CentOS 7 NISでユーザ管理 – ユーザ登録

CentOS 7 NISサーバ、クライアントの環境が整ったのでユーザ登録を行ってみます。

CentOS 7 NISでユーザ管理 – NISサーバの設定
https://www.rootlinks.net/2016/03/23/centos-7-nisでユーザ管理-nisサーバの設定/

CentOS 7 NISでユーザ管理 – NISクライアントの設定
https://www.rootlinks.net/2016/03/24/centos-7-nisでユーザ管理-nisクライアントの設定/

1. ユーザ登録

NISサーバ側でユーザ登録を行います。

Shell

[root@host01 ~]# useradd user01 [root@host01 ~]# ll /home drwx------. 2 user01 user01 59 Mar 17 14:44 user01 [root@host01 ~]# passwd user01 Changing password for user user01. New password: BAD PASSWORD: The password is shorter than 7 characters Retype new password: passwd: all authentication tokens updated successfully.

1 2 3 4 5 6 7 8 9

[root@host01 ~]# useradd user01 [root@host01 ~]# ll /home drwx------. 2 user01   user01     59 Mar 17 14:44 user01 [root@host01 ~]# passwd user01 Changing password for user user01. New password: BAD PASSWORD: The password is shorter than 7 characters Retype new password: passwd: all authentication tokens updated successfully.

2. NISデータベースに反映
Shell

[root@host01 ~]# cd /var/yp [root@host01 yp]# make gmake[1]: Entering directory `/var/yp/rootlinks.net' Updating passwd.byname... Updating passwd.byuid... Updating group.byname... Updating group.bygid... Updating netid.byname... gmake[1]: Leaving directory `/var/yp/rootlinks.net'

1 2 3 4 5 6 7 8 9

[root@host01 ~]# cd /var/yp [root@host01 yp]# make gmake[1]: Entering directory `/var/yp/rootlinks.net' Updating passwd.byname... Updating passwd.byuid... Updating group.byname... Updating group.bygid... Updating netid.byname... gmake[1]: Leaving directory `/var/yp/rootlinks.net'

3. NISクライアントでログイン

NISクライアント側でログインします。
ローカル(host02)にuser01は存在しないのでNIS認証が行われログインが許可されます。

Shell

login as: user01 user01@host02's password: Creating directory '/home/user01'. [user01@host02 ~]$

1 2 3 4

login as: user01 user01@host02's password: Creating directory '/home/user01'. [user01@host02 ~]$

host02にはuser01のhomeが無いので最初のログインで作成されます。

4. 動作確認
• ypdomainname

NISドメインの確認

Shell

[user01@host02 ~]$ ypdomainname rootlinks.net

1 2	[user01@host02 ~]$ ypdomainname rootlinks.net

• ypwhich

NISサーバの確認

Shell

[user01@host02 ~]$ ypwhich host01.rootlinks.net

1 2	[user01@host02 ~]$ ypwhich host01.rootlinks.net

• yppasswd

ユーザによるパスワード変更

Shell

[user01@host02 ~]$ yppasswd Changing NIS account information for user01 on host01.rootlinks.net. Please enter old password: Changing NIS password for user01 on host01.rootlinks.net. Please enter new password: Please retype new password: RPC: 受け取れません The NIS password has not been changed on host01.rootlinks.net.

1 2 3 4 5 6 7 8

[user01@host02 ~]$ yppasswd Changing NIS account information for user01 on host01.rootlinks.net. Please enter old password: Changing NIS password for user01 on host01.rootlinks.net. Please enter new password: Please retype new password: RPC: 受け取れません The NIS password has not been changed on host01.rootlinks.net.

