box | Read about Password Synchronization. | Overview of Password Synchronization
Check box | Log on as a member of both the Schema Administrators and Enterprise Administrators groups. |
Check box | Install Password Synchronization on all Windows-based domain controllers. If the passwords of local accounts on a server are to be synchronized, install Password Synchronization on the server. If Windows domain passwords are to be synchronized, install Password Synchronization on all domain controllers. | Install Identity Management for UNIX Components
Check box | Set the password encryption key. | Setting the password encryption key
Check box | Change other settings, as needed. | Setting default synchronization; Setting computer-specific synchronization properties
Check box | Add UNIX-based computers with which passwords will be synchronized if they are not members of the Network Information Service (NIS) domain. For each computer, on the General tab of the Add Computer dialog box, clear the Synchronize password changes to this computer check box, select the Synchronize password changes from this computer check box, and then click OK. If you want to use non-default values, you can also specify values for the port number, encryption key, or both. | Adding or removing computers for synchronization
Check box | Ensure that the Password Synchronization configurations on all domain controllers in the domain are identical. |

Configuring UNIX-based standalone hosts to work with Password Synchronization

 | Step | Reference
Check box | Install and configure the Password Synchronization single sign-on daemon (SSOD) on all UNIX-based computers with which passwords will be synchronized. Be sure to change the default encryption key in the sso.conf file to match the Password Synchronization encryption key set in previous steps before copying it to the UNIX-based computers. | Install the Password Synchronization daemon on UNIX-based computers
Check box | Specify which users have permissions to synchronize passwords. | Controlling password synchronization for user accounts
Check box | Start the Password Synchronization daemon. | Start or stop Identity Management for UNIX components
Check box | Install and configure the Password Synchronization PAM on all UNIX-based computers from which password changes are to be synchronized with Windows passwords. | Install the Password Synchronization pluggable authentication module

Additional references

For more information about Password Synchronization, see:

  • The Windows Server TechCenter for Active Directory Domain Services (http://go.microsoft.com/fwlink/?LinkId=48547)


Overview of Identity Management for UNIX

Overview of Identity Management for UNIX

Identity Management for UNIX makes it easy to integrate computers running Windows into your existing UNIX enterprise. Active Directory network administrators can use Server for NIS to manage Network Information Service (NIS) domains, and Password Synchronization automatically synchronizes passwords between Windows and UNIX operating systems.

With minor differences, Identity Management for UNIX is compliant with Internet Engineering Task Force (IETF) standard Request for Comments (RFC) 2307, meaning that your network's password and NIS attributes can be resolved by the Lightweight Directory Access Protocol (LDAP). For more information about RFC 2307, including a complete list of attributes specified in the RFC 2307 schema, see the RFC database Web site.

Server for NIS completely integrates UNIX NIS networks with Windows Active Directory. Identity Management for UNIX includes an easy-to-use wizard that a Windows domain administrator can use to export NIS domain maps to Active Directory entries. Once this is done, an Active Directory domain controller running Server for NIS becomes the master server for the NIS domain.

Password Synchronization automatically changes a user password on the UNIX network when the user changes his or her Windows password, and vice versa. This allows users to maintain just one password for both networks.

Password Synchronization is supported within the following operating systems:

  • Hewlett Packard HP UX 11i v1

  • IBM® AIX® version 5L 5.2 and 5L 5.3

  • Linux

    • Novell® SUSE® Linux Enterprise Server 10

    • Red Hat® Enterprise Linux® 4 server

  • SunSM Microsystems Solaris™ 10, Scalable Processor Architecture (SPARC)-compatible versions only

Server for NIS should integrate well with any operating system or product that uses LDAP.


Administrative Utilities in Identity Management for UNIX

Identity Management for UNIX Administration

Identity Management for UNIX includes a Microsoft Management console (MMC) that provides a Windows-UI-based method of completing virtually all tasks in Server for NIS or Password Synchronization.

The management tools are installed by default when you install Server for NIS, Password Synchronization, or Identity Management for UNIX as a whole.

Opening the Identity Management for UNIX MMC

You can open the Identity Management for UNIX management console in any of the following ways.

  • Clicking Start, Administrative Tools, and then Microsoft Identity Management for UNIX.

  • Clicking Start, clicking Run, typing idmumgmt.msc into the Open text box, and then clicking OK or pressing Enter.

  • In the hierarchy pane of the Server Manager console, under Active Directory Domain Services, click Microsoft Identity Management for UNIX.


Identity Management for UNIX: How To...

In this section

  • Connect to another computer you want to manage

  • Install Identity Management for UNIX Components

  • Start or stop Identity Management for UNIX components

  • Remove Identity Management for UNIX Components


Connect to another computer you want to manage

To connect to another computer you want to manage

Perform the following steps to manage Identity Management for UNIX on a remote computer.

To connect to another computer

  1. Open Identity Management for UNIX.

    To open Identity Management for UNIX, click Start, point to Administrative Tools, and then click Identity Management for UNIX. You can also open Identity Management for UNIX from Server Manager by expanding Active Directory Domain Services in the hierarchy pane, and then selecting the Identity Management for UNIX node.

  2. Do one of the following:

    • Right-click the Microsoft Identity Management for UNIX node in the hierarchy pane, and then click Connect to another computer. On the Select Computer dialog box, select Another Computer.

    • In the Actions pane, click Connect to another computer, and then select Another Computer.

    • With the Microsoft Identity Management for UNIX node at the top of the hierarchy pane highlighted, click Connect to another computer on the Action menu. On the Select Computer dialog box, select Another Computer.

  3. In the box, type the name or IP address of the computer to use, or click Browse.

  4. When you have identified or found the computer you want, click OK.
Note

You must be logged on with an account that is a member of the Administrators group on the remote computer.

There is no command-line method for this procedure.


Install Identity Management for UNIX Components

Identity Management for UNIX is considered a role service, or a software subcomponent, of the Active Directory Domain Services (AD DS) server role.

To install Identity Management for UNIX components

Using the Windows interface

Using a command line

Installing Identity Management for UNIX by using the Windows interface

Important

Server for NIS and Password Synchronization can be installed only on AD DS domain controllers.

To install Identity Management for UNIX components

  1. Open Server Manager.

  2. In the Roles section, in the list of common tasks, click Add Role Services.

  3. On the Select Role Services page of the Add Role Services Wizard, select the Identity Management for UNIX role services you want to install, and then click Next.

  4. If the wizard prompts you to install any other role services required by Identity Management for UNIX components, click Yes.

  5. After verifying your selections on the Confirm Installation Selections page, click Install.
Notes
  • You must be a member of the Administrators group on the local computer to install Identity Management for UNIX components.
  • Server Manager is available only to members of the Administrators group on the local computer. By default, Server Manager opens when an administrator logs on to the computer. You can open Server Manager from the Start menu, the Quick Launch toolbar, or from within Administrative Tools.

Installing Identity Management for UNIX by using a command line

Server Manager command line tools allow you to install or remove roles, role services, or features in a Windows Command Prompt. Identity Management for UNIX can be installed by using the Server Manager line command because it is a role service of the Active Directory Domain Services role.

You can run the Server Manager line command, ServerManagerCmd.exe, from within any directory on the local computer. You must be a member of the Administrators group on the local computer to run the Server Manager command.

Important

Because of security restrictions imposed by User Account Control in Windows Server 2008, you must run ServerManagerCmd.exe in a Command Prompt window opened with elevated privileges. To do this, right-click the Command Prompt executable, or the Command Prompt object on the Start menu, and then click Run as administrator.

Note

Other parameters are available for this command, such as -restart, which automatically restarts the computer after installation if it is required by the programs you have installed. It is recommended that you read about additional Server Manager command line parameters in the topic "Overview of Server Manager Commands" in the Server Manager Help.

To install Identity Management for UNIX by using a command line

  • In a Command Prompt window opened with elevated privileges, type one of the following and press ENTER.

    • ServerManagerCmd.exe -install ADDS-Identity-Management to install all of Identity Management for UNIX

    • ServerManagerCmd.exe - install ADDS-NIS to install Server for NIS

    • ServerManagerCmd.exe - install ADDS-Password-Sync to install Password Synchronization

    • ServerManagerCmd.exe -install ADDS-IDMU-Tools to install the administration tools for Identity Management for UNIX

    Note

    Add the -whatIf parameter to your command to instruct Server Manager to show the list of all software that is installed by default as a result of the command.

Special considerations for installing or removing Server for NIS

The NIS domain

Upon installation, Server for NIS creates a Network Information Service (NIS) domain with the same name as the AD DS domain. Administrators can add users, groups, or computers to this domain. Moreover, administrators can migrate UNIX NIS domain data to Server for NIS and designate the Server for NIS computer as the master NIS server for the migrated domain.

Removing Server for NIS in master mode

If you remove Server for NIS while it is running on a master server, you must verify that another server is assigned the tasks of the master server. If other Windows-based subordinate NIS servers are in the domains supported by the master server you remove, you must assign one of these servers the role of master server. Server for NIS cannot be a subordinate server to a master NIS server running on a UNIX-based operating system.

Removing Server for NIS in subordinate mode

If you remove Server for NIS while it is running as a subordinate server, the domain controller on which it was running will continue to receive NIS map updates through AD DS Synchronization.

Additional Configuration

Server for NIS and Password Synchronization require some additional configuration before they can operate in your enterprise. Password Synchronization requires the installation of specific components on UNIX hosts that will participate in password synchronization.

For more information about additional configuration steps, see the Checklists for these technologies:

  • Checklist: Deploying Server for NIS

  • Checklist: Migrating NIS Maps to Active Directory Domain Services

  • Checklist: Deploying Password Synchronization


Install the Password Synchronization daemon on UNIX-based computers

The Password Synchronization daemon must be installed on computers running a UNIX-based operating system to enable Password Synchronization to change users' passwords on those computers.

Supported UNIX-based operating systems

Password Synchronization supports synchronization with UNIX computers running any of the following operating systems:

  • Hewlett Packard HP UX 11i v1

  • IBM® AIX® version 5L 5.2 and 5L 5.3

  • Linux

    • Novell® SUSE® Linux Enterprise Server 10

    • Red Hat® Enterprise Linux® 4 server

  • SunSM Microsystems Solaris™ 10, Scalable Processor Architecture (SPARC)-compatible versions only

To install the Password Synchronization daemon

Important

The sso.conf file contains encryption keys and other sensitive information. For this reason, it must be accessible only by system administrators.

Perform the following steps to install the Password Synchronization daemon on UNIX-based computers.

To install the Password Syncronization daemon

  1. Download the file ssod.tar.gz from the Web site UNIX Side Components for Identity Management for UNIX (http://go.microsoft.com/fwlink/?LinkId=59120). Save the file to /usr/bin or /usr/local/bin on the UNIX computer, and change its name to ssod. The name of the source binary file depends on the version of UNIX you are using.

    • If the computer is running Hewlett-Packard HP-UX, the source binary file name is ssod.hpx.

    • If the computer is running Novell SUSE Linux Enterprise Server, the source binary file name is ssod.sus.

    • If the computer is running Red Hat Enterprise Linux, the source binary file name is ssod.rhl.

    • If the computer is running Sun Microsystems Solaris, the source binary file name is ssod.sol.

    • If the computer is running IBM AIX, the source binary file name is ssod.aix.

  2. Using a binary file copying method such as File Transfer Protocol (FTP) to avoid corrupting CR/LF (carriage-return/line-feed) pairs, copy Sso.cfg from \Unix\Bins on the computer running Windows Server® 2008 to /etc on the UNIX computer, and change the file name to sso.conf.

  3. Open sso.conf by using a text editor.

  4. If you have changed the default encryption key, edit the following line to specify the new default key. This value must match the default key specified on all domain controllers with which this computer will synchronize passwords:

    ENCRYPT_KEY= encryptionKey

  5. If you have changed the default port, edit the following line to specify the new port. This value must match the port number specified on all domain controllers with which this computer will synchronize passwords.

    PORT_NUMBER= portNumber

  6. Edit the following line to specify one domain controller in each Windows domain with which the computer must synchronize passwords. If you have specified a nondefault port number or encryption key for the UNIX-based computer when configuring Password Synchronization on the Windows domain controllers, specify that value where indicated; otherwise, leave the value blank:

    SYNC_HOSTS=( domainController[, portNumber [, encryptionKey]]) ...

    Each entry in the list must be enclosed by parentheses and separated from the next entry by a blank space.

  7. If the computer is a Network Information Service (NIS) master server, and if you want passwords to be synchronized throughout the NIS domain, edit the following line as shown to enable NIS synchronization:

    USE_NIS=1

    Also, if required, edit the following line to specify the location of the NIS makefile:

    NIS_UPDATE_PATH= makefilePath

  8. Set the file permissions of sso.conf to read and write for the root user only, and deny access to all other users.

  9. If the computer is running a Linux-based operating system, copy /etc/pam.d/system-auth to /etc/pam.d/ssod.


Install the Password Synchronization pluggable authentication module

This section contains instructions on installing the pluggable authentication module (PAM) on computers running any of the following four UNIX-based operating system families:

  • IBM AIX

  • Hewlett-Packard HP-UX

  • Red Hat Enterprise Linux

  • Sun Solaris

To install the pluggable authentication module (PAM) on AIX

Perform the following steps to install the PAM on computers running IBM AIX.

To install the PAM on AIX

  1. Copy the file pam_sso.aix from \Unix\Bins on the Windows Server® 2008 product disc to /usr/lib/ on the computer running IBM AIX.

  2. Change the file name to pam_sso.aix.1.

  3. On the computer running AIX, log on as root, and then run the following command:

    chown root /usr/lib/pam_sso.aix.1 chmod 555 /usr/lib/pam_sso.aix.1

  4. If necessary, create the /etc/pam.conf file according to your network requirements, setting the owner to root and the base permissions to 644. For more information about creating the pam.conf file, see "Pluggable Authentication Modules" in System Management Guides: Security Guide in your AIX documentation.

    The following is a sample pam.conf file

    #
# Authentication management
#
OTHER   auth     required       /usr/lib/security/pam_aix

#
# Account management
#
OTHER   account  required       /usr/lib/security/pam_aix

#
# Session management
#
OTHER   session  required       /usr/lib/security/pam_aix

  5. Open /etc/pam.conf by using a text editor.

  6. In the Password management section, add the following line:

    passwd password required /usr/lib/security/pam_sso.aix.1

    The following is a sample pam.conf file with this line added.

    #
# Authentication management
#
OTHER   auth     required       /usr/lib/security/pam_aix

#
# Account management
#
OTHER   account  required       /usr/lib/security/pam_aix

#
# Session management
#
OTHER   session  required       /usr/lib/security/pam_aix

#
# Password management
#
passwd   password required       /usr/lib/security/pam_sso.aix.1

  7. Open /usr/lib/security/methods.cfg by using a text editor, and add the following lines at the end of the file:

    PAM: program = /usr/lib/security/PAM

    PAMfiles: options = auth=PAM,db=BUILTIN

  8. Open /etc/security/user with a text editor and add authentication information for the specific users whose passwords you want to synchronize. For example:

    user1:    admin = false    SYSTEM = PAMfiles[*] AND "compat"    registry = PAMfiles
Note

You can choose to change the default section of /etc/security/user to allow all users to synchronize their passwords. In this case, to restrict access to Password Synchronization, you can use the SYNC_USERS attribute in the /etc/sso.conf file to restrict access. For more information, see Use sso.conf to configure Password Synchronization on UNIX-based computers. To disable UNIX-to-Windows password synchronization, remove the entry in /etc/pam.conf that you added in step 6.

To install the pluggable authentication module (PAM) on HP-UX

Perform the following steps to install the PAM on computers running Hewlett-Packard HP-UX.

To install the PAM on HP-UX

  1. Copy pam_sso.hpx from \Unix\Bins on the Windows Server 2008 product disc to /usr/lib/security on the UNIX computer.

  2. Change the file name to pam_sso.hp.1, and then set its file-mode bits to 544.

    Note

    The file-mode bits for pam_sso.hp.1 must be set to 544 (o:r-x,g:r--,w:r--) or it will not function properly.

  3. On the computer running HP-UX, open /etc/pam.conf by using a text editor.

  4. In the Password management section, locate the following line:

    other    password required      /usr/lib/security/libpam_unix.1

  5. Immediately after the line located in the previous step, add the following line:

    other password required /usr/lib/security/pam_sso.hp.1

Note

To disable UNIX-to-Windows password synchronization, remove the entry in /etc/pam.conf that you added in step 5. Before installing the pam_sso module, make sure that PAM support is properly installed and configured on the UNIX computer.

Sample HP-UX PAM configuration file

The following file samples show a typical configuration. Actual contents of these files may vary, depending on your system configuration.

#
# PAM configuration
#
# Authentication management
#
login    auth required  /usr/lib/security/libpam_unix.1
su       auth required  /usr/lib/security/libpam_unix.1
dtlogin  auth required  /usr/lib/security/libpam_unix.1
dtaction auth required  /usr/lib/security/libpam_unix.1
ftp      auth required  /usr/lib/security/libpam_unix.1
OTHER    auth required  /usr/lib/security/libpam_unix.1
#
# Account management
#
login    account required       /usr/lib/security/libpam_unix.1
su       account required       /usr/lib/security/libpam_unix.1
dtlogin  account required       /usr/lib/security/libpam_unix.1
dtaction account required       /usr/lib/security/libpam_unix.1
ftp      account required       /usr/lib/security/libpam_unix.1
#
OTHER    account required       /usr/lib/security/libpam_unix.1
#
# Session management
#
login    session required       /usr/lib/security/libpam_unix.1
dtlogin  session required       /usr/lib/security/libpam_unix.1
dtaction session required       /usr/lib/security/libpam_unix.1
OTHER    session required       /usr/lib/security/libpam_unix.1
#
# Password management
#
login    password required      /usr/lib/security/libpam_unix.1
dtlogin  password required      /usr/lib/security/libpam_unix.1
dtaction password required      /usr/lib/security/libpam_unix.1
other    password required      /usr/lib/security/libpam_unix.1
other    password required      /usr/lib/security/pam_sso.hp.1

To install the pluggable authentication module (PAM) on Linux

Perform the following steps to install the PAM on computers running Linux.

To install the PAM on Linux

  1. Copy pam_sso.rhl from \Unix\Bins on the Windows Server 2008 product disc to /lib/security on the UNIX computer, and change its name to pam_sso.so.1.

  2. On the UNIX computer, copy /etc/pam.d/system-auth to /etc/pam.d/ssod.

  3. Open /etc/pam.d/system-auth with a text editor, and locate the following line:

    password…..required…../lib/security/pam_cracklib.so…..retry=3

  4. After the line in the previous step, add the following line:

    password required /lib/security/pam_sso.so.1

  5. Locate and delete the following line:

    Password    required    /lib/security/pam_deny.so

  6. Save the modified file.
Note

These instructions apply to the typical Linux configuration. If you have configured PAM support differently, you might have to adjust these instructions to your specific configuration. To disable UNIX-to-Windows password synchronization, remove the entry in /etc/pam.d/system-auth that you added in step 4. Before installing the pam_sso module, make sure that PAM support is properly installed and configured on the UNIX computer.

Sample Linux PAM configuration file

The following file samples show a typical configuration. Actual contents of these files may vary, depending on your system configuration.

/etc/pam.d/passwd

#%PAM-1.0
auth       required     /lib/security/pam_stack.so service=system-auth
account    required     /lib/security/pam_stack.so service=system-auth
password   required     /lib/security/pam_stack.so service=system-auth

/etc/pam.d/ssod

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/pam_env.so
auth        sufficient    /lib/security/pam_unix.so likeauth nullok
auth        required      /lib/security/pam_deny.so

account     required      /lib/security/pam_unix.so

password    required      /lib/security/pam_cracklib.so retry=3 type=
password    sufficient    /lib/security/pam_unix.so nullok use_authtok shadow
password    required      /lib/security/pam_deny.so

session     required      /lib/security/pam_limits.so
session     required      /lib/security/pam_unix.so

/etc/pam.d/system-auth

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/pam_env.so
auth        sufficient    /lib/security/pam_unix.so likeauth nullok
auth        required      /lib/security/pam_deny.so

account     required      /lib/security/pam_unix.so

password    required      /lib/security/pam_cracklib.so retry=3 type=
password    required      /lib/security/pam_sso.so.1
password    sufficient    /lib/security/pam_unix.so nullok use_authtok shadow
password    required      /lib/security/pam_deny.so

session     required      /lib/security/pam_limits.so
session     required      /lib/security/pam_unix.so

To install the pluggable authentication module (PAM) on Solaris

Perform the following steps to install the PAM on computers running Sun Solaris.

To install the PAM on Solaris

  1. Copy pam_sso.sol from the \Unix\Bins folder on the Windows Server 2008 product disc to the /usr/lib/security directory on the UNIX computer, and change its name to pam_sso.so.1.

  2. On the UNIX computer, open /etc/pam.conf with a text editor.

  3. In the Password management section, locate the following line:

    other password required /usr/lib/security/$ISA/pam_unix.so.1

  4. Immediately following the line located in the step 3, add the following line:

    other password required /usr/lib/security/$ISA/pam_sso.so.1

Note

To disable UNIX-to-Windows password synchronization, remove the entry in /etc/pam.conf that you added in step 4. Before installing the pam_sso module, make sure that PAM support is properly installed and configured on the UNIX computer.

Sample Solaris PAM configuration file

The following file samples show a typical configuration. Actual contents of these files may vary, depending on your system configuration.

#
#ident  "@(#)pam.conf   1.14    99/09/16 SMI"
#
# Copyright (c) 1996-1999, Sun Microsystems, Inc.
# All Rights Reserved.
#
# PAM configuration
#
# Authentication management
#
login   auth required   /usr/lib/security/$ISA/pam_unix.so.1
login   auth required   /usr/lib/security/$ISA/pam_dial_auth.so.1
#
rlogin  auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1
rlogin  auth required   /usr/lib/security/$ISA/pam_unix.so.1
#
dtlogin auth required   /usr/lib/security/$ISA/pam_unix.so.1
#
rsh     auth required   /usr/lib/security/$ISA/pam_rhosts_auth.so.1
other   auth required   /usr/lib/security/$ISA/pam_unix.so.1
#
# Account management
#
login   account requisite       /usr/lib/security/$ISA/pam_roles.so.1
login   account required        /usr/lib/security/$ISA/pam_unix.so.1
#
dtlogin account requisite       /usr/lib/security/$ISA/pam_roles.so.1
dtlogin account required        /usr/lib/security/$ISA/pam_unix.so.1
#
other   account requisite       /usr/lib/security/$ISA/pam_roles.so.1
other   account required        /usr/lib/security/$ISA/pam_unix.so.1
#
# Session management
#
other   session required        /usr/lib/security/$ISA/pam_unix.so.1
#
# Password management
#

other   password required       /usr/lib/security/$ISA/pam_unix.so.1
other  password required        /usr/lib/security/$ISA/pam_sso.so.1
dtsession auth required /usr/lib/security/$ISA/pam_unix.so.1

#
# Support for Kerberos V5 authentication (uncomment to use Kerberos)
#
#rlogin auth optional   /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#login  auth optional   /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#dtlogin        auth optional   /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#other  auth optional   /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#dtlogin        account optional /usr/lib/security/$ISA/pam_krb5.so.1
#other  account optional /usr/lib/security/$ISA/pam_krb5.so.1
#other  session optional /usr/lib/security/$ISA/pam_krb5.so.1
#other  password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass


Use sso.conf to configure Password Synchronization on UNIX-based computers

Use sso.conf to configure Password Synchronization on the UNIX-based computer

To change settings and customize how Password Synchronization works on a UNIX-based computer, you change settings in the sso.conf file. For information about installing the sso.conf file, see Install the Password Synchronization daemon on UNIX-based computers.

The following table describes the values you can set in the sso.conf file.

Value Description

CASE_IGNORE_NAME

Specifies whether Password Synchronization will ignore differences in uppercase and lowercase letters in user names when it compares Windows and UNIX user names. To allow case-insensitive comparisons, set this entry to 1 (the default). To force Password Synchronization to use case-sensitive comparisons, set this entry to 0.

ENCRYPT_KEY

Specifies the default key used to encrypt passwords exchanged with Windows servers. You can use settings in the SYNC_HOSTS value to specify a different encryption key for a specific Windows server.

FILE_PATH

Specifies the full path and name of the passwd or shadow file (such as /etc/passwd). This file must contain the encrypted passwords for users, and the type of file (passwd or shadow) must be the same as specified by USE_SHADOW. On AIX systems, the path and name of the shadow file is /etc/security/passwd.

IGNORE_PROPAGATION_ERRORS

When set to 1, specifies that the Password Synchronization PAM module is to ignore any error that occurs when a Windows password is being changed and to continue synchronization with other hosts specified in SYNC_HOSTS.

NIS_UPDATE_PATH

Specifies the full path to the NIS makefile. This value is ignored unless USE_NIS is set to 1.

PORT_NUMBER

Specifies the default number of the port on which the Password Synchronization daemon will listen for password changes from Windows servers. You can use settings in the SYNC_HOSTS value to specify a different port number for a specific Windows server.

SYNC_DELAY

Specifies the number of seconds the Password Synchronization PAM module will wait between synchronization attempts.

SYNC_HOSTS

Specifies the Windows servers or domain controllers with which passwords are to be synchronized. In addition, you can specify a port number or encryption key (or both) for a specific server. Enclose each entry in parentheses and separate items with a blank space. You can have multiple entries on separate lines, each of which cannot exceed 269 characters. The total list of servers or domain controllers is generated by concatenating all entries. For example:

SYNC_HOSTS=(Marketing)
SYNC_HOSTS=(Sales,ASDFhjkl4321ZyXw) (Accounting,6678)
SYNC_HOSTS=(Shipping,6678,ASDFhjkl4321ZyXw)

synchronizes passwords with the Marketing server using the default port and encryption key, with the Sales server using ASDFhjkl4321ZyXw as the encryption key, with the Accounting server using 6678 as the port number, and with the Shipping server using 6678 as the port number and ASDFhjkl4321ZyXw as the encryption key.

If you use server-specific port number or encryption key settings, you must use the same values to configure Password Synchronization on the Windows server, or the passwords will not be synchronized.

SYNC_RETRIES

Specifies the number of times that the Password Synchronization PAM module will attempt to synchronize a password change with a Windows server or domain controller.

SYNC_USERS

Specifies UNIX users whose passwords are to be synchronized. You can specify ALL to synchronize passwords for all users or NONE to disable password synchronization for users. You can also specify particular users. If you specify one or more users preceded by plus signs (+), only those users will have their passwords synchronized. If you specify one or more users preceded by minus signs (–), all users except the specified users will have their passwords synchronized. For example, to allow only users bobg and kimr to synchronize their passwords, specify:

SYNC_USERS=+bobg +kimr

To prevent only root and bobg from having their passwords synchronized, specify:

SYNC_USERS=–root –bobg

The minus sign always takes precedence, regardless of the order in which entries appear. For example, the following specifies that the password for user chrisa will not be synchronized:

SYNC_USERS=+chrisa –chrisa +chrisa

TEMP_FILE_PATH

Specifies the full path of the directory to be used to hold a temporary file while the passwd or shadow file is updated. This should be the same directory in which the passwd or shadow file is located. For security reasons, only the administrator should have access to this directory.

USE_NIS

Set to 0 if Password Synchronization is not synchronizing with an Network Information Service (NIS) domain; set to 1 if Password Synchronization is synchronizing with an NIS domain. If USE_NIS is set to 1, specify a valid path for NIS_UPDATE_PATH.

USE_SHADOW

Set to 0 if the passwd file is to be used for synchronization; set to 1 if the shadow file is to be used.


Start or stop Identity Management for UNIX components

This section contains procedures for starting and stopping Server for NIS and Password Synchronization.

In this section

  • To start Server for NIS

  • To stop Server for NIS

  • To start the Password Synchronization daemon

  • To stop the Password Synchronization daemon

  • Special considerations for starting or stopping Server for NIS

To start Server for NIS

Note

Server for NIS is enabled by default following installation. To change the Server for NIS service startup type to Automatic, use the following procedure.

To set the Server for NIS service startup type to Automatic

  1. Log on to the computer as a member of the Administrators group on which you want to run Server for NIS.

  2. On the Start menu, click Run, type services.msc, and then click OK to open the Services MMC.

    -- or --

    On the Start menu, click Administrative Tools, then click Services to open the Services MMC.

  3. In the results pane, double-click Server for NIS.

  4. On the General tab of the Server for NIS Properties dialog box, select Automatic from the Startup type drop-down menu.

  5. Click OK. Close the Services MMC.
  • Using the Windows interface

  • Using a command line

Using the Windows interface

To start Server for NIS by using Windows

  1. Open the Identity Management for UNIX management console.

    To open Identity Management for UNIX, click Start, point to All Programs, point to Identity Management for UNIX, and then click Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NIS, and then click Start.

Using a command line

To start Server for NIS by using a command line

  • At a command prompt, type:

    nisadmin [server] start [–u user [–p password]]

The following table describes the arguments used with the nisadmin command to start Server for NIS.

Argument | Description
server | The name of the server you want to start.
user | The name of the user who has administrative permissions on the server to be started, if different from the current user.
password | The password of the user who has administrator permissions on the server to be started, if different from the current user. If you type a user name but omit the password, you will be prompted for the password.
Note

To view the complete syntax for this command, at a command prompt, type the following: nisadmin /?

To stop Server for NIS

  • Using the Windows interface

  • Using a command line

Using the Windows interface

To stop Server for NIS by using Windows

  1. Open the Identity Management for UNIX management console.

    To open Identity Management for UNIX, click Start, point to All Programs, point to Identity Management for UNIX, and then click Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NIS, and then click Stop.

Using a command line

To stop Server for NIS by using a command line

  • At a command prompt, type:

    nisadmin [server] stop [–u user [–p password]]

The following table describes the command arguments used with the nisadmin command to stop Server for NIS.

Argument | Description
server | The name of the server you want to stop.
user | The name of the user who has administrator permissions on the server to be stopped, if different from the current user.
password | The password of the user who has administrator permissions on the server to be stopped, if different from the current user. If you type a user name but omit the password, you will be prompted for the password.
Note

To view the complete syntax for this command, at a command prompt, type the following: nisadmin /?

To start the Password Synchronization daemon

To start the Password Synchronization daemon

  • Run the single sign-on daemon (SSOD).
Note

There is no other method for this procedure.

The sso.conf file must be in the /etc/ directory.

If you see no errors, the daemon is running. If any failures occur during the initialization of the daemon, an error message is displayed on the console. Errors may also be logged to the Syslog file.

If you want the Password Synchronization service to start automatically, add the single sign-on daemon (SSOD) to your system startup files (typically Rc.local). This will start SSOD as root.

To stop the Password Synchronization daemon

To stop the Password Synchronization daemon

  • Send the process a TERM signal by typing and entering the following at a command line:

    kill –term pid

    where pid is the process identifier of the Password Synchronization single sign-on daemon (SSOD).

Special considerations for starting or stopping Server for NIS

When Server for NIS is stopped, it does not respond to Network Information Service (NIS) requests from clients, including requests for password changes.

When Server for NIS is stopped, you can continue to make changes to NIS map data by using Active Directory Users and Computers.

UNIX-based computers respond differently when Server for NIS is stopped, however. If the UNIX-based NIS server has failed, changes to maps made by using the make utility are not updated in the NIS database.

Additionally, when Server for NIS is stopped, NIS map changes are not propagated to UNIX-based subordinate NIS servers. However, subordinate NIS servers running on Windows-based Active Directory domain controllers continue to receive updates.


Remove Identity Management for UNIX Components

Identity Management for UNIX is considered a role service, or a software subcomponent, of the Active Directory Domain Services server role.

To remove Identity Management for UNIX

Using the Windows interface

Using a command line

Remove Identity Management for UNIX by using the Windows interface

To remove Identity Management for UNIX by using the Windows interface

  1. Open Server Manager. Click Start, point to Administrative Tools, and then click Server Manager..

  2. In the Active Directory Domain Controller area's list of common tasks, click Remove Role Services.

  3. On the Select Role Services page of the Remove Role Services Wizard, clear the check box for Identity Management for UNIX or the parts of Identity Management for UNIX that you want to remove, and then click Next.

  4. After verifying your selections on the Confirm Removal Selections page, click Remove.
Notes
  • You must be a member of the Administrators group on the local computer to remove Identity Management for UNIX components.
  • Server Manager is available only to members of the Administrators group on the local computer. By default, Server Manager opens when an administrator logs on to the computer. You can open Server Manager from the Start menu, the Quick Launch toolbar, or from within Administrative Tools.

Remove Identity Management for UNIX by using a command line

Server Manager command line tools allow you to install or remove roles, role services, or features in a Windows Command Prompt. Identity Management for UNIX can be removed by using the Server Manager line command because it is a role service of the Active Directory Domain Services role.

You can run the Server Manager line command, ServerManagerCmd.exe, from within any directory on the local computer. You must be a member of the Administrators group on the local computer to run the Server Manager command.

Important

Because of security restrictions imposed by User Account Control in Windows Server 2008, you must run ServerManagerCmd.exe in a Command Prompt window opened with elevated privileges. To do this, right-click the Command Prompt executable, or the Command Prompt object on the Start menu, and then click Run as administrator.

Note

Other parameters are available for this command, such as -restart, which automatically restarts the computer after removal if it is required by the programs you have removed. It is recommended that you read about additional Server Manager command line parameters in the topic "Overview of Server Manager Commands" in the Server Manager Help.

To remove Identity Management for UNIX by using a command line

  • In a Command Prompt window opened with elevated privileges, type one of the following and press ENTER.

    • ServerManagerCmd.exe -remove ADDS-Identity-Management to remove all of Identity Management for UNIX

    • ServerManagerCmd.exe -remove ADDS-NIS to remove Server for NIS only

    • ServerManagerCmd.exe -remove ADDS-Password-Sync to remove Password Synchronization only

    • ServerManagerCmd.exe -remove ADDS-IDMU-Tools to remove the administration tools for Identity Management for UNIX only

    Note

    Add the -whatIf parameter to your command to instruct Server Manager to show the list of all software that is removed by default as a result of the command.

Additional removal tasks

The single sign-on daemon (SSOD) is installed on all UNIX computers with which passwords are synchronized. If the UNIX computers are no longer synchronizing passwords with other Windows-based servers on the network running Password Synchronization, you can remove the SSOD files from the UNIX computers.


Server for NIS

Server for NIS

Server for NIS enables a Microsoft Windows–based Active Directory domain controller to administer UNIX Network Information Service (NIS) networks.

  • Before you start using Server for NIS, see Checklist: Deploying Server for NIS.

  • For detailed reference information about command utilities for managing Server for NIS, see Command-line Utilities in Server for NIS.

In this section

The following topics are included in this section.

  • Overview of Server for NIS

  • Best Practices for Server for NIS

  • Server for NIS Administration

  • Server for NIS Concepts

  • Command-line Utilities in Server for NIS

  • Server for NIS Troubleshooting


Overview of Server for NIS

Server for NIS integrates Microsoft Windows and Network Information Service (NIS) networks by giving a Windows–based Active Directory® Domain Services (AD DS) domain controller the ability to act as a master NIS server for one or more NIS domains.

How Server for NIS works

Server for NIS stores both standard and nonstandard NIS map data in AD DS. (Standard maps consist of aliases, bootparams, ethers, hosts, group, netgroup, netid, netmasks, networks, passwd, protocols, rpc, services, pservers, and shadow; all other maps are non-standard.) Server for NIS thus creates a single name space for the Windows and NIS domains that can be managed by the Windows administrator using a single set of tools. The administrator can easily create, modify, and delete user accounts for Windows and UNIX domains at the same time. A user who has accounts in both Windows and UNIX environments can be managed by AD DS with all attributes necessary for the respective domain and name space.

Server for NIS can also be installed on other domain controllers in the same domain as the master NIS server, giving them the ability to function as NIS subordinate (also known as slave) servers. In this case, the NIS data in Active Directory is automatically replicated among the Windows domain controllers running Server for NIS. In addition, UNIX-based computers can continue to function as subordinate servers in the NIS domain; Server for NIS uses yppush to propagate changes to the NIS data to UNIX-based NIS servers just as a UNIX-based master NIS server would.

The Server for NIS setup process

After you install Server for NIS, you migrate NIS maps from UNIX-based NIS servers to the computer running Server for NIS. You can use either the Windows-based migration wizard provided with Server for NIS, or you can use a command-line utility to complete the migration. After the maps for an NIS domain have been migrated, Server for NIS is ready to deploy as a master server for the NIS domain. You can migrate multiple NIS domains to the same Windows–based AD DS domain controller. These domains can be merged with each other or kept separate. You can migrate NIS map data in a staged manner by migrating NIS maps one at a time.

Server for NIS can support multiple NIS domains concurrently. Maps that belong to multiple domains can also reside concurrently in Active Directory. Requests from a client or another server in a domain receive data from a map in the same domain.

Management of Server for NIS

You can manage Server for NIS using the Windows-based Identity Management for UNIX. You can manage the passwd, group and hosts maps that you have migrated to AD DS by using Windows–based tools such as Active Directory Users and Computers. You can also use the command-line tools nismap and nisadmin to manage all standard and non-standard maps and to manage Server for NIS. You can monitor Server for NIS performance using Windows administrative tools, including using Event Viewer to audit significant events and errors logged by Server for NIS.

In addition to using administrative tools provided by Windows, you can also create additional administrative tools using Active Directory Service Interfaces (ADSI) or Lightweight Directory Access Protocol (LDAP).

Server for NIS implements the NIS remote procedure calls necessary to serve requests from UNIX-based and Windows-based NIS clients, as well as other subordinate NIS servers. Server for NIS supports both broadcast mode and normal binding mode.


Best Practices for Server for NIS

Best practices when migrating a Network Information Service (NIS) domain

  • Before performing the actual migration, carefully review Checklist: Migrating NIS Maps to Active Directory Domain Services.

  • Before starting the wizard, decide whether the domain you are migrating should remain a separate domain or should be merged with another domain on Server for NIS.

  • If you migrate maps separately, you should migrate passwd maps before you migrate group or shadow maps. This ensures that the UNIX passwords will be stored properly.

  • Be sure you know the structure of your nonstandard maps before starting the wizard. In particular, you should know the field separators, key field, file name, and map name. Nonstandard maps are accessed using only one key.

  • Use the default Do not migrate (log only) option in the NIS Data Migration wizard first, so that Server for NIS tests all migration steps but does not actually migrate data. After analyzing the log files and deciding how you want to handle map conflicts if they occur, run the wizard again, selecting the Migrate and log option.

  • After examining the log, correct any problems before you migrate the data. If the same user name exists in both the Windows and NIS domains, determine whether the duplicate user names represent the person. If not, change the user name of one of the users. If the user names refer to the same person, determine whether the UNIX properties are the same. If not, determine which are correct. You can then preserve the existing entry in Active Directory Domain Services (AD DS), or overwrite it with the information in the UNIX map.

  • If a conflict is reported during the actual migration, even though none was reported in the test migration, there might be conflicts within the NIS maps themselves. When you run the wizard with the Log only option selected, it reports only conflicts between NIS maps and AD DS, not conflicts within the NIS maps themselves. If a conflict happens during the actual migration, resolve the conflict in the NIS maps and then migrate the NIS data that was not migrated using the command line nis2ad –r yes option.

Keep subordinate servers up to date

If your NIS domain is active (that is, changes to the domain occur frequently), you should increase the frequency at which Server for NIS checks for changes. This ensures that UNIX-based subordinate servers are updated soon after a change is registered on the master server. You can also use the Check for updates now command in the Actions pane of the Identity Management for UNIX snap-in to immediately update subordinate servers.

Do not migrate an NIS domain to more than one Active Directory domain

Although you can migrate an NIS domain to computers running Server for NIS in more than one Windows-based domain, this is strongly discouraged, because changes made in one Windows-based domain are not replicated to the other domain.

Discourage users from using yppasswd to change NIS passwords

Users should change their NIS password by changing their Windows password. Server for NIS changes the NIS password to match.

Server for NIS does not fully support the yppasswd utility available on UNIX systems. When a user runs yppasswd, Server for NIS changes the user's password in the NIS passwd map. Because yppasswd encrypts the new password before sending it to the NIS master server, however, Server for NIS cannot obtain a plain-text password to set the user's Windows password. Consequently, Windows and UNIX passwords for the user will not be the same. In addition, yppasswd poses security risks because it transmits the deprecated passwords in plain text. Because the user's old password could also be the user's current Windows password, this can expose the user's Windows password to unauthorized users on the network.

Using Password Synchronization, you can provide users with a method for changing their NIS password using the yppasswd command. For more information, see Synchronizing Passwords with an NIS Domain.


Server for NIS Administration

In this section

  • Configuring a UNIX NIS Server to Use Server for NIS as the Master Server

  • Configuring UNIX Clients to Use Server for NIS as the Master Server

  • Adding or removing UNIX subordinate servers

  • Change a subordinate server to a master server

  • Manage NIS Maps


Configuring a UNIX NIS Server to Use Server for NIS as the Master Server

To configure a UNIX NIS server to use Server for NIS as the master server

To change a UNIX-based Network Information Service (NIS) server from a master server to a subordinate (also known as slave) server, follow these steps.

To configure a UNIX NIS server to use Server for NIS as the master server

  1. Migrate maps from the UNIX master NIS server.

  2. Transfer the maps from the old master server to other subordinate NIS servers by providing the name of the new Server for NIS for each map. At a command prompt, type:

    ypxfr –h newserver mapname

    where newserver is the name of the new NIS master server, and mapname is the name of the map to be transferred.

  3. Run this command for each map on each subordinate server.

    After this step, UNIX subordinate servers should recognize the new Server for NIS master server.


Configuring UNIX Clients to Use Server for NIS as the Master Server

To configure UNIX clients to use Server for NIS as the master server

For each UNIX client computer on which you want to use Server for NIS as the master server, do the following.

To configure UNIX clients to use Server for NIS as the master server

  1. If the domain name has changed, type the following command at a command prompt, and press ENTER.

    domainName newdomain

  2. Stop ypbind by typing the following command at a command prompt, and pressing ENTER.

    kill –9 ypbind pid

  3. Restart ypbind by typing the following command at a command prompt, and pressing ENTER.

    Ypbind

    Note

    Network Information Service (NIS) subordinate (also known as slave) servers require that the NIS master server name in the local /etc/hosts file matches the master server name in the NIS maps exactly, including the case of the letters of these names. Make sure the case of the host name in /etc/hosts matches exactly the master server name as displayed by the Server for NIS. Server for NIS typically displays the host computer name entirely in upper case characters.


Adding or removing UNIX subordinate servers

Adding or removing UNIX-based subordinate servers

  • Using the Windows interface

  • Using a command line

Using the Windows interface

The following procedures are carried out in the Identity Management for UNIX management console.

Adding a UNIX-based subordinate server

To add a UNIX-based subordinate server

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. Click Server for NIS in the hierarchy pane.

  4. In the console tree, expand Server for NIS and view the list of Network Information Service (NIS) domains.

  5. In the domain you want to modify, click the NIS Servers node.

  6. With the NIS Servers node selected, do one of the following:

    • Right-click NIS Servers, and then click Add NIS Server.

    • Click Add NIS Server in the Actions pane.

    • On the Action menu, click Add NIS Server.

  7. On the Add NIS Server dialog box, specify the name of the UNIX-based computer you want to add, or its IP address.

  8. Click OK.

Removing a UNIX-based subordinate server

To remove a UNIX-based subordinate server

  1. Open the Identity Management for UNIX snap-in by clicking Start, pointing to All Programs, and then clicking Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. Click Server for NIS in the hierarchy pane.

  4. In the console tree, expand Server for NIS and view the list of Network Information Service (NIS) domains.

  5. In the domain you want to modify, click the NIS Servers node.

  6. In the results pane, select the UNIX-based subordinate server that you want to remove.

  7. With the computer selected in the results pane, do one of the following:

    • Right-click the computer, and then click Delete.

    • Click Delete in the Actions pane.

    • On the Action menu, click Delete.

  8. If you are sure you want to delete the computer from control by this domain, click OK when prompted by Server for NIS.

Using a command line

Note

To view the complete syntax for this command, at a command prompt, type: nismap /?

To add or remove UNIX-based subordinate servers by using the command line

  1. To add a UNIX-based subordinate server, at a command prompt, type the following, where Subordinate represents the name or IP address of the computer you want to add, and NISDomain represents the name of the NIS domain to which you want to add the computer.

    nismap add -e " Subordinate " -a NISDomain ypservers

    To remove a server, at a command prompt, type the following, where Subordinate represents the name or IP address of the computer you want to remove, and NISDomain represents the name of the NIS domain from which you want to remove the computer.

    nismap del -k Subordinate -a NISDomain ypservers

  2. Press ENTER.

The following table describes the parameters for the nismap command that are used in this procedure. For more about the nismap command, see nismap.

Argument Description

add

Adds a map entry. The following options and arguments are used with add:

Term | Definition
-e "mapentry" | Specifies the new map entry as a string in the appropriate NIS map format. The string must be enclosed in quotation marks (" ").

del

Deletes an existing map entry. The following option and argument are required with del:

Term | Definition
-k key | Specifies the search key that identifies the map entry to be deleted.

Subordinate

The UNIX Network Information Service (NIS) server on which you want the nismap command to act.

NISDomain

The name of the NIS domain to which you want to add or remove UNIX-based subordinate servers.


Change a subordinate server to a master server

To change a subordinate server to a master server

  • Using the Windows interface

  • Using a command line

Using the Windows interface

To change a subordinate server to a master server by using Windows

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. In the console tree, click Server for NIS and view the list of Network Information Service (NIS) domains.

  4. Select the domain you want to modify.

  5. In the details pane, click NIS Servers, select the Windows server you want to make the new master server, and then click Promote.
Note

To open Identity Management for UNIX, click Start, point to All Programs, point to Identity Management for UNIX, and then click Identity Management for UNIX. Only an Active Directory Domain Services domain controller can be promoted to be the master server. When you change a subordinate server to a master server, the previous master server automatically changes to a subordinate server.

Using a command line

To change a subordinate server to a master server by using the command line

  • Do one of the following:

    • To change a master server to a subordinate server, at a command prompt, type:

      nisadmin [server] mkslave –m newMaster–d domainName –u username–p password

    • Or, to change a subordinate server to a master server, at a command prompt, type:

      nisadmin [server] mkmaster –d domainName–u username –p password

The following placeholders are arguments used with the nisadmin command to promote a subordinate server to a master server, or demote a master server to a subordinate server.

Argument | Description
server | The domain controller server that is hosting Active Directory. If not specified, the current server is used.
newMaster | The name of the new master server, required for the mkslave command.
domainName | The name of the domain for which the change is being made.
username | The name of the user who has administrator permissions on the server to be changed, if different from the current user.
password | The password for the user who has administrator permissions on the server to be changed. If the password is not supplied, you will be prompted for it.
Note

To view the complete syntax for this command, at a command prompt, type nisadmin /?.

For more information about the command-line method of performing this procedure, see nisadmin.


Manage NIS Maps

In this section

  • Migrating NIS domains

  • Add a group to an NIS domain

  • Set the encryption method for a domain

  • Changing the frequency of map updates

  • Propagate selected maps now

  • Propagate changed maps now

  • Use ypmatch to view an entry in an NIS map

  • Use ypcat to print values in an NIS map

  • Edit maps

  • Manage NIS users

  • Manage NIS groups

  • Manage NIS computers


Migrating NIS domains

To migrate NIS domains

  • Using the Windows interface

  • Using a command line

Using the Windows interface

Before you begin migrating NIS domains by using the NIS Data Migration wizard, it is recommended that you refer to the following topics.

  • Checklist: Migrating NIS Maps to Active Directory Domain Services

  • Best Practices for Server for NIS

  • Understanding NIS Data Migration

To migrate NIS domains by using the Windows interface

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. Click Server for NIS in the navigation pane.

  3. With Server for NIS highlighted in the navigation pane, click the Start NIS Data Migration Wizard command in the Actions pane.

    You can also click Start NIS Data Migration Wizard on the Action menu, or right-click Server for NIS, then click Start NIS Data Migration Wizard on the shortcut menu.

  4. Follow the step-by-step directions in the wizard.
Note

Password file entries with names longer than eight characters will not be migrated. Windows user accounts created as a result of the migration are disabled. After performing the migration, you must enable the accounts. For security reasons, it is recommended that you assign a temporary password to these accounts and instruct the affected users to change their Windows password as soon as possible.

Using a command line

Perform the following steps to migrate NIS maps by using the command-line interface.

Note

To view the complete syntax for this command, at a command prompt type: nis2ad /?

To migrate NIS domains by using the command-line interface

  1. Open a Command Prompt window by clicking Start, then clicking Command Prompt.

  2. At the prompt, type the following.

    nis2ad.exe -y NIS_Domain -a AD_domain [options] mapfile

    NIS_Domain represents the UNIX-based NIS domain containing the map to migrate, AD_Domain represents the Active Directory Domain Services (AD DS) domain to which you want to migrate maps, and mapfile represents the name of the NIS map source file that you want to migrate.

    Note

    The command as provided in this procedure performs a test migration. To perform an actual migration, add the -m parameter before the mapfile specification.

  3. Add optional parameters to the nis2ad command as appropriate. See the table in this topic for options you can use with the nis2ad command.

  4. Press ENTER to start migration.

The following table describes the arguments that are required in this procedure.

Argument | Description
-y NIS_Domain | Specifies the name of the Network Information Service (NIS) domain that contains the map to migrate.
-a AD_domain | Specifies the NIS domain name in AD DS.
mapfile | Specifies the name of the NIS map source file to migrate. NIS map source files are the plain text files from which the NIS map databases are compiled.

The nis2ad utility accepts the following optional parameters.

Option | Description
-m | Perform the migration. If this option is omitted, the program finds and reports conflicts but performs only a test and not an actual migration.
-c FileName | Specifies the file where conflict details are written. Uses a default file (%sfudir%\nis\conflicts.log) if not specified.
-t TargetContainer | Specifies the target container name. Applicable only when creating a new NIS domain. If not specified, uses the default or uses the container of the target domain.
-f FileName | Specifies the name of the log file. If not specified, nis2ad uses a default file (%sfudir%\nis\nis2ad.log).
-r yes|no | Replace the object in AD DS with object being migrated. Default is no.
-n | Resolves conflicts by changing the Windows account name in AD DS. If objects of different types have the same name, the name of both objects is changed before the data is migrated.
-p Password | If needed and if not specified, the user will be prompted.
-d Directory | Specifies the path of the directory that contains NIS map source files.
-s Server | Specifies the domain controller server hosting AD DS. Otherwise use the current server.
-u User | Specifies the name of the user having administrator privileges on this computer. If not specified, nis2ad uses the current user.

Remarks on the command-line installation process

You can migrate only one map at a time using nis2ad. To migrate more than one map at a time, use the NIS Data Migration wizard.

Password file entries with names longer than eight characters will not be migrated.

Windows user accounts created as a result of the migration will be disabled. After performing the migration, you must enable the accounts. For security reasons, it is recommended that you assign a temporary password to these accounts and instruct the affected users to change their Windows password as soon as possible.

Even if you specify another user by using the -u option, the currently logged on user must have write permissions for the folder that will contain the log and conflict files. If necessary, modify the permissions on the folder to grant write access to the user who will be running the nis2ad utility before running the utility.

Additional references

  • nis2ad

  • Understanding NIS Data Migration


Add a group to an NIS domain

To add a group to an NIS domain

A group identifier (GID) is automatically assigned to the group. If your NIS domain has special requirements for GID values, you can change the assigned value.

To add a group to an NIS domain

  1. Open Active Directory Users and Computers.

    To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

    You can also open Active Directory Users and Computers from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Active Directory Users and Computers.

  2. In the console tree, click the Users folder.

  3. In the details pane, right-click the group you want to add to the NIS domain, and then click Properties.

  4. Click the UNIX Attributes tab.

  5. In the NIS Domain list, click the domain to which you want to add the group.

  6. To save the changes and keep the dialog box open, click Apply. To save the changes and close the dialog box, click OK.

    Note

    There is no command-line method for this procedure. The name of the group must comply with UNIX naming conventions. It must contain only lowercase alphabetic and numeric characters, no more than eight characters, and at least one alphabetic character. It must not include either a colon (:) or a newline character.


Set the encryption method for a domain

To set the encryption method for a domain

  • Using the Windows interface

  • Using a command line

Using the Windows interface

To set the encryption method for a domain by using Windows

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. In the console tree, expand Server for NIS and view the list of NIS domains.

  4. Select the domain for which you want to set an encryption method.

  5. Open the Properties dialog box for the selected domain by doing one of the following.

    • Right-click the selected domain, and then click Properties.

    • Click Properties in the Actions pane.

    • On the Action menu, click Properties.

  6. In the UNIX password encryption scheme area, select the encryption method you want all UNIX computers in the domain to use.

    Note

    You can select the MD5 encryption method for a UNIX domain that consists exclusively of computers running Linux and using MD5 encryption. Domains that contain one or more computers using the crypt algorithm or that run any other operating system must use crypt. Although Linux versions 6.2 and later support MD5 encryption, Identity Management for UNIX is not supported for versions of Linux prior to version 8.

Using a command line

To set the encryption method for a domain by using the command line

  • At a command prompt, type the following:

    nisadmin [computer] encryptiontype -d domain {crypt | md5} [-u usr [-p pword]]

The placeholders in the following table are arguments used in the command line to set the encryption method.

Argument | Description
computer | Specifies the remote computer you want to administer. You can specify the computer using a WINS or DNS name, or by Internet Protocol (IP) address.
domain | Specifies the name of the domain for which the change is being made.
usr | Specifies the user name of the user whose credentials are to be used. It might be necessary to add the domain name to the user name in the form domain\username.
pword | Specifies the password of the user specified using the -u option. If you specify the -u option but omit the -p option, you are prompted for the user's password.
Note

To view the complete syntax for this command, at a command prompt, type: nisadmin /?

You can select the MD5 encryption method for a UNIX domain that consists exclusively of computers running Linux and using MD5 encryption. Domains that contain one or more computers using crypt or that run any other operating system must use crypt. Although Linux versions 6.2 and later support MD5 encryption, Identity Management for UNIX is not supported for versions of Linux prior to version 8.

Password encryption can only be set to one encryption method at a time. Changing the encryption method invalidates user passwords. All passwords must be reset if the encryption method is changed.


Changing the frequency of map updates

To change frequency of map updates to UNIX subordinate (slave) NIS servers

  • Using the Windows interface

  • Using a command line

Using the Windows interface

To change the frequency of map updates to UNIX subordinate servers by using the Windows interface

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. Click Server for NIS in the hierarchy pane.

  4. With Server for NIS selected in the hierarchy pane, click Map Updates, either in the Actions pane, on the Action menu, or by right-clicking Server for NIS and then clicking Map Updates.

  5. On the General tab of the Server for NIS Properties dialog box, specify the interval you want to elapse between NIS map updates, and then click OK.

Using a command line

Note

To view the full syntax of the nisadmin command, at a command prompt, type nisadmin /?.

To change the frequency of map updates to UNIX subordinate servers by using a command line

  • At a command prompt, type the following, and press ENTER. Days, hh, and mm represent the number of days, hours, and minutes, respectively, that you want to elapse between map updates.

    nisadmin config pushint= days : hh : mm -s Server -u User -p Password

The following table describes command arguments of nisadmin used in this procedure. For more information, see nisadmin.

Argument | Description
[[days:]hh:]mm | Specifies the interval at which the service checks changes to Network Information Service (NIS) maps in Active Directory and propagates them to secondary NIS servers for all domains, in days, hours, and minutes. If hh is specified, hh must be in the range 0–23 and mm must be in the range 0–59.
Server | The master server for the domain.
User | The name of the user who has administrative privileges on the server to be started, if different from the current user.
Password | The password of the user who has administrative privileges on the server to be started, if different from the current user. If you type a user name but omit the password, you will be prompted for the password.


Propagate selected maps now

To propagate selected maps now

  • Using the Windows interface

  • Using a command line

Using the Windows interface

To propagate selected maps using Windows

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. In the console tree, expand Server for NIS and then expand the node for the domain for which you want to update maps.

  4. Select NIS Maps.

  5. Select the objects representing the maps you want to update. To select more than one map, press and hold the CTRL key while clicking the maps.

  6. Right-click the selected maps, and then click Update Maps.

Using a command line

To propagate selected maps using a command line

  • At a command prompt, type the following:

    yppush [-d ActiveDirectoryNISDomain] [-q] [-t Timeout] [-h Hosts] MapName

The following table describes arguments that are used with the yppush command to propagate maps. To view the complete syntax for this command, at a command prompt, type yppush /?.

Argument | Description
-d ActiveDirectoryNISDomain | Network Information Service (NIS) domain name in Active Directory.
-q | Quiet mode. Do not wait for response from subordinate (slave) servers and do not report errors.
-t Timeout | The number of seconds to wait for a response from the subordinate server before sending the next request. Must be greater than zero. The default value is 30.
-h Hosts | The hosts to notify of changes. Default is all subordinate servers in the domain. Can be used multiple times for more than one computer.
MapName | The name of the NIS map to be transferred.
Note

This command propagates a single map. Run the command again to propagate additional maps. The yppush command pushes map data only from the Windows-based NIS master server to UNIX-based NIS subordinate servers. It does not push map data to NIS subordinate servers running Windows operating systems. Active Directory Domain Services updates Windows-based NIS subordinate servers.


Propagate changed maps now

To propagate changed maps now

  • Using the Windows interface

  • Using a command line

Using the Windows interface

To propagate changed maps by using Windows

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. Expand the Identity Management for UNIX node and select Server for NIS.

  4. Propagate changed maps by doing one of the following.

    • Right-click Server for NIS and then click Check for Updates Now.

    • In the Actions pane, click Check for Updates Now.

    • On the Action menu, click Check for Updates Now.

Using a command line

To propagate changed maps by using a command line

  • At a command prompt, type:

    nisadmin [server] syncall [–u user [–p password]]

The following table describes the arguments of the nisadmin command that are used to propagate changed maps. To view the complete syntax for this command, at a command prompt, type nisadmin /?.

Argument | Description
syncall | Propagate all maps.
server | The name of the server where the maps are stored.
user | The name of the user who has administrator permissions on the server, if different from the current user.
password | The password of the user who has administrator permissions on the server, if different from the current user. If you type a user name but omit the password, you will be prompted for the password.
Note

The nisadmin syncall command propagates maps only on UNIX-based NIS subordinate servers. It does not propagate maps on NIS subordinate servers running Windows operating systems. Active Directory updates Windows-based NIS subordinate servers.


Use ypmatch to view an entry in an NIS map

To use ypmatch to view an entry in an NIS map

To use ypmatch to view an entry in an NIS map

  • At a command prompt, type one of the following:

    ypmatch [-d Domain] [-h HostName] [-t] [-k] Key [Key ...] MapName

    or

    ypmatch -x

The following table describes the arguments that are used with the ypmatch command to view entries in NIS maps. To view the complete syntax for this command, at a command prompt, type ypmatch /?.

Argument | Description
Domain | A domain other than the default domain.
HostName | The name of the Network Information Service (NIS) server to which you want to send the request.
-t | Inhibits translation of nickname to map name.
-k | Prints a key followed by a colon before printing the value of the key. This is useful only if your keys do not have duplicate values, and you do not have an unreasonable number of keys to clutter the output.
Key | The key for which you want to print the value.
MapName | The name or the nickname of a map.
-x | Lists the nicknames as specified by the MapName parameter.
Note

There is no Windows interface method for this procedure.


Use ypcat to print values in an NIS map

To use ypcat to print values in an NIS map

To use ypcat to print values in an NIS map

  • At a command prompt, type one of the following:

    ypcat [-k] [-d DomainName] [-t] [-h NISServer] MapName

    or

    ypcat -x

The following table describes the arguments that are used with ypcat to print the values of an NIS map. To view the complete syntax for this command, at a command prompt, type ypcat /?.

Argument | Description
-k | Displays keys and their values.
DomainName | Searches the specified domain for the specified map.
-t | Forces the ypcat command to bypass the nickname translation table and search only for the map specified by the MapName parameter.
NISServer | Name of the Network Information Service (NIS) server where the map is stored.
MapName | The name of the map to be listed.
-x | Lists the nicknames as specified by the MapName parameter.
Note

There is no Windows interface method for this procedure.


Edit maps

In this section

The following topics are contained in this section.

  • Edit passwd, group, and host map entries

  • Edit standard and nonstandard map entries using the command line interface

  • Create the structure of a nonstandard map


Edit passwd, group, and host map entries

To edit passwd, group, and host map entries using Active Directory Users and Computers

Important

Do not use Active Directory Users and Computers to modify attributes of special users and groups, that is, users and groups with user identifiers (UIDs) or group identifiers (GIDs) of less than 100. If you do, the data returned by Server for NIS is not correct for those users and groups. Use the procedure described in Edit standard and nonstandard map entries using the command line interface instead.

To edit passwd, group, and host map entries

  1. Open Active Directory Users and Computers.

    To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

    You can also open Active Directory Users and Computers from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Active Directory Users and Computers.

  2. In the console tree, expand the Active Directory domain that contains the map you want to edit, and then do one of the following:

    • To edit passwd or group maps, click Users.

    • To edit the host map, click Computers.

  3. Double-click the user or computer whose properties you want to edit.

  4. Click the UNIX Attributes tab.

  5. In the boxes provided, edit the properties you want to change.

  6. To save the changes and keep the dialog box open, click Apply. To save the changes and close the dialog box, click OK.


Edit standard and nonstandard map entries using the command line interface

To edit standard and nonstandard map entries using the command line

Note

When you use nismap to delete a user, group, or host object, only the UNIX attributes of the object are deleted. To delete the object from Active Directory, use the Active Directory administration tools.

To edit standard and nonstandard map entries by using the command line

  • At a command prompt, do one of the following.

    • To add a user to a passwd map, type:

      nismap add –e passwdEntry –a nisDomain passwd

    • To modify a user in a passwd map, type:

      nismap mod –e passwdEntry –k username –a nisDomain passwd

    • To delete a user from a passwd map, type:

      nismap del –k username –a nisDomain passwd

    • To add a group to a group map, type:

      nismap add –e groupEntry –a nisDomain group

    • To modify a user from group map, type:

      nismap mod –e groupEntry –k groupName –a nisDomain group

    • To delete a user from group map, type:

      nismap del –k groupName –a nisDomain group

The following table describes arguments that are used with the nismap command to modify map entries. To view the complete syntax for this command, at a command prompt, type nismap /?.

Argument | Description
passwdEntry | An entry from the passwd map.
nisDomain | The Network Information Service (NIS) domain.
username | The name of the user.
groupEntry | An entry from the group map.
groupName | The name of the group to which the user belongs.


Create the structure of a nonstandard map

To create the structure of a nonstandard map

To create the structure of a nonstandard map

  • At a command prompt, type the following.

    nismap create –i fieldNumber –g "separator" mapName

The following table describes the arguments used with the nismap command to create nonstandard map structure.

Argument Description

fieldNumber

The number of the field that contains the key to the map.

" separator "

The character used to separate fields, in quotation marks. To specify a space as a separator, enclose the space in double quotation marks (" "). For example:

nismap create –i 1 –g " " Phones

creates a map called Phones in which the key field is the first field and the separator character is a space. Other white-space characters, such as tab, are also accepted.

mapName

The name of the map.
Note

There is no Windows interface method for this procedure. After this structure is created, there is no way to remove it. This structure applies to all NIS domains, so it is important to ensure that the format is consistent across all NIS domains. Do not use the hash character (#) as a field separator because this character is used in standard maps to mark the beginning of a comment.


Manage NIS users

In this section

The following topics are contained in this section.

  • Add a user to an NIS domain

  • Change a user's ID (UID)

  • Change a user's default shell

  • Change a user's home directory

Managing NIS users

UNIX systems store basic information about authorized users in the passwd file. This file consists of a series of lines, one for each authorized user. Each line can contain the following information about a user:

  • User name

  • Password (in encrypted form)

  • User identifier (UID)

  • Group identifier (GID) of the user's primary group

  • User's full name and other information (known as the gecos field)

  • Default login shell

  • Home directory

Conventional Network Information Service (NIS) servers generate two maps from the passwd file, passwd.byname and passwd.byuid, which contain the same information as the passwd file, but are indexed to provide quick access to the records.

Instead of storing this information in files, Server for NIS maintains user information in Active Directory Domain Services entries for each user. This allows you to manage the Windows and UNIX (NIS) information together by using the user properties dialog box in Active Directory Users and Computers. When adding a new user, for example, you have to enter the information shared by Windows and NIS (the user name, password, and full name and other gecos-type information) only once. In the case of UNIX-specific information (UID, primary GID, login shell, and UNIX home directory), you can enter this information using the UNIX Attributes tab of the same dialog box.


Add a user to an NIS domain

To add a user to an NIS domain

Note

There is no command-line method for this procedure. The logon name of the user must comply with UNIX user-naming conventions. It must contain only lowercase alphabetic and numeric characters, no more than eight characters, and at least one alphabetic character. It must not include either a colon (:) or a newline character. A user identifier (UID), default shell, and home directory are automatically assigned to the user. If your NIS domain has special requirements for these values, you can change them when you add the user to the domain or at any later time.

To add a user to an NIS domain

  1. Open Active Directory Users and Computers.

    To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

    You can also open Active Directory Users and Computers from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Active Directory Users and Computers.

  2. In the console tree, click the Users folder.

  3. In the details pane, right-click the user you want to add to the NIS domain, and then click Properties.

  4. Click the UNIX Attributes tab.

  5. In the NIS Domain list, click the domain to which you want to add the user.

  6. In the Primary group name/GID list, click the name of the user's primary group, and then click OK.

  7. In the details pane, right-click the group you selected as the user's primary group, and then click Properties.

  8. Click the UNIX Attributes tab, and then click Add.

  9. In the Available NIS Users list, click the name of the user you just added to the domain, click Add, and then click OK.


Change a user's ID (UID)

To change a user's ID (UID)

To change a user's UID

  1. Open Active Directory Users and Computers.

    To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

    You can also open Active Directory Users and Computers from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Active Directory Users and Computers.

  2. In the console tree, click the Users folder.

  3. In the details pane, right-click the user you want to administer, and then click Properties.

  4. Click the UNIX Attributes tab.

  5. In the UID box, type the new user identifier (UID) for the user.

  6. To save the changes and keep the dialog box open, click Apply. To save the changes and close the dialog box, click OK.
Note

There is no command-line method for this procedure.


Change a user's default shell

To change a user's default shell

To change a user's default shell

  1. Open Active Directory Users and Computers.

    To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

    You can also open Active Directory Users and Computers from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Active Directory Users and Computers.

  2. In the console tree, click the Users folder.

  3. In the details pane, right-click the user you want to administer, and then click Properties.

  4. Click the UNIX Attributes tab.

  5. In the Login Shell box, type the full path name of the new shell for the user.

  6. To save the changes and keep the dialog box open, click Apply. To save the changes and close the dialog box, click OK.
Note

There is no command-line method for this procedure.


Change a user's home directory

To change a user's home directory

To change a user's home directory

  1. Open Active Directory Users and Computers.

    To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

    You can also open Active Directory Users and Computers from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Active Directory Users and Computers.

  2. In the console tree, click the Users folder.

  3. In the details pane, right-click the user you want to administer, and then click Properties.

  4. Click the UNIX Attributes tab.

  5. In the Home Directory box, type the full path name of the new home directory for the user.

  6. To save the changes and keep the dialog box open, click Apply. To save the changes and close the dialog box, click OK.
Note

There is no command-line method for this procedure.


Manage NIS groups

In this section

The following topics are contained in this section.

  • Add one or more groups to an NIS domain

  • Change a group's ID (GID)

  • Add or remove members of a group

Managing NIS groups

UNIX systems store basic information about groups of users in the group file. This file consists of a series of lines, one for each group. Each line can contain the following information about a group:

  • Group name

  • Group identifier (GID)

  • List of users belonging to the group

Conventional Network Information Service (NIS) servers generate two maps from the group file, group.byname and group.bygid, which contain the same information as the group file, but are indexed to provide quick access to the records.

Instead of storing this information in files, Server for NIS maintains group information in Active Directory Domain Services entries for each group. This allows you to manage the Windows and UNIX (NIS) information together by using the group properties dialog box in Active Directory Users and Computers. When creating a new group, for example, you must enter the group name, which is shared by Windows and NIS, only once. In the case of UNIX-specific information (GID and members), you can enter this information using the UNIX Attributes tab of the same dialog box.


Add one or more groups to an NIS domain

To add a group to an NIS domain

A group identifier (GID) is automatically assigned to the group. If your NIS domain has special requirements for GID values, you can change the assigned value.

To add a group to an NIS domain

  1. Open Active Directory Users and Computers.

    To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

    You can also open Active Directory Users and Computers from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Active Directory Users and Computers.

  2. In the console tree, click the Users folder.

  3. In the details pane, right-click the group you want to add to the NIS domain, and then click Properties.

  4. Click the UNIX Attributes tab.

  5. In the NIS Domain list, click the domain to which you want to add the group.

  6. To save the changes and keep the dialog box open, click Apply. To save the changes and close the dialog box, click OK.
Note

There is no command-line method for this procedure. The name of the group must comply with UNIX naming conventions. It must contain only lowercase alphabetic and numeric characters, no more than eight characters, and at least one alphabetic character. It must not include either a colon (:) or a newline character.


Change a group's ID (GID)

To change a group's ID (GID)

To change a group's GID

  1. Open Active Directory Users and Computers.

    To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

    You can also open Active Directory Users and Computers from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Active Directory Users and Computers.

  2. In the console tree, click the Users folder.

  3. In the details pane, right-click the group you want to administer, and then click Properties.

  4. Click the UNIX Attributes tab.

  5. In the GID (Group ID) box, type the new group identifier (GID) for the group.

  6. To save the changes and keep the dialog box open, click Apply. To save the changes and close the dialog box, click OK.
Note

There is no command-line method for this procedure.


Add or remove members of a group

To add or remove members of a group

To add or remove members of a group

  1. Open Active Directory Users and Computers.

    To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

    You can also open Active Directory Users and Computers from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Active Directory Users and Computers.

  2. In the console tree, click the Users folder.

  3. In the details pane, right-click the group you want to administer, and then click Properties.

  4. Click the UNIX Attributes tab.

  5. Do one of the following:

    • To add a user, click Add. In the Available NIS users list, click Add, and then click OK.

    • To remove a user, in the Members list, click the user you want to remove, and then click Remove.

  6. To save the changes and keep the dialog box open, click Apply. To save the changes and close the dialog box, click OK.
Note

There is no command-line method for this procedure.


Manage NIS computers

In this section

The following topics are contained in this section.

  • Add a computer to a domain

  • Specify the IP address of a computer in a domain

  • Specify the alias of a computer in a domain

Managing NIS computers

UNIX systems store basic information about host computers on the network in the hosts file. This file consists of a series of lines, one for each computer. Each line can contain the following information about a computer:

  • Internet Protocol (IP) address

  • Computer name

  • List of aliases

A UNIX computer consults this list to determine the IP address of another computer when that computer is referred to by name or alias, rather than by address.

Instead of storing this information in a file, Server for NIS maintains information about network computers in Active Directory Domain Services entries for each computer. This allows you to manage the Windows and UNIX (NIS) information together by using the computer properties dialog box in Active Directory Users and Computers. When adding a computer to the Windows and Network Information Service (NIS) domains, for example, you must enter the computer name, which is shared by Windows and NIS, only once. In the case of UNIX-specific information (IP address and aliases), you can enter this information using the UNIX Attributes tab of the same dialog box.

Note that you have to enter the IP address only if it is statically assigned. If the address is assigned by a DHCP server, the hosts map will be automatically updated whenever the computer's IP address changes.


Add a computer to a domain

To add a computer to a domain

To add a computer to a domain

  1. Open Active Directory Users and Computers.

    To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

    You can also open Active Directory Users and Computers from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Active Directory Users and Computers.

  2. In the console tree, click the Computers folder.

  3. In the details pane, right-click the computer you want to add to the domain, and then click Properties.

  4. Click the UNIX Attributes tab.

  5. In the NIS Domain list, select the domain to which you want to add the computer.

  6. To save the changes and keep the dialog box open, click Apply. To save the changes and close the dialog box, click OK.
Note

There is no command-line method for this procedure.


Specify the IP address of a computer in a domain

To specify the IP address of a computer in a domain

To specify the IP address of a computer in a domain

  1. Open Active Directory Users and Computers.

    To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

    You can also open Active Directory Users and Computers from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Active Directory Users and Computers.

  2. In the console tree, click the Computers folder.

  3. In the details pane, right-click the computer you want to administer, and then click Properties.

  4. Click the UNIX Attributes tab.

  5. In the IP Address box, type the Internet Protocol (IP) address of the computer.

  6. To save the changes and keep the dialog box open, click Apply. To save the changes and close the dialog box, click OK.
Note

There is no command-line method for this procedure.


Specify the alias of a computer in a domain

To specify the alias of a computer in a domain

To specify the alias of a computer in a domain

  1. Open Active Directory Users and Computers.

    To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

    You can also open Active Directory Users and Computers from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Active Directory Users and Computers.

  2. In the console tree, click the Computers folder.

  3. In the details pane, right-click the computer you want to administer, and then click Properties.

  4. Click the UNIX Attributes tab.

  5. In the Alias box, type the alias of the computer, and then click Add.

  6. To save the changes and keep the dialog box open, click Apply. To save the changes and close the dialog box, click OK.
Note

There is no command-line method for this procedure. To remove an alias of the computer, select the alias in the List of Aliases list, and then click Remove.


Server for NIS Concepts

In this section

This section contains the following topics.

  • Understanding Server for NIS

  • Understanding NIS Data Migration

  • Administering Server for NIS


Understanding Server for NIS

Understanding Server for NIS

Server for NIS integrates Windows and Network Information Service (NIS) networks by giving a Windows–based Active Directory Domain Services (AD DS) domain controller the ability to act as a master NIS server for one or more NIS domains. Server for NIS stores both standard and nonstandard NIS map data in AD DS. (Standard maps consist of aliases, bootparams, ethers, hosts, group, netgroup, netid, netmasks, networks, passwd, protocols, rpc, services, pservers, and shadow; all other maps are non-standard.)

Server for NIS thus creates a single name space for the Windows and NIS domains that can be managed by the Windows administrator using a single set of tools. The administrator can easily create, modify, and delete user accounts for both Windows and UNIX domains at the same time. A user who has accounts in both the Windows and UNIX environments can be managed by using AD DS with all attributes necessary for the respective domain and name space.

Master and subordinate servers running Server for NIS

Server for NIS can also be installed on other domain controllers in the same domain as the master NIS server, giving them the ability to function as NIS subordinate servers. In this case, the NIS data in AD DS is automatically replicated among the Windows domain controllers running Server for NIS. UNIX-based computers can continue to function as subordinate servers in the NIS domain, because Server for NIS uses yppush to propagate changes of NIS data to UNIX-based NIS servers just as a UNIX-based master NIS server.

Migration process

After you install Server for NIS, your first task is to migrate NIS maps from UNIX-based NIS servers to the computer running Server for NIS. You can use either a Windows-based migration wizard included with Server for NIS, or you can use a command-line utility to complete this task. After maps have been migrated, Server for NIS is ready to act as a master server for the NIS domain. You can migrate multiple NIS domains to the same Windows–based Active Directory domain controller. Domains can be either merged or kept separate. You can migrate NIS map data in a staged manner by migrating NIS maps one at a time.

Server for NIS can support multiple NIS domains concurrently. Maps that belong to multiple domains can be stored concurrently in AD DS. Requests from a client or another server in a domain receive data from a map in the same domain.

Management of Server for NIS

You can manage Server for NIS using the Windows-based Identity Management for UNIX. You can manage the passwd, group and hosts maps that you have migrated to AD DS using Windows–based tools such as Active Directory Users and Computers. You can also use the command-line tools nismap and nisadmin to manage all standard and nonstandard maps, and to manage Server for NIS. You can monitor Server for NIS performance using Windows administrative tools, including using Event Viewer to audit significant events and errors logged by Server for NIS.

In addition to using administrative tools provided by Windows, you can also create additional administrative tools using Active Directory Service Interfaces (ADSI) or Lightweight Directory Access Protocol (LDAP).

Server for NIS implements the NIS remote procedure calls necessary to serve requests from UNIX-based and Windows-based NIS clients, as well as other subordinate NIS servers. Server for NIS supports both broadcast mode and normal binding mode.

In this section

This section contains the following topics.

  • Understanding NIS

  • Master and subordinate server modes

  • Understanding NIS Data Migration


Understanding NIS

Understanding NIS

Formerly known as Yellow Pages (yp), Network Information Service (NIS) provides a simple network look-up service that consists of databases and processes. An NIS domain consists of a client and one or more servers. Clients use the NIS protocol to look up information stored in NIS databases, which are replicated among servers. A single master server is assigned to update databases, while subordinate servers provide read-only services. Databases are synchronized by copying them from master servers to subordinate servers periodically or when changes occur.

A database served by NIS is called an NIS map. The NIS lookup calls require a map (database) name and an NIS domain name. An NIS domain consists of a collection of such maps. In addition to map databases, the master NIS server maintains the time stamp that indicates when each database was last modified.

Each database is created from a source file. For example, passwd.byname and passwd.byuid databases are created from the source file named passwd. When source files change, administrators either run a shell script called ypmake or a makefile to update the databases. In addition, the makefiles used to create the databases push the databases to subordinate NIS servers using yppush. The transfer uses ypxfr, a program that runs on subordinate servers.

Clients can use many functions and remote procedure calls to connect to the network lookup service, including the following:

  • yp_match

  • yp_first

  • yp_next

  • yp_all

  • yp_order

  • yp_master

  • yperr_string

  • ypprot_err

In addition there are usually many tools for administering NIS, such as ypwhich, yppoll, ypset, ypcat, and domainname.

Note

Server for NIS does not support ypxfrd, which might cause some UNIX subordinate NIS servers to display warning messages. The warning messages originate in ypinit and do not indicate actual errors. Some UNIX subordinate NIS servers run ypxfrd on the master NIS server to replicate NIS maps. If they fail to connect to ypxfrd, they obtain copies of NIS maps by using yp_all.


Master and subordinate server modes

Master and subordinate (slave) modes

Server for NIS can operate in a master mode or subordinate mode. (If Server for NIS is used in a domain, the master server in the domain must be Server for NIS.) In UNIX, the primary difference between the two is that both subordinate and master servers can read map data, while only the master server can update maps. Additionally, the master Network Information Service (NIS) server provides periodic updates of the maps to subordinate servers.

In the Windows environment running Server for NIS, because the data is stored in Active Directory Domain Services (AD DS), both master and subordinate servers share the same replicated AD DS database. This makes them peers as far as map updates or write access are concerned. Server for NIS in either master mode or subordinate mode allows updates to Network Information Service (NIS) map data stored in AD DS. Changes to AD DS on any of these servers are propagated to other computers running Server for NIS in the domain by the AD DS synchronization mechanism.

Although these servers operate as peers for data updates, there must still be only one master server for UNIX-based subordinate servers and clients. UNIX subordinate servers continue to receive map updates from the Windows-based domain controller running Server for NIS that is designated as the master server. Similarly, they will continue to send passwd changes only to the master server.

For information about changing a subordinate server to a master server, see Change a subordinate server to a master server.


Understanding NIS Data Migration

Understanding NIS data migration

Server for NIS allows Network Information Service (NIS) map data to be migrated to Active Directory Domain Services (AD DS).

After the migration, and upon receiving NIS requests from clients or other servers, Server for NIS searches AD DS to reply to NIS queries.

Migration consists of the following three steps:

  1. Migrate the NIS maps to a Windows-based server.

    • Using the command line

      Identity Management for UNIX includes a command-line tool called nis2ad to migrate maps from UNIX-based NIS servers to AD DS–based Server for NIS.

    • Using the migration wizard

      The NIS Data Migration wizard in Identity Management for UNIX extracts the information necessary to perform the migration. Even when using the migration wizard, however, you must complete steps 2 and 3, which follow.

    The migration wizard and the nis2ad command read map data from NIS map source files, which are the plain text files from which the NIS map databases are compiled. These source files must be located in a location that can be accessed by the domain controller during migration, such as on a disk on the domain controller or in a shared directory accessible by the domain controller.

  2. Inform the existing subordinate (also known as slave) NIS servers of the new master NIS server.

    After the migration, the original UNIX-based NIS server must send an update of maps to all subordinate NIS servers with the name of the new master server in the maps.

  3. Disable the original NIS server.

UNIX-based subordinate NIS servers can continue to work as before; however, they receive map updates from the Windows-based computer instead of the UNIX-based computer. Client computers continue to get NIS maps or data from the new master.

In this section

Migrating and Managing Standard and Non-standard Maps

Resolving Migration Conflicts


Migrating NIS to Active Directory Domain Services

Migrating NIS to Active Directory

During migration, Server for NIS can migrate each Network Information Service (NIS) domain and preserve it as a separate domain in Active Directory Domain Services (AD DS). It can also merge the data in an existing domain, however. This domain can be one of the previously migrated domains or a special NIS domain that is created when Server for NIS is installed.

One of the advantages of migrating NIS maps to Windows is to merge UNIX and Windows users and objects to create a common name space. Another advantage is that objects common in two networks can have a unique identity.

During migration, you must specify the AD DS container in which migrated objects must be created. It is strongly recommended that you create these objects in the same container as the other Windows objects. If the container is not specified, new objects are created in the default container that is the same as the Windows container.

If you migrate passwd, groups, or host maps to a container other than the default container, migrated entities do not show by default in Active Directory Users and Computers. To view all objects, select Advanced features on the View menu of the Active Directory Users and Computers console.

Windows user accounts created as a result of the migration are disabled. After performing the migration, you must enable the accounts when you are ready for them to be used. For security reasons, it is recommended that you also assign a temporary password to these accounts and instruct users to change their Windows passwords as soon as possible.

See Server for NIS Troubleshooting for information about handling migration problems.

Staged migration

After maps are migrated to the AD DS domain controller, other UNIX-based subordinate servers can be migrated to other domain controllers in the same Windows domain. Migration of subordinate servers does not require migration of the data, because AD DS allows domain controllers in the Windows domain to share the same AD DS schema and database, and subordinate domain controllers already have access to the NIS data. After Server for NIS is installed on a domain controller in the same Windows domain, the domain controller is ready to act as a subordinate NIS server for the NIS domain.

The following are the steps in the migration of a subordinate NIS server.

  1. Verify that the master server of the NIS domain is migrated to Server for NIS.

  2. Install Server for NIS on another AD DS domain controller. The subordinate NIS server that you want to migrate to Windows can continue to operate as before. Subnets can have more than one subordinate NIS server.

  3. Disable the subordinate NIS server on the UNIX-based computer.

The NIS map source files of an NIS domain need not be migrated all at once. (NIS map source files are the plain text files from which the NIS map databases are compiled.) Each NIS map for a domain is migrated separately. The administrator can specify the domain name to which this map will be migrated. If a domain with the specified name does not exist, Server for NIS creates a new NIS domain with that name.

After you migrate NIS maps to Server for NIS, a delay can occur before the migrated data is available to Server for NIS.

Migrating multiple NIS domains

The migration utility or migration wizard allows migration of multiple NIS domains to AD DS. During migration of a map, the administrator must specify the domain from which the data is being migrated. Server for NIS preserves the name of the original domain with the map entries created in AD DS. As a result, migrated map entries are returned to clients or subordinate servers from the specified domain only.

The migration wizard can also merge a map from one domain into another NIS domain. This can be one of the previously migrated NIS domains, or a special domain that is created when Server for NIS is installed. The administrator must specify the name of the NIS domain to which the data will be migrated.

If you migrate multiple domains, you can manage individual domains by using the Identity Management for UNIX management console.

Server for NIS supports a maximum of 960 unique combinations of NIS domains and maps. For example, Server for NIS cannot support more than 64 domains with 15 maps each (64×15=960).


Migrating and Managing Standard and Non-standard Maps

This topic contains the following sections.

Migrating standard and nonstandard maps

Managing standard and nonstandard NIS maps

Migrating standard and nonstandard maps

The command-line migration program and the NIS Data Migration wizard are both designed to migrate standard Network Information Service (NIS) maps, such as passwd, group, and services. The NIS Data Migration wizard provides a list of NIS map source files (that is, the plaintext files from which the NIS map databases are compiled) from which the administrator chooses the maps to migrate. The migration wizard then uses the standard format of these NIS map source files to migrate the data to Active Directory.

The following are considered standard maps. All other maps are nonstandard maps.

  • aliases

  • bootparams

  • ethers

  • hosts

  • group

  • netgroup

  • netid

  • netmasks

  • networks

  • passwd

  • protocols

  • rpc

  • services

  • ypservers

  • shadow

Note

Domain names are not case sensitive. Domains cannot be migrated if they have the same name, even if the case of characters in the names is different.

How Server for NIS handles standard migration

Migration is handled in one of two ways, depending on whether the map being migrated has an equivalent in Active Directory Domain Services (AD DS). For standard maps such as passwd, group, and hosts, that have an equivalent AD DS class, auxiliary classes are added. For example, an auxiliary class called posixAccount is added to the class user, which, in turn, adds attributes such as uidNumber and unixHomeDirectory. For standard NIS maps that have no equivalent in AD DS, such as services and rpc, additional classes are created.

Because Identity Management for UNIX is compliant with Internet Engineering Task Force (IETF) standard Request for Comments (RFC) 2307, map attributes match those identified in the RFC 2307 schema, with the following exceptions:

  • The Identity Management for UNIX equivalent of the RFC 2307 attribute userPassword is unixUserPassword.

  • The Identity Management for UNIX equivalent of the RFC 2307 attribute homeDirectory is unixHomeDirectory.

  • In Identity Management for UNIX, posixgroup is not a unique class as defined by RFC 2307. It is an auxiliary class.

For each map entry being migrated during the migration of standard maps, the migration wizard either creates a new object of the corresponding class or adds appropriate attributes to the auxiliary class.

Because the classes and attributes found in non-standard maps may not have matching correspondents in Active Directory, the migration wizard relies upon a key field to make a one-to-one match between entries in the existing map and entries created in Active Directory. Using the key field as a reference, the migration wizard copies to Active Directory other classes in the nonstandard map as they appear in the map source file.

Important

When you migrate passwd and group maps, users will not appear as members of their primary group. If you want users to be members of their primary group in AD DS, you must use Active Directory Users and Computers to add users to their primary group.

Before you migrate a nonstandard map, you must provide the syntax of the map. You must provide the name of the nonstandard map, the delimiter between the fields, and the field number of the key field.

For information about managing maps after migration, see Managing standard and nonstandard NIS maps.

Migrating passwd maps

If a new Windows user is created as a result of the migration, the user's Windows account is disabled. Before the user can log on to the Windows domain or a UNIX computer in the NIS domain, you must enable the Windows account. For security reasons, it is recommended that you change the user's Windows password to a known, temporary value, provide the user with the temporary password, and then instruct the user to change the Windows password as soon as possible. When the user changes the Windows password, the new password is propagated to UNIX-based NIS clients the next time NIS maps are refreshed. After this refresh occurs, the user can log on to UNIX computers in the NIS domain.

If migration results in adding UNIX attributes to an existing Windows user, the UNIX password in AD DS is set to the existing UNIX password, and the Windows password remains unchanged.

Whenever a user's Windows password is changed, the password in the NIS passwd map stored in AD DS is changed. The reverse is not true, however. That is, when the user runs yppasswd on a UNIX client computer to change the user's NIS password, only the password in the NIS passwd map is changed; the Windows password does not change. As a result, UNIX and Windows passwords differ.

Note

Users should change passwords only in Windows to ensure that Windows and UNIX passwords in the NIS map are identical. Note, however, that you can install and configure Password Synchronization to provide two-way password synchronization between Server for NIS and UNIX hosts in an NIS domain.

For more information, see Synchronizing Passwords with an NIS Domain.

Migrating ypservers maps

Keys within the ypservers map are the ASCII names of the computers on which the NIS servers run. That is, the ypservers map can contain only a list of NIS servers, each one listed on a separate line. If your ypservers map contains aliases, before migrating the map, edit the ypservers map to contain only the host names of the servers, one per line. The following list is an example of a valid ypservers map:

ypserver_1
ypserver_2
ypserver_3

Migrating Automount File System (AutoFS) maps

You can migrate Automount File System (AutoFS) maps by importing the auto_master and auto_home files from a UNIX computer. You can use either command-line tools or the NIS Data Migration wizard.

Before performing the migration, you must copy the auto_master and auto_home files from the UNIX computer to any directory (such as %temp%) on the Windows-based computer.

When you use the wizard to migrate AutoFS maps, specify auto_master or auto_home, depending on which map you are migrating. Specify a blank space as the field separator and 1 as the key field. Verify that the key is not part of the value.

You can use the wizard to import other AutoFS maps as well. For example, you can migrate the auto.redirect map by copying and then importing the auto_redirect map file, making sure that the key is not part of the value..

Using command-line tools to migrate AutoFS maps involves using the nismap utility to create the corresponding structure in the Active Directory schema and then running the nis2ad utility to import the map data.

For example, the following commands would migrate AutoFS maps from the NIS domain named NIS01 to the Windows domain named WIN01 by using files located in C:\Temp:

nismap create -i 1 -g " " -y auto.master
nismap create -i 1 -g " " -y auto.home
nis2ad -y NIS01 -a WIN01 -d C:\Temp -s localhost -r yes -m auto_master
nis2ad -y NIS01 -a WIN01 -d C:\Temp -s localhost -r yes -m auto_home

You can use the same method to migrate other AutoFS maps. For example, to migrate the auto.redirect map, use the nismap utility to create the structure for the auto.redirect map in AD DS, copy the auto_redirect file to the Windows-based computer, and then run the nis2ad utility to import the data in the auto_redirect file.

Migrating nonstandard maps

AD DS includes a class that applies to any NIS map. This class requires the name of the map, the key, and the rest of the entry.

To migrate nonstandard maps, the administrator must provide the name of the map source file and the format of the map entries to the migration wizard or command-line utility. The migration wizard uses the key field and the separator to migrate the data and create appropriate objects in Active Directory.

Important

If you migrate passwd, group, or hosts maps to a container other than the default container (CN=users,...), some migrated objects do not typically display in Active Directory Users and Computers. To view all objects in Active Directory Users and Computers, select the domain and then click Advanced Features on the View menu.

Managing standard and nonstandard NIS maps

You can use a Windows-based Network Information Service (NIS) server to manage both standard and nonstandard maps. You can manage maps that are part of a domain served by a Windows-based NIS server by using two different types of tools.

  • The Identity Management for UNIX graphical user interface (GUI)

  • Command-line utilities

In many cases, you can use either method to perform a task. In some cases, however, only one method or the other can be used.

For information about migrating maps, see Migrating standard and nonstandard maps.

Managing passwd maps

You can use Active Directory Users and Computers to manage passwd maps for Server for NIS. You can also use Active Directory Users and Computers to manage password file–related attributes for a user in the Windows domain, or for the users migrated from a given NIS domain.

Managing group maps

Data for group maps for Server for NIS are managed by using Active Directory Users and Computers. Each group in the Windows domain or from the groups migrated from a given NIS domain can be managed by using Active Directory Users and Computers.

Note that, for a given group, the UNIX members are different from the Windows users for the same group.

Managing hosts maps

You can manage data for hosts maps for Server for NIS by using Active Directory Users and Computers. Each computer in the Windows domain, as well as the hosts migrated from a given NIS domain, can be managed by using this snap-in.

Managing other maps and nonstandard maps

Server for NIS does not include GUI tools for managing standard NIS maps other than passwd, group, and hosts. Maps other than these can be managed using tools provided as part of Active Directory. In particular, administrators can use the adsiedit snap-in to view and edit NIS maps.

Standard maps include:

  • passwd

  • group

  • hosts

  • aliases

  • bootparams

  • ethers

  • netgroup

  • netid

  • netmasks

  • networks

  • protocols

  • rpc

  • services

  • ypservers

  • shadow password maps


Resolving Migration Conflicts

Resolving migration conflicts

During migration, conflicts may occur when Server for NIS attempts to merge incoming user accounts, groups, and computer names into classes that already exist in Active Directory Domain Services (AD DS). Conflicts can also occur because Server for NIS allows one Network Information Service (NIS) domain to merge with another NIS domain that has already been migrated to Server for NIS.

For example, consider a passwd map source file being migrated to Server for NIS. A UNIX user name johnwood is in the map to be migrated. If there is no existing user with a user name of johnwood, migration of this user to Server for NIS is simple. If there is already a user with that user name previously migrated from another NIS domain, a conflict occurs.

When the NIS Data Migration wizard encounters a potential name conflict during migration, it resolves the conflict by prefixing the name being migrated. If the name being migrated is a user name, the prefix consists of the NIS domain name plus the characters _u_. If the name being migrated is a group name, the prefix consists of the NIS domain plus the characters _g_. This allows the migration to complete even if there is a conflict.

For example, if you are migrating a user named johnwood in an NIS domain named mktg, and a user with the same name was previously migrated from another NIS domain, then the user name of johnwood in the mktg domain is changed to mktg_u_johnwood during the migration.

When conflicts occur, examine the migration logs and determine how to handle each conflict. Consider whether the conflicting name represents the same user or group in both domains, or different users or groups. If not, it is recommended that you rename one or both users or groups. If they do represent the same user or group, then you will need to decide whether the user or group must be in both domains (in which case, at least one of them must be renamed) or whether you can delete the user or group in one of the domains.

Instead of correcting the conflict after the domain migration has occurred, you can prevent the conflict (such as by changing the name of a user or group in the NIS domain).

By default, the NIS Data Migration wizard performs a test migration. During this process, Server for NIS performs the steps required to migrate an NIS domain to AD DS, but does not actually modify AD DS. Server for NIS records expected migration results in a log file. If potential conflicts are found, you can resolve conflicts before performing an actual migration.

When identical names are detected during a test or actual migration, the conflict can be logged to a conflicts log file, which lists conflicts that occur during the migration of a map. If a conflict occurs, the conflicts log file lists the NIS entry to migrate, and the existing entry in AD DS. In the following example, the conflicts log file reports no conflicts in the migration of the passwd file.

--------------
## Tue Jun 1 16:22:47 1999 : Conflicts between entries from map file 'passwd' and existing entries in Active Directory. ##
-------------

In the next example, the conflicts log file reports a conflict in the migration of the map. It lists the existing entry in AD DS, and the new entry to migrate with which the existing entry has a conflict.

-------------
## Tue Jun 1 16:22:52 1999 : Conflicts between entries from map file 'aliases' and existing entries in Active Directory. ##
EXISTS : having DN = 'CN=al1,CN=nisadmin,CN=DefaultMigrationContainer,DC=nis, DC=sfu,DC=nttest,DC=microsoft,DC=com'
OLD : staff:wnj,mosher,sam
NEW : staff:pradeep,peter,wjs
-------------

According to the file, the staff map exists in AD DS. The entry in AD DS is different from the new entry to add. You can change the name of the alias staff either in AD DS or in the map source file; that is, the plain text file from which the NIS map database is compiled. You can also preserve or replace the existing entries by using settings in the NIS Data Migration wizard.

In addition to a conflicts file, you can specify a log file where all migration operations are logged. The following is sample output of a migration operations log file.

## Start of NIS to Active Directory migration of 'passwd' @ Tue Jun 1 16:26:21 1999 ##
MESSAGE : Migrating 'passwd' entries from UNIX NIS domain 'nis01' to Active Directory domain 'CorpDomain.'
SUCCESS : Migration of object 'nis0101' of class 'User' into 'LDAP://localhost/CN=Users,DC=nis,DC=sfu,DC=nttest,DC=microsoft,DC=com'.
SUCCESS : Migration of object 'nis0102' of class 'User' into 'LDAP://localhost/CN=Users,DC=nis,DC=sfu,DC=nttest,DC=microsoft,DC=com'.
## Start of NIS to Active Directory migration of 'passwd' @ Tue Jun 1 16:41:46 1999 ##
MESSAGE : Migrating 'passwd' entries from UNIX NIS domain 'conflicts' to Active Directory domain 'conflicts'.
CONFLICT : Can't migrate 'nis0101' to
'LDAP://localhost/CN=Users,DC=nis,DC=sfu,DC=nttest,DC=microsoft,DC=com'. An object having same attributes(name/uidNumber/gidNumber) exists at 'CN=nis0101,CN=Users,DC=nis,DC=sfu,DC=nttest,DC=microsoft,DC=com'.


Handling special user types during migration

Handling special users during migration

During migration, for special user types with user identifiers (UIDs) below the number 20, Windows accounts are created such that the first nine characters of their Network Information Service (NIS) domain are appended to their UNIX-based user names to create their Windows account names. Their UNIX user names are unaffected. For example, if you migrate the root user from the domain physlab to Server for NIS, a new Windows user is created and named physlab_u_root. The UNIX user name is still root, and NIS queries from the physlab domain are not affected by the difference in names.

A group called root from such a domain, if migrated, will create a group called physlab_g_root.


Administering Server for NIS

In this section

This section contains the following topics

  • Synchronizing user passwords

  • Setting UNIX passwords to special values

  • Synchronizing and propagating NIS changes

  • Sending periodic map updates to subordinate NIS servers

  • Pushing map updates immediately


Synchronizing user passwords

Synchronizing user passwords

Server for NIS provides limited support for keeping passwords synchronized between a user's Windows and UNIX accounts.

If Server for NIS is installed in a Windows domain with multiple domain controllers, it is recommended that you install Password Synchronization on all domain controllers in the domain. This is because any domain controller can potentially respond to a request to change a user's password, and so it is recommended that Password Synchronization be running on that domain controller to ensure that the NIS passwd map is updated. If you install Password Synchronization on a domain controller solely to support Server for NIS in this fashion, it is not necessary to configure UNIX hosts to work with Password Synchronization running on the domain controller.

When synchronizing passwords, Server for NIS can use either crypt or Message Digest 5 (MD5). Server for NIS can support different encryption methods for multiple domains, but all UNIX computers in a particular domain must use the same encryption method. See Set the encryption method for a domain for more information about how to specify the encryption method.


Setting UNIX passwords to special values

Setting UNIX passwords to special values

You can set the password for a UNIX user to a special value, such as NP (no password) or * (no login) without affecting the user's Windows password. To do this, use the nismap command to change the Network Information Service (NIS) password entry for specific user, as follows:

  • To set password to no password (usually a blank):

    nismap mod -e " username :: uid : gid : gecos :/ home / username :/ login_shell " -k username passwd

  • To set password to * (no logon):

    nismap mod -e " username :*: uid : gid : gecos :/ home / username :/ login_shell " -k username passwd

  • To set password to *LK* (locked):

    nismap mod -e "username:*LK*: uid : gid : gecos :/ home / username :/ login_shell " -k username passwd


Synchronizing and propagating NIS changes

Synchronizing and propagating NIS changes

A Windows-based master Network Information Service (NIS) server can propagate changes in maps to subordinate NIS servers in the same domain. These changes are propagated to subordinate NIS servers using the features of the NIS protocol.

The master NIS server supports the following transfer modes:

  • Periodic transfer of NIS maps.

  • On-demand transfer of NIS maps to subordinate servers. Typically, NIS maps get transferred to subordinate servers upon change by using make. The Windows-based NIS server does not use make; instead, the server pushes immediately.

  • Subordinate NIS servers can request transfer of maps at any time.


Sending periodic map updates to subordinate NIS servers

Sending periodic map updates to subordinate (slave) NIS servers

In Network Information Service (NIS), a master NIS server sends periodic map updates to subordinate NIS servers to ensure that both the master and subordinate servers have the same view of the maps. This process uses yppush. Server for NIS also sends periodic map updates to subordinate NIS servers. You can set the frequency of map updates through Server for NFS Administration.

Server for NIS uses yppush to send map updates only to subordinate NIS servers running on UNIX.

Because Server for NIS uses Active Directory Domain Services (AD DS) to store data, both master and subordinate servers share the same replicated AD DS database. Changes to maps for a given domain are propagated to other Servers for NIS running in subordinate mode by the AD DS synchronization mechanism. Thus, Windows-based subordinate NIS servers receive updates from the master NIS server with every change. The update frequency is the property of the Server for NIS and is fixed for all domains that server supports.

For information about how to change the frequency of map updates, see Changing the frequency of map updates.

For information about using yppush, see yppush.


Pushing map updates immediately

Pushing map updates immediately

In Network Information Service (NIS), whenever a change is made to map data, administrators run make to make corresponding changes to the NIS database. Typically, as a part of this process, make also propagates the changes to subordinate (also known as slave) servers through yppush. This provides a way for administrators to push changes immediately to subordinate servers.

Because Server for NIS does not use make to make changes to the database, it provides an explicit yppush command to immediately propagate changes to UNIX-based subordinate servers. Server for NIS also provides a command in the Identity Management for UNIX management console to immediately push maps to subordinate NIS servers.

Note that you can use yppush to push changes only to subordinate NIS servers running on UNIX. Because Server for NIS uses Active Directory Domain Services (AD DS) to store data, both master and subordinate servers running Windows operating systems share the same replicated AD DS database. Changes to AD DS are immediately propagated to other Servers for NIS. Thus, it is not necessary to use yppush to push changes to subordinate NIS servers running Windows operating systems.

For information about propagating maps immediately, see Propagate selected maps now and Propagate changed maps now.

For information about using yppush, see yppush.


Command-line Utilities in Server for NIS

Command-line Utilities in Server for NIS

nisadmin

nis2ad

ypclear

yppush

ypmatch

ypcat

nismap


nisadmin

nisadmin

NAME

nisadmin - Windows command-line utility to administer Server for NIS

SYNOPSIS

nisadmin [computer] [-u usr [-p pword]]
nisadmin [computer] [-u usr [-p pword]] mkmaster -d domain
nisadmin [computer] [-u usr [-p pword]] mkslave -d domain -m server
nisadmin [computer] [-u usr [-p pword]] addserver -d domain -m server
nisadmin [computer] [-u usr [-p pword]] delserver -d domain -m server
nisadmin [computer] [-u usr [-p pword]] config option[...]
nisadmin [computer] [-u usr [-p pword]] syncall
nisadmin [computer] [-u usr [-p pword]] start
nisadmin [computer] [-u usr [-p pword]] stop
nisadmin [computer] [-u usr [-p pword]] pause
nisadmin [computer] [-u usr [-p pword]] continue
nisadmin [computer] [-u usr [-p pword]] encryptiontype
         -d domain {crypt | md5}

DESCRIPTION

The nisadmin Windows command-line utility administers Server for NIS on the local computer or on a remote computer. If you are logged on with an account that does not have the required privileges, you can specify a user name and password of an account that does. The action performed by nisadmin depends on the command argument you supply.

In addition to specific command arguments, nisadmin accepts the following options and arguments:

Term | Definition
computer | Specifies the remote computer you want to administer. You can specify the computer using a Windows Internet Name Service (WINS) or Domain Name System (DNS) name, or by Internet Protocol (IP) address.
-u usr | Specifies the user name of the user whose credentials are to be used. It might be necessary to add the domain name to the user name in the form domain\username.
-p pword | Specifies the password of the user specified using the -u option. If you specify the -u option but omit the -p option, you are prompted for the user's password.

The specific action that nisadmin performs depends on the command argument you specify:

Term Definition

mkmaster

Changes a subordinate (also known as slave) server to a master server. The following option and argument are required when you use mkmaster:

Term | Definition
-d domain | Specifies the name of the domain for which the change is being made.

mkslave

Changes a master server to a subordinate (also known as slave) server. The following options and arguments are required when you use mkslave:

Term | Definition
-d domain | Specifies the name of the domain for which the change is being made.
-m server | Specifies the name of the domain controller to be promoted to master server.

addserver -d domain -m server

Add the specified computer as a subordinate server. The following options and arguments are required when you use addserver.

Term | Definition
-d domain | Specifies the name of the domain for which the change is being made.
-m server | Specifies the name of the domain controller to be added as a subordinate server.

delserver -d domain -m server

Remove the specified subordinate server. The following options and arguments are required when you use delserver.

Term | Definition
-d domain | Specifies the name of the domain for which the change is being made.
-m server | Specifies the name of the subordinate server to be removed.

config

Configures service parameters. You must supply one or more of the following options when you use config:

Term | Definition
pushint=[[days:]hh:]mm | Specifies the interval at which the service checks changes to Network Information Service (NIS) maps in Active Directory and propagates them to secondary NIS servers for all domains, in days, hours, and minutes. If hh is specified, hh must be in the range 0-23 and mm must be in the range 0-59.
logging={n[ormal] | v[erbose]} | Specifies the amount of information to be available in event logs. Specify normal (or n) to log only failure events; specify verbose (or v) to log failure, warning, and success events.

syncall

Synchronizes changed maps with those on UNIX-based subordinate servers immediately.

start

Starts the Server for NIS service.

stop

Stops the Server for NIS service.

pause

Pauses the Server for NIS service.

continue

Continues running the Server for NIS service.

encryptiontype

Specifies the method used to encrypt UNIX passwords for the specified domain. For domains whose UNIX-based computers are all running Linux with MD5 encryption, this value can be md5. For domains containing one or more UNIX-based computers running any other operating system or encryption method, this value must be crypt (the default). All computers in the domain must use the same method.

If you do not supply a command argument, nisadmin displays the current Server for NIS settings.


nis2ad

nis2ad

NAME

nis2ad - Windows command-line utility to migrate maps from Network Information Service (NIS) to Active Directory directory service

SYNOPSIS

nis2ad.exe -y NIS_Domain -a AD_domain [options] mapfile

DESCRIPTION

The nis2ad Windows command-line utility transfers the entries in the Network Information Service (NIS) map source file specified by mapfile located in the UNIX NIS domain specified by NIS_domain to the Active Directory domain specified by AD_domain. NIS map source files are the plain text files from which the NIS map databases are compiled.

The -m option must be specified to perform the actual migration; otherwise, nis2ad performs the actions it would perform in an actual migration without actually changing Active Directory, including logging any conflicting entries.

The nis2ad utility accepts the following options and arguments:

Term | Definition
-d directoryname | Specifies the name of the directory that contains NIS map source files.
-s server | Specifies the domain controller server hosting Active Directory; otherwise, uses the current server.
-u user | Specifies the name of a user having administrator permissions on this computer; otherwise, uses the current user.
-p password | If a password is needed but is not specified, nis2ad prompts the user for the password.
-f logfile | Specifies the name of the log file. The log file must be on your local computer. The default is %sfudir%\nis\nis2ad.log.
-c conflictfile | Specifies the file where conflict details are written. The default is %sfudir%\nis\conflicts.log.
-r {yes|no} | Replaces the object in Active Directory with the object being migrated. The default is no.
-n | Resolves conflicts by changing the Windows account name in Active Directory. If objects of different types have the same name, the name of both objects is changed before the data is migrated.
-t targetContainer | Specifies the target container name. Applicable only when creating a new NIS domain. If not specified, uses default or uses the container of the target domain.
-m | Performs the migration. If this option is omitted, the program finds and reports conflicts, but does not actually perform the migration.
-h/-? | Displays usage information for the command.
Note

The currently logged on user must have write permissions for the folder that will contain the log and conflict files, even if another user is specified with the -u option. If necessary, modify the permissions on the folder to grant write access to the user who will be running the nis2ad utility before running the utility.


ypclear

ypclear

NAME

ypclear - Windows command-line utility to clear the Network Information Service (NIS) server cache for an NIS map and its dependent maps

SYNOPSIS

ypclear [-d domainName] [-t] [-h nisServer] mapname
ypclear -x

DESCRIPTION

The ypclear(1w) Windows command-line utility tells the specified Network Information Service (NIS) server in a specified domain that a map has changed and that the server should clear its cache. Without this notification, the NIS server can sometimes serve out-of-date information.

The ypclear command can be used to rebuild the map cache of an NIS server that still displays obsolete map data, even when Active Directory shows a current and accurate map of the network. Typically, using ypclear corrects the problem.

The ypclear command accepts the following options and arguments:

Term | Definition
-d domain | Specifies the NIS domain. If this option is not used, the NIS domain is assumed to be the domain named in the DEFAULT_NIS_DOMAIN environment variable.
-t | Inhibits map nickname translation.
-h nisServer | Specifies the name of the NIS server. If this option is not used, the NIS server is assumed to be the server named in the NIS_SERVER environment variable.
-x | Displays the map nickname translation table.


yppush

yppush

NAME

yppush - Force propagation of a changed Network Information Service (NIS) map

SYNOPSIS

yppush [-d adNisDomain] [-q] [-t timeout] [-h host[...]] mapname

DESCRIPTION

The yppush(1w) Windows command-line utility sends a request to UNIX-based subordinate (also known as slave) NIS servers to transfer a new version of the NIS map specified by mapname from the master NIS server. It is run only on the master NIS server after the NIS map has been changed. If the -h option is specified, the transfer request is sent only to the specified server. Otherwise, yppush first constructs a list of NIS server hosts by reading the ypservers NIS map within the domain. For more information about the correct format of the ypservers map, see the note in this topic.

The yppush command sends a transfer map request from the NIS server to the transfer agent on each subordinate host computer. A host's transfer agent is the utility that copies map data from the master server. When the transfer has completed, whether the transfer operation succeeded or failed, the transfer agent returns a status message, the contents of which can be printed to standard output. Transfer agents also return messages when a transfer is not possible; for example, when the yppush request is undeliverable to one or more host computers, or when the time-out period on responses from host computers has expired.

The yppush command accepts the following options and arguments:

Term | Definition
-d adNisDomain | Specifies the NIS domain. If this option is not used, the NIS domain is assumed to be the domain named in the DEFAULT_NIS_DOMAIN environment variable.
-q | Quiet mode. Does not wait for a response from subordinate servers, and does not report errors.
-t timeout | Specifies a time-out value, in seconds, that yppush will wait for a response from the subordinate server. This value must be greater than zero. The default value is 30 seconds.
-h host[...] | The name of the host to notify of the map change. You can specify multiple host names, separated by spaces. If you do not specify this option, the notification is sent to all subordinate servers in the domain.
Note

Keys within the ypservers map are the ASCII names of the computers on which the NIS servers run. That is, the ypservers map should contain a list of NIS servers, each one listed on a separate line. If your ypservers map contains aliases, edit the ypservers map to contain only the host names of the servers, one per line. The following list is an example of a valid ypservers map:

ypserver_1
ypserver_2
ypserver_3


ypmatch

ypmatch

NAME

ypmatch - Windows command-line utility to display the values of one or more keys from a Network Information Service (NIS) map

SYNOPSIS

ypmatch [-k] [-t] [-d domain] [-h nisServer] key[...] mapname
ypmatch -x

DESCRIPTION

The ypmatch(1w) Windows command-line utility displays the values one or more keys from the Network Information Service (NIS) map specified by mapname, which may be a map name or a map nickname.

The ypmatch command accepts the following options and arguments:

-k
Displays map keys. This option is useful with maps in which the values are null or the key is not part of the value.

-t
Inhibits map nickname translation.

-d domain
Specifies the NIS domain. If this option is not used, the NIS domain is assumed to be the domain named in the DEFAULT_NIS_DOMAIN environment variable.

-h nisServer
Specifies the name of the NIS server. If this option is not used, the NIS server is assumed to be the server named in the NIS_SERVER environment variable. If NIS_SERVER is not set, ypmatch broadcasts the request.

key
The key for which you want to display the value. To display the value of more than one key, specify the keys separated by spaces. If any key begins with a slash mark (/), backslash (\) or hyphen (-), these special characters must be preceded by a backslash (\). For example, if the key name is \mykey, then use \\mykey.

-x
Displays the map nickname translation table.


ypcat

ypcat

NAME

ypcat - Windows command-line utility to print values of all keys in an NIS map

SYNOPSIS

ypcat [-k] [-t] [-h nisServer] [-d domain] mapname
ypcat -x

DESCRIPTION

The ypcat(1w) Windows command-line utility prints the values of all keys from the Network Information Service (NIS) database specified by mapname, which can be a map name or a map nickname.

The ypcat command accepts the following options and arguments:

Term | Definition
-k | Displays map keys. This option is useful with maps in which the values are null or the key is not part of the value.
-t | Inhibits map nickname translation.
-d domain | Specifies the NIS domain. If this option is not used, the NIS domain is assumed to be the domain named in the DEFAULT_NIS_DOMAIN environment variable.
-h nisServer | Sends a request to the server name represented by the nisServer variable. The -h option broadcasts the request to all other NIS servers in the domain specified with the -d option, if no server name is provided.
-x | Displays the map nickname translation table.


nismap

nismap

NAME

nismap - Windows command-line utility to manage Network Information Service (NIS) maps

SYNOPSIS

nismap add [common_option[...]] -e "mapentry"
           [-r {yes | no}] [-c conflictfile] mapname
nismap mod [common_option[...]] -e "mapentry" -k key mapname
nismap del [common_option[...]] -k key mapname
nismap create [common_option[...]] -i fieldnum -g separator [-y] mapname

DESCRIPTION

The nismap Windows command-line utility manages the Network Information Service (NIS) map specified by mapname maintained by Server for NIS on a local computer or a remote computer. If you are logged on with an account that does not have the required privileges, you can specify the user name and password of an account that does. The specific action that nismap performs depends on the command argument you specify.

In addition to specific command arguments, nismap accepts the following common options and arguments, represented by common_option in the command synopsis:

Term | Definition
-a AD_domain | The name of the NIS domain in Active Directory. This option is not available for the create command argument.
-f logfile | Specifies the fully qualified path and name of the log file. Logged events are appended to this file. The default path and file name is %temp%\conflicts.log.
-s server | Specifies the name of the domain controller. The default is the domain controller of the domain of the computer on which the command is executed.
-u usr | Specifies the user name of the user whose credentials are to be used. It might be necessary to add the domain name to the user name in the form domain\username.
-p pword | Specifies the password of the user specified using the -u option. If you specify the -u option but omit the -p option, you are prompted for the user's password.
-h/-? | Displays usage information for the command.

The following command arguments are accepted by nismap:

Term Definition

add

Adds a map entry. The following options and arguments are used with add:

Term | Definition
-e " mapentry " | Specifies the new map entry as a string in the appropriate NIS map format. The string must be enclosed in quotation marks (" ").
-r {yes | no} | Specifies whether the existing object in Active Directory is to be replaced with this entry. The default is no.
-c conflictfile | Specifies the name of the file in which conflict information is to be recorded. If this option is not provided, a default file name is used.

mod

Modifies an existing map entry. The following options and arguments are required with mod

Term | Definition
-e "mapentry" | Specifies the replacement map entry as a string in the appropriate NIS map format. The string must be enclosed in quotation marks (" ").
-k key | Specifies the search key that identifies the map entry to be modified.

del

Deletes an existing map entry. The following option and argument are required with del:

Term | Definition
-k key | Specifies the search key that identifies the map entry to be deleted.

create

Creates a structure for a nonstandard map. The following options and arguments are required with create:

Term | Definition
-i fieldnum | Specifies the field number of the key field.
-g separator | Specifies the character that separates fields in the map.
-y | Specifies that the key is not part of the value for this map.
Note

When you use nismap to delete a user, group, or host object, only the UNIX attributes of the object are deleted from Active Directory. To delete the object from Active Directory, use the Active Directory administration tools.

Do not use nismap to change a user's password. Use net.exe or the Windows interface (CTRL+ALT+DELETE) instead. The nismap utility will fail if you change the passwd entry using the nismap mod command. This value is the encrypted string of the user's password. If you need to change the passwd entry, use ypcat(1w) or ypmatch(1w) to retrieve the user's current passwd entry and to ensure that the password field is identical.

If you try to modify a mail alias using the nismap mod command, Server for NIS adds the new alias to the original one instead of replacing it. To change the alias, first use nismap del to delete the original alias, and then use nismap add to add the modified alias.


Server for NIS Troubleshooting

Troubleshooting

What trouble are you having?

  • NIS Data Migration wizard or command-line utility completes successfully, but no maps are added to Server for NIS

  • Migration conflicts occur even though a test migration succeeded with Do Not Migrate (log only) option selected.

  • A conflict occurs while attempting to migrate more than one user with the same user identifier (UID)

  • NIS Data Migration wizard or command-line utility reports Network Information Service (NIS) name conflicts with system account

  • The ypmatch utility on an HP-UX computer fails

  • The first request to Server for NIS fails

  • Objects migrated to nonstandard containers do not appear in Active Directory Users and Computers

  • The ypcat utility sometimes displays incorrect passwd information, but ypmatch provides accurate information

  • Users with new Windows accounts created by NIS migration cannot log on to Windows and cannot log on to NIS client computers

  • A user account disabled in Active Directory is not also disabled on UNIX hosts

  • A newly migrated user is not authenticated by a UNIX client

NIS Data Migration wizard or command-line utility completes successfully, but no maps are added to Server for NIS.

Cause: The Do not migrate (log only) option was selected.

Solution: Because migration is irreversible, the Do not migrate (log only) option is the default. You can override the default when running the wizard by selecting either Overwrite or Preserve on the Manage Migration Conflicts page of the NIS Data Migration Wizard. To override the default when you are running the command-line utility to migrate instead (Nis2ad.exe), specify the -m option on the command line.

Migration conflicts occur even though a test migration succeeded with Do Not Migrate (log only) option selected.

Cause: If data conflicts in the Network Information Service (NIS) maps you are migrating, the conflict might not be reported until an actual migration is complete, because Server for NIS reports only conflicts between NIS maps and Active Directory.

Solution: Resolve the conflicts in the original NIS maps and then migrate the NIS data that was not migrated by using the nis2ad –r yes command-line option.

A conflict occurs while attempting to migrate more than one user with the same user identifier (UID).

Cause: The NIS Data Migration Wizard cannot migrate users that have the same UID. Only the first user is successfully migrated.

Solution: Make sure all users have unique UIDs before migrating NIS maps.

NIS Data Migration Wizard or command-line utility reports Network Information Service (NIS) name conflicts with system account.

Cause: A user name in NIS is identical to a reserved Windows account name. Reserved account names include such names as Network, System, Users, and Computers.

Solution: Resolve the conflict by renaming the UNIX-based account, and then remigrate the entry by using the nis2ad –r yes command-line option.

The ypmatch utility on an HP-UX computer fails.

Cause: A map contains keys in mixed case. The HP-UX operating system converts all keys to lower case before sending the NIS request. This is an issue with the HP-UX operating system that is beyond the control of Server for NIS.

Solution: Convert keys to lower case before migrating them.

The first request to Server for NIS fails.

Cause: If the number of objects migrated to Server for NIS was very large, Server for NIS can take a long time to build the map cache.

Solution: Make the request again after waiting 30 minutes or more. Subsequent requests might succeed.

Objects migrated to nonstandard containers do not appear in Active Directory Users and Computers.

Cause: Active Directory Users and Computers does not display nonstandard containers by default.

Solution: On the View menu, click Advanced Features.

The ypcat utility sometimes displays incorrect passwd information, but ypmatch provides accurate information.

Cause: Server for NIS data has not yet updated the map cache after data in Active Directory has changed. The ypcat utility takes its information from this cache; the ypmatch utility takes its information directly from Active Directory.

Solution: Decrease the refresh interval between updates to the map cache, or check that the updates have been cached immediately upon making changes in Active Directory. For more information, see Changing the frequency of map updates and Propagate changed maps now.

Users with new Windows accounts created by NIS migration cannot log on to Windows and cannot log on to NIS client computers.

Cause: To avoid exposing new accounts to misuse, the migration wizard disables the new accounts.

Solution: After completing migration, enable new accounts only when users are ready to use them. For security reasons, it is recommended that you change the password on all newly created Windows user accounts to temporary values. Notify users of the temporary passwords and instruct them to change their Windows passwords as soon as possible. Inform them of how often map changes are propagated (see Sending periodic map updates to subordinate NIS servers) so they will know when they can expect their UNIX passwords to be updated.

A user account disabled in Active Directory is not also disabled on UNIX hosts.

Cause: Windows and UNIX accounts must be disabled separately because the mechanism for doing so is fundamentally different, and the method for disabling UNIX accounts differs based on system version and administrator preference.

Solution: After disabling an account by using Active Directory Users and Groups, you must also disable or lock the corresponding UNIX account by the usual means (such as by changing the password to a value unknown to the user, by adding a special character to the user's password in the passwd file, by changing the account's login shell, or all three).

A newly-migrated user is not authenticated by a UNIX client.

Cause: Possible configuration errors on the client computer.

Solution: Perform the following troubleshooting steps for the indicated client operating system.

On a client computer running the Solaris operating system:

  • Ensure that the Windows-based computer that is running Server for NIS is added to the /etc/hosts file on the Solaris client. Then run the ypwhich command on the client and check that it shows the correct Windows-based computer.

  • Ensure that the /etc/nsswitch.conf file contains an entry similar to the following:

    passwd: files [NOTFOUND=continue] nis

  • Ensure that the user is not listed in the local passwd file.

  • Add the following to the end of the /etc/passwd file on the client computer:

    +::::::

  • Ensure that shadow files, if any, are also migrated to Server for NIS.

  • Ensure that the ypcat password command does not show X in the user's password field.

  • Ensure that the file /var/yp/securenets is configured to allow authentication from the client computer.

On a client computer running the Linux operating system

  • Ensure that the Windows server running Server for NIS has been added to the /etc/hosts file on the client computer and that the ypwhich command on the client computer correctly shows the name of the Windows-based computer.

  • Ensure that the USENIS entry in the /etc/sysconfig/authconfig is set to USENIS=yes.

  • Ensure that the nsswitch.conf file is properly configured.


Password Synchronization

Password Synchronization makes it easy for users to maintain one user name and password for Windows domains and UNIX systems, synchronizing the passwords when one of them changes.

Password Synchronization

Depending on how Password Synchronization and the UNIX servers are configured, synchronization can be one way or two way.

  • Before you begin using Password Synchronization, see Checklist: Deploying Password Synchronization.

  • For information about the Password Synchronization command-line utility, see Command-line Utility in Password Synchronization.


Overview of Password Synchronization

Understanding Password Synchronization

Password Synchronization helps integrate Windows and UNIX networks by simplifying the process of maintaining secure passwords in both environments. Users are freed of the difficulty of maintaining separate passwords for their Windows and UNIX accounts or having to remember to change the password wherever it is used. With Password Synchronization, whenever a user's password is changed on a Windows-based computer or domain, the password can also be automatically changed on every UNIX host on which the user has an account. Password Synchronization can also be configured to change the user's Windows password automatically when the user's UNIX password is changed.

This enables you to administer passwords from a single computer, which simplifies work for administrators as well as individual users. Password Synchronization is also flexible: administrators can exclude specific users and computers from synchronization. Password Synchronization can synchronize passwords on stand-alone Windows-based computers (such as computers running Windows 2000 Server that do not belong to a domain) or for an entire Windows-based domain. Similarly, Password Synchronization can be used to manage passwords on individual UNIX hosts or on all computers in a Network Information Service (NIS) domain.

How Password Synchronization works

Password Synchronization propagates passwords securely by transmitting only encrypted passwords over TCP/IP sockets. This eliminates the need to use nonsecure methods (such as scripts) to administer passwords remotely. Passwords are also synchronized immediately. This means that, unlike methods such as rdist, which batches password propagation, there is no appreciable delay between the time that a password is changed on one system and when it is changed on all other affected systems. This eliminates confusion and frustration for active users. Importantly, it eliminates a potential security risk if a password must be changed to block a user's access to the network. To enhance network security further, different encryption keys can be used for each Windows-based computer and UNIX host pair.

Password Synchronization is a combination of three software components:

  • The Password Synchronization service running on one or more Windows-based computers

  • The Password Synchronization daemon running on one or more UNIX computers

  • The Password Synchronization pluggable authentication module (PAM) installed on one or more UNIX computers.

When Password Synchronization is configured for Windows-to-UNIX synchronization and a password is changed on a Windows-based computer running Password Synchronization, the Password Synchronization service determines whether the user's password is to be synchronized on UNIX computers. If it is, the service encrypts the password and sends it to the Password Synchronization daemon on each computer with which the Windows-based computer is configured to be synchronized. The daemon then decrypts the password and changes the password on the UNIX host. If the UNIX host is an NIS master server and it is configured to do so, the daemon also runs make to propagate the password change throughout the NIS domain.

When Password Synchronization is configured for UNIX-to-Windows synchronization, passwords that are changed on UNIX hosts are synchronized on Windows-based computers and domains. The Password Synchronization PAM module makes this possible by intercepting the password change request on the UNIX host, encrypting the password, and then sending the password change request to the Password Synchronization service running on the Windows-based computers with which it is configured to be synchronized.


Best Practices for Password Synchronization

Best practices

  • Install Password Synchronization on appropriate domain controllers To ensure consistent synchronization of domain passwords with UNIX passwords, Password Synchronization must be installed on the primary domain controller and, in the case of a Windows 2000 domain, all domain controllers in a domain.

    • If you add a domain controller to a domain, you should install Password Synchronization on the new domain controller as soon as possible and configure it to match the other domain controllers.

    • If you need to remove Password Synchronization from any domain controller, you should demote the server to a member server before uninstalling Password Synchronization.

  • Ensure consistent password policies If you are providing only for one-way password synchronization, make sure that the password policy on the computer from which passwords will be synchronized is at least as restrictive in all areas as the policy on the computer to which passwords are synchronized. For example, if you configure Windows-to-UNIX synchronization, the Windows password policy must be at least as restrictive as the policy of the UNIX computers with which it synchronizes passwords. If you are supporting two-way synchronization, the password policies must be equally restrictive on both systems. Inconsistent password policies can result in synchronization failure when a user changes a password on the less restrictive system; or the password might be changed on the more restrictive system, even if it does not conform to the system's policies.

    Make sure that Windows users are aware of any special password restrictions on the UNIX systems with which their passwords will be synchronized. For example, some versions of UNIX support a maximum password length of eight characters. For maximum compatibility with the default Windows password policy and these UNIX limitations, passwords should be seven or eight characters long unless you are sure that all UNIX systems can support longer passwords.

  • Configure Password Synchronization to provide the maximum protection for your users' passwords

    Follow these recommendations to maintain optimal security:

    • Explicitly list the users whose passwords are to be synchronized To provide maximum control over which users can synchronize passwords, do not use the ALL keyword with the SYNC_USERS list in sso.conf on the UNIX host. Instead, you should explicitly list each user for whom password synchronization is allowed or blocked. On the Windows-based computer running Password Synchronization, create the PasswordPropAllow group and add the accounts of users whose passwords you want to synchronize. For more information, see Controlling password synchronization for user accounts.

    • Do not synchronize passwords for disabled UNIX accounts On some versions of UNIX, changing the password of a disabled user account activates that account. Consequently, if a user has a disabled account on a UNIX computer that is configured to synchronize passwords with a Windows-based computer, the user or an administrator can activate the UNIX account by changing the user's Windows password. To prevent this, use the PasswordPropDeny group to block synchronization for disabled UNIX accounts.

      Also, when an administrator disables a UNIX account, the administrator should use the SYNC_USERS entry in sso.conf to block password synchronization for the account.

    • Avoid synchronizing administrator passwords Do not synchronize passwords for members of the Windows Administrators groups or the passwords of UNIX superuser or root accounts.

    • Perform the Windows Server 2003 Service Pack 1 (SP1) compatibility check when you enable Windows to NIS (Active Directory) password synchronization in the Password Synchronization Properties dialog box, Configuration tab. To protect the security of user account passwords in your enterprise, it is strongly recommended that you allow Password Synchronization to identify all domain controllers in the forest that are not running Windows Server 2003 SP1 or later releases.

      Password Synchronization prompts you to allow the compatibility check when you select Enable in the Windows to NIS (Active Directory) password synchronization area. With Windows Server 2003 SP1, or a later release installed on all the domain controllers in a forest, the risk of exposing user password hashes to unauthorized viewers is greatly reduced. When Windows Server 2003 SP1 is not the minimum functional level of all the domain controllers in a forest, it is possible for any authenticated user on the domain to view the password hash for any UNIX user whose account has been migrated to Active Directory Domain Services (AD DS).

      In the event an unauthorized user breaks the password hash for a UNIX-based user account in AD DS, the Windows-based password for the account is no longer secure.

When Password Synchronization is installed, members of the local Administrators group and the Domain Administrators group are added to the PasswordPropDeny group, which prevents their passwords from being synchronized. If you add a user to either the Administrators or Domain Administrators group, be sure to add the user to the PasswordPropDeny group as well.

Modify the SYNC_USERS statement in the sso.conf file on all UNIX-based systems to prevent the passwords of superusers from being synchronized.

  • Do not use the default port number and encryption key Preserving the default port number and encryption key makes it possible for an attacker to set up a spoofing UNIX host to capture passwords. You should protect the port number and encryption keys used to synchronize passwords as carefully as the passwords themselves.

  • Secure the sso.conf file The sso.conf file on each UNIX host contains important configuration information that could be used to compromise security. It is recommended that you set the mode bit mask of the file to 600.

  • Ensure that the directory identified by TEMP_FILE_PATH is properly protected The temporary files created on UNIX hosts by Password Synchronization contain information that could be used by an attacker to compromise system security. For this reason, you should ensure that any directory referenced by TEMP_FILE_PATH in sso.conf has read access only for the root account and cannot be accessed by any other users.

  • Ensure log files are appropriately protected On the UNIX host, Password Synchronization uses the syslogd daemon to log messages that result from synchronization operations. The resulting logs contain such information as the names of users whose passwords are being synchronized and with which computers, propagation errors, and so on. These log files should be protected to ensure that only administrators can view them.

  • Restart the Password Synchronization daemon after changing its configuration When you make changes to the Password Synchronization daemon configuration file (sso.conf), you must stop and restart the daemon for configuration changes to take effect.

  • Configure systems to handle user name case sensitivity correctly Unless you rigorously enforce a policy to ensure that Windows and UNIX user names match in both spelling and case, verify that the CASE_IGNORE_NAME option in the sso.conf file is set to 1 (the default). UNIX user names are case sensitive; therefore, passwords might not synchronize properly if the user names do not match exactly, because the Password Synchronization daemon is unable to associate the Windows user name with the corresponding UNIX user name.

  • Make sure that password file type and name are consistent When you configure the Password Synchronization daemon, verify that the password file type (specified by USE_SHADOW) and path name (set by FILE_PATH) are appropriate for each other. For example, on most systems, if USE_SHADOW is set to 0 (to indicate that the passwd file is used for synchronization), then the FILE_PATH option should be set to /etc/passwd. However, if USE_SHADOW is set to 1 (to indicate that the shadow file is used instead), then the FILE_PATH option should be set to /etc/shadow. (On IBM AIX systems, the path and name of the shadow file is /etc/security/passwd.)


Password Synchronization Setup

In this section

  • Setting the password encryption key

  • Setting default synchronization

  • Setting the default port

  • Adding or removing computers for synchronization

  • Setting computer-specific synchronization properties

  • Setting auditing options

  • Controlling password synchronization for user accounts


Setting the password encryption key

Setting the default encryption key

Important

This setting affects the default encryption key for UNIX hosts when they are added for synchronization, as well as the port used for UNIX-to-Windows synchronization. If you change this setting, you must edit the /etc/sso.conf file to specify the same encryption key on UNIX hosts that are configured for UNIX-to-Windows password synchronization with the computer on which you complete this procedure.

To set the default encryption key

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. In the hierarchy pane, click Password Synchronization, and then do one of the following.

    • Right-click Password Synchronization, and then click Properties.

    • Click Properties in the Actions pane.

    • On the Action menu, click Properties.

  4. In the Encryption and decryption key area of the General tab, enter a key you want to use, or click Generate key to have Password Synchronization create a new key for you.

    For maximum security, you should use a key that is the maximum 21 characters in length.

  5. To save your changes, click Apply.
Note

To perform this task in the command line environment, see psadmin.

For more information about setting the password encryption key, see Password Encryption.


Setting default synchronization

Setting default synchronization

The settings in this procedure affect the default synchronization for UNIX hosts when they are added for synchronization. Settings you change in this procedure do not affect computers that have already been added for synchronization.

To set default synchronization

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. In the hierarchy pane, click Password Synchronization, and then do one of the following.

    • Right-click Password Synchronization, and then click Properties.

    • Click Properties in the Actions pane.

    • On the Action menu, click Properties.

  4. In the Direction of password synchronization area of the General tab, select the direction in which you want passwords to be synchronized.

    • To allow password synchronization from Windows-based computers to UNIX-based computers, select Windows to UNIX.

    • To allow password synchronization from UNIX-based computers to Windows-based computers, select UNIX to Windows.

  5. Click Apply to save your changes.
Note

To perform this task in the command line environment, see psadmin.


Setting the default port

Setting the default port

This setting affects the default port number for UNIX hosts when they are added for synchronization, as well as the port used for UNIX-to-Windows synchronization.

If you change this setting, you must edit the /etc/sso.conf file to specify the same port on UNIX hosts that are configured for UNIX-to-Windows password synchronization with this computer.

To set the default port

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. In the hierarchy pane, click Password Synchronization, and then do one of the following.

    • Right-click Password Synchronization, and then click Properties.

    • Click Properties in the Actions pane.

    • On the Action menu, click Properties.

  4. In the Port configuration area of the General tab, provide a new port number if needed.

    Note

    For maximum security, use a port number other than the default (6677). Before changing the default port number on a computer that is running a firewall program, check your firewall settings to verify that the firewall allows the new port number but blocks the previous port number.

  5. Click Apply.
Note

To perform this task in the command line environment, see psadmin.


Adding or removing computers for synchronization

Adding or removing computers for synchronization

In addition to adding a UNIX-based computer to the list of UNIX-based computers participating in password synchronization, if you want to change the user's password on the UNIX computer when the corresponding Windows user's password is changed, you must install the Password Synchronization single sign-on daemon (SSOD) on the UNIX-based computer. For more information, see Install the Password Synchronization daemon on UNIX-based computers.

If you want to change the Windows user's password when the corresponding UNIX-based computer user's password is changed, you must install the pluggable authentication module (PAM) on the UNIX-based computer. For more information, see Install the Password Synchronization pluggable authentication module.

Adding a computer for synchronization

To add a computer for synchronization

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. In the hierarchy pane, under the Password Synchronization node, click UNIX Computers, and then do one of the following.

    • Right-click UNIX Computers, and then click Add Computer.

    • Click Add Computer in the Actions pane.

    • On the Action menu, click Add Computer.

  4. In the Computer name text box of the Add Computer dialog box, provide the name or IP address of a UNIX-based computer.

  5. In the Direction of password synchronization area, select the direction of password synchronization for this computer.

  6. If necessary, specify a different encryption key than the default key, or click Generate key to have Password Synchronization generate a new key for synchronization with this computer.

  7. If necessary, change the port number this computer monitors for password changes. The default is 6677.

  8. Click OK.

Removing a computer from synchronization

To remove a computer from synchronization

  1. Open the Identity Management for UNIX snap-in by clicking Start, pointing to All Programs, and then clicking Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. In the hierarchy pane, under the Password Synchronization node, click UNIX Computers.

  4. In the results pane, select the UNIX-based computer that you want to remove from synchronization.

  5. With the computer selected in the results pane, do one of the following:

    • Right-click the computer, and then click Delete.

    • Click Delete in the Actions pane.

    • On the Action menu, click Delete.

  6. If you are certain you want to delete the computer from synchronization, click OK when prompted.
Note

To perform this task in the command line environment, see psadmin.


Setting computer-specific synchronization properties

Setting computer-specific synchronization properties

Before setting computer-specific synchronization properties in Password Synchronization, edit the sso.conf file on the UNIX-based computer to specify the same settings. For information about assigning computer-specific settings in the sso.conf file, see Use sso.conf to configure Password Synchronization on UNIX-based computers.

To set computer-specific synchronization properties

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. In the hierarchy pane, under the Password Synchronization node, click UNIX Computers.

  4. In the results pane, select the UNIX-based computer for which you want to configure properties.

  5. With the computer selected in the results pane, do one of the following:

    • Right-click the computer, and then click Properties.

    • Click Properties in the Actions pane.

    • On the Action menu, click Properties.

  6. On the Properties dialog box for the computer, select the direction of synchronization you want.

  7. If necessary, modify the existing password encryption key for the computer, or generate a new key.

  8. If necessary, specify a different port number that the computer monitors for password changes.

    The default port number is 6677.

  9. Click OK when your changes are complete.
Note

To perform this task in the command line environment, see psadmin.


Setting auditing options

Setting auditing options for Password Synchronization

To set auditing options for Password Synchronization

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. In the hierarchy pane, click Password Synchronization, and then do one of the following.

    • Right-click Password Synchronization, and then click Properties.

    • Click Properties in the Actions pane.

    • On the Action menu, click Properties.

  4. On the Configuration tab of the Properties dialog box, select Enable extensive logging to instruct Password Synchronization to log detailed steps of synchronization retries.

    Clear the Enable extensive logging check box if you want Password Synchronization logs to contain fewer details about synchronization attempts.

  5. Click OK.
Note

To perform this task in the command line environment, see psadmin.


Controlling password synchronization for user accounts

Controlling password synchronization for user accounts

You can control which users' passwords are synchronized by creating two local user groups: PasswordPropAllow and PasswordPropDeny. (Use Active Directory Users and Computers to create the two groups.)

In the PasswordPropAllow group, add the user names for which passwords should be synchronized. In the PasswordPropDeny group, add user names for which passwords should not be synchronized.

Passwords are synchronized for users who are in PasswordPropAllow and are not in PasswordPropDeny.

If PasswordPropAllow does not exist, the effect is the same as if it did exist with all user names in it. If PasswordPropDeny does not exist, the effect is the same as if it did exist with no user names in it.

These rules apply to synchronization from Windows to UNIX and from UNIX to Windows. If a user's password cannot be synchronized from Windows to UNIX, it cannot be synchronized from UNIX to Windows.

You can ensure that the passwords for certain users are never synchronized, even if synchronization is allowed by the Password Synchronization server. To ensure that a UNIX user account will never have its password synchronized with the Windows password, edit the sso.conf file to place the user name of the account, preceded by a minus sign (–), after SYNC_USERS=. For example, to ensure that the password of the root account is never synchronized with a Windows account by that name, make sure that the following line appears in sso.conf:

SYNC_USERS=–root

To control password synchronization for user accounts

  1. Open Active Directory Users and Computers.

    To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

    You can also open Active Directory Users and Computers from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Active Directory Users and Computers.

  2. In the hierarchy pane of the Active Directory Users and Computers snap-in, right-click Users.

  3. Point to New, and then click Group.

  4. Name the group PasswordPropAllow.

  5. In the Group scope area, select Domain local.

  6. In the Group type area, select Security.

  7. Click OK.

  8. Repeat the entire procedure through Step 7 to create a second group, but name the second group PasswordPropDeny.

  9. In the results pane, right-click the new PasswordPropAllow group, and then click Properties.

  10. On the Members tab of the PasswordPropAllow Properties dialog box, add the names of users for whom passwords should be synchronized. Click OK to close the Properties dialog box when your additions are complete.

  11. On the Members tab of the PasswordPropDeny Properties dialog box, add the names of users for whom passwords should not be synchronized. Click OK to close the Properties dialog box when your additions are complete.
Note

There is no command-line method for this procedure.

Additional references

Use sso.conf to configure Password Synchronization on UNIX-based computers


Password Synchronization Concepts

In this section

Synchronizing Passwords with an NIS Domain

Password Encryption


Synchronizing Passwords with an NIS Domain

Synchronizing passwords with an NIS domain

By using Password Synchronization, you can provide one-way (Windows-to-UNIX) and two-way password synchronization between Windows domains and Network Information Service (NIS) domains. You can do this regardless of whether the master server of the NIS domain is running a UNIX-based operating system or is a Windows-based computer running Server for NIS.

If the NIS master server is running a UNIX-based operating system, all that is required to provide one-way synchronization is to install Password Synchronization on all Windows-based computers (for example, on the domain controllers) from which you want to synchronize passwords, and then install the single sign-on daemon (SSOD) on the NIS master server. You then edit the sso.conf file on the NIS master server to do the following:

  • Set USE_NIS to 1.

  • Set NIS_UPDATE_PATH to specify the location of the NIS makefile.

This instructs the SSOD to run the makefile and push the changed maps whenever a password change request is received from the Windows domain. For more information and additional instructions, see Install the Password Synchronization daemon on UNIX-based computers.

If Server for NIS is the master server for the NIS domain, you can provide one-way password synchronization from Windows to UNIX by selecting Enable in the Windows to NIS (Active Directory) password synchronization area of the Configuration tab in the Password Synchronization Properties dialog box. Because enabling Windows to NIS (Active Directory) password synchronization can expose passwords to greater risk of unauthorized use, selecting Enable prompts you to run a compatibility check of all domain controllers in the forest, to verify that they have the minimum security features to help protect user passwords.

If you need to synchronize passwords with UNIX computers that are not part of the NIS domain, install Password Synchronization on Windows-based Active Directory Domain Services domain controllers and configure the UNIX computers as described earlier in this topic.

You can provide UNIX-to-Windows synchronization for both types of NIS domains by doing the following.

  • If the NIS master server is running a UNIX-based operating system, configure the server for one-way synchronization as described earlier in this topic.

  • Install Password Synchronization on all domain controllers. If the NIS master server is running a UNIX-based operating system, configure Password Synchronization on Windows-based servers for two-way synchronization with the master server. Finally, add each NIS client to the list of computers with which Password Synchronization works, taking care to enable UNIX-to-Windows synchronization and disable Windows-to-UNIX synchronization. Windows-to-UNIX synchronization should be enabled only for the NIS master server. For more information about adding and configuring computers, see Adding or removing computers for synchronization and Setting computer-specific synchronization properties.

  • Install the Password Synchronization pluggable authentication module (PAM) on each NIS client, and then copy the sso.conf file from the master server to the /etc directory of those clients. For more information, see Install the Password Synchronization pluggable authentication module.

  • If the NIS master server is a Windows-based computer running Server for NIS, copy Sso.cfg to one of the NIS clients, set SYNC_HOSTS to specify the computer running Server for NIS as the Windows-based computer with which to synchronize passwords, and then copy the file to the other UNIX clients. See Use sso.conf to configure Password Synchronization on UNIX-based computers to learn more about settings in this file.

  • Configure each UNIX computer to allow users to use the yppasswd command to change their passwords. To do this, replace the yppasswd binary file on the UNIX computer with a link to the passwd binary file, and then edit the /etc/nsswitch.conf file to replace the passwd and shadow lines with the following:

    passwd:  files [NOTFOUND=continue] nis
shadow:  files [NOTFOUND=continue] nis
    After you do this, when a user runs the yppasswd command to change the user's password, it is actually the passwd binary file that is run to change the password. If the user's passwd entry is not found in the local passwd and shadow files, the NIS password is changed instead.


Password Encryption

Password encryption

A Windows-based computer can send and receive updated passwords to and from a UNIX-based computer as encrypted text only. The Password Synchronization single sign-on daemon (SSOD) receives the encrypted password and decrypts it before requesting the password change on the UNIX host. Similarly, if Password Synchronization is configured to support UNIX-to-Windows synchronization, the pluggable authentication module (PAM) encrypts the password before sending it to Password Synchronization on the Windows-based computer, which then decrypts the password before requesting the password change on the Windows-based computer.

The password can be successfully decrypted only if Password Synchronization and the SSOD or PAM module use the same encryption key to encrypt and decrypt the password. Before installing the SSOD on any UNIX computer, you must first set the default encryption key. You must then specify the same key in the sso.conf file when you install the SSOD on each UNIX host. This will ensure that Password Synchronization and the SSOD on the UNIX hosts will use the same encryption key. For more information about setting the default encryption key, see Setting the password encryption key. For information about installing and configuring the SSOD, see Install the Password Synchronization daemon on UNIX-based computers.

For added security, you can specify an encryption key that is used only between a particular Windows-based computer and a UNIX host. For information about configuring Password Synchronization to use a computer-specific encryption key, see Setting computer-specific synchronization properties. For information about setting the computer-specific encryption key on the UNIX computer, see use Use sso.conf to configure Password Synchronization on UNIX-based computers.

Encryption key requirements

The encryption key must meet the following requirements:

  • It must be 16 to 21 characters long (21 is recommended).

  • It must contain characters from at least three of the following four groups:

    • Uppercase English letters (A–Z)

    • Lowercase English letters (a–z)

    • Westernized Arabic numerals (0–9)

    • Punctuation symbols ` ~ ! @ # $ % ^ & * _ – + = | \ { } [ ] : ; \ " ' < > . ?

  • It must not contain a left or right parentheses (that is a "(" or ")" character), a comma (,), or a blank space ( ).


Troubleshooting Password Synchronization

Troubleshooting

What trouble are you having?

  • User cannot log on to UNIX system after changing Windows password

  • Passwords fail to synchronize in a Windows domain, seemingly at random

  • User's password is changed on some, but not all, computers

  • Error ID 4104 is recorded in the event log for a system account, which usually has a name ending with a dollar sign ($)

  • An error message about the encryption key is recorded in Event Viewer after Password Synchronization installation completes

  • I cannot stop the single sign-on daemon (SSOD) using kill -TERM on Linux

User cannot log on to UNIX system after changing Windows password

Cause: Windows does not report a problem if an attempt to synchronize a UNIX password with a new Windows password fails.

Solution: Check the Windows event log to determine why the attempt to change the password on the UNIX system failed.

Passwords fail to synchronize in a Windows domain, seemingly at random

Cause: Password Synchronization is not configured identically on all domain controllers in the domain. As a result, if a nonconforming domain controller accepts a user's password change, it might not be able to change the password on UNIX computers.

Solution: Ensure that Password Synchronization is configured identically on all domain controllers, particularly host settings and default settings for encryption keys and ports.

User's password is changed on some, but not all, computers

Cause: Password policies are more restrictive on some computers, user names do not match between Windows and UNIX computers, or the user changed the password on a UNIX computer when two-way synchronization is not set up.

Solution: Ensure that password policies on Windows and UNIX computers that synchronize passwords are similar. Otherwise, if the user changes the password on the less restrictive computer, the more restrictive system might not accept the new password. Password policies that govern minimum and maximum length, character case and alphanumeric mix, expiration, and reuse must be as close as possible between Windows and UNIX computers that synchronize passwords. Also, Windows and UNIX system administrators must ensure that that user names, including case, are identical on the Windows and UNIX computers.

Error ID 4104 is recorded in the event log for a system account, which usually has a name ending with a dollar sign ($)

Cause: This error does not indicate a problem. It is logged when a backup domain controller or domain member server resets its secure channel with the domain. When this happens, the server password is also reset. Password Synchronization intercepts these password change requests; because they are for computer accounts rather than for user or group accounts, Password Synchronization logs error number 4104.

Solution: No corrective measures are necessary.

An error message about the encryption key is recorded in Event Viewer after Password Synchronization installation completes

Cause: This error does not indicate a problem; it is a reminder for the Password Synchronization administrator to change the default encryption key. Changing the default encryption key is a security best practice for Password Synchronization, and helps prevent unauthorized users from obtaining passwords. Typically, the description text of this error message is "Default encryption key is insecure. Please generate new encryption key." For more information about best practices, see Best Practices for Password Synchronization.

Solution: Set a new encryption key by using the procedure in the topic Setting the password encryption key.

I cannot stop the single sign-on daemon (SSOD) using kill -TERM on Linux

Cause: This is a known limitation.

Solution: Use kill 9 SSOD_PID instead.


Command-line Utility in Password Synchronization

The following command-line utility is available to administer Password Synchronization.

Command-line Utility in Password Synchronization

psadmin


psadmin

psadmin

NAME

psadmin - Windows command-line utility to manage Password Synchronization

SYNOPSIS

psadmin [computername] [common_option] [add | delete | list]
psadmin [computername] [common_option] config [config_option]

DESCRIPTION

The psadmin Windows command-line utility manages the Password Synchronization component of Identity Management for UNIX, either on a specified computer, or globally. The specific action that psadmin performs depends on the command argument you specify.

In addition to specific command arguments, psadmin accepts the following common options and arguments, represented by common_option in the command synopsis:

Term | Definition
-u username | The account name of the user whose password synchronization behavior you want to modify or view.
-p password | The password for the user account whose password synchronization behavior you want to modify or view.
-? | Displays usage information for the command.

The following configuration options are accepted by psadmin:

Term Definition

-comp name

Computer to which configuration options are applied. If -comp is unspecified, Password Synchronization modifies the default configuration settings. If -comp is the only option specified, then Password Synchronization configuration of the specified computer is displayed.

-enable direction

Specifies the direction of password synchronization. The variable direction can contain one of the following values:

WintoUnix: Synchronize password changes from computers that run Windows operating systems to computers that run UNIX operating systems.

UnixToWin: Synchronize password changes from computers that run UNIX operating systems to computers that run Windows operating systems.

BothDir: Enable two-way password synchronization.

-key keyvalue

Sets the encryption and decryption key for the computer specified by -comp. If keyvalue is random, Password Synchronization uses a random encryption key.

-port number

Sets the port number for the specified computer.

-retry number

Specifies the number of retries allowed. Because this option is a global setting, it can be used only when -comp is not used.

-interval secs

Specifies the elapsed time period, in seconds, between retries. Because this option is a global setting, it can be used only when -comp is not used.

-log [yes | no]

Enables or disables logging. Because this option is a global setting, it can be used only when -comp is not used.

-?

Displays psadmin usage and arguments.

The following command arguments are accepted by psadmin:

Term | Definition
add computername | Adds the specified computer to the list of computers participating in password synchronization.
delete computername | Deletes the specified computer from the list of computers participating in password synchronization.
list | Displays the list of computers participating in Password Synchronization.
syncSNIS [yes | no] | Enable (yes) or disable (no) automatic synchronization of passwords in the Windows to UNIX direction for all NIS accounts that have been migrated to Active Directory Domain Services (AD DS). If you add the syncSNIS parameter to the psadmin command with a "yes" value, you are prompted to perform the Windows Server 2003 Service Pack 1 (SP1) compatibility check. It is strongly recommended that you perform this check as a security best practice. For more information about the compatibility check, see Best Practices for Password Synchronization.