あれ!? エラーになります。どうもFirewallの影響のようです。
yppasswddのポートを許可する必要がありそうです。

NISサーバ側で/etc/sysconfig/yppasswddにyppasswddの動作ポートを836に指定します。

Shell

[root@host01 yp]# cat /etc/sysconfig/yppasswdd # The passwd and shadow files are located under the specified # directory path. rpc.yppasswdd will use these files, not /etc/passwd # and /etc/shadow. #ETCDIR=/etc # This option tells rpc.yppasswdd to use a different source file # instead of /etc/passwd # You can't mix usage of this with ETCDIR #PASSWDFILE=/etc/passwd # This option tells rpc.yppasswdd to use a different source file # instead of /etc/passwd. # You can't mix usage of this with ETCDIR #SHADOWFILE=/etc/shadow # Additional arguments passed to yppasswd YPPASSWDD_ARGS=

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

[root@host01 yp]# cat /etc/sysconfig/yppasswdd # The passwd and shadow files are located under the specified # directory path. rpc.yppasswdd will use these files, not /etc/passwd # and /etc/shadow. #ETCDIR=/etc   # This option tells rpc.yppasswdd to use a different source file # instead of /etc/passwd # You can't mix usage of this with ETCDIR #PASSWDFILE=/etc/passwd   # This option tells rpc.yppasswdd to use a different source file # instead of /etc/passwd. # You can't mix usage of this with ETCDIR #SHADOWFILE=/etc/shadow   # Additional arguments passed to yppasswd YPPASSWDD_ARGS=

Shell

[root@host01 yp]# vi /etc/sysconfig/yppasswdd

1	[root@host01 yp]# vi /etc/sysconfig/yppasswdd

Shell

[root@host01 yp]# cat /etc/sysconfig/yppasswdd # The passwd and shadow files are located under the specified # directory path. rpc.yppasswdd will use these files, not /etc/passwd # and /etc/shadow. #ETCDIR=/etc # This option tells rpc.yppasswdd to use a different source file # instead of /etc/passwd # You can't mix usage of this with ETCDIR #PASSWDFILE=/etc/passwd # This option tells rpc.yppasswdd to use a different source file # instead of /etc/passwd. # You can't mix usage of this with ETCDIR #SHADOWFILE=/etc/shadow # Additional arguments passed to yppasswd YPPASSWDD_ARGS="--port 836"

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

[root@host01 yp]# cat /etc/sysconfig/yppasswdd # The passwd and shadow files are located under the specified # directory path. rpc.yppasswdd will use these files, not /etc/passwd # and /etc/shadow. #ETCDIR=/etc   # This option tells rpc.yppasswdd to use a different source file # instead of /etc/passwd # You can't mix usage of this with ETCDIR #PASSWDFILE=/etc/passwd   # This option tells rpc.yppasswdd to use a different source file # instead of /etc/passwd. # You can't mix usage of this with ETCDIR #SHADOWFILE=/etc/shadow   # Additional arguments passed to yppasswd YPPASSWDD_ARGS="--port 836"

Firewallの設定

Shell

[root@host01 yp]# firewall-cmd --permanent --add-port=836/udp success [root@host01 yp]# firewall-cmd --reload success [root@host01 ~]# firewall-cmd --list-all public (default, active) interfaces: eno16777736 sources: services: dhcpv6-client rpc-bind ssh ports: 836/udp 834/udp 834/tcp masquerade: no forward-ports: icmp-blocks: rich rules:

1 2 3 4 5 6 7 8 9 10 11 12 13 14

[root@host01 yp]# firewall-cmd --permanent --add-port=836/udp success [root@host01 yp]# firewall-cmd --reload success [root@host01 ~]# firewall-cmd --list-all public (default, active)   interfaces: eno16777736   sources:   services: dhcpv6-client rpc-bind ssh   ports: 836/udp 834/udp 834/tcp   masquerade: no   forward-ports:   icmp-blocks:   rich rules:

NISクライアント側で再度パスワードの変更を実施してみます。

Shell

[user01@host02 ~]$ yppasswd Changing NIS account information for user01 on host01.rootlinks.net. Please enter old password: Changing NIS password for user01 on host01.rootlinks.net. Please enter new password: Please retype new password: The NIS password has been changed on host01.rootlinks.net.

1 2 3 4 5 6 7 8

[user01@host02 ~]$ yppasswd Changing NIS account information for user01 on host01.rootlinks.net. Please enter old password: Changing NIS password for user01 on host01.rootlinks.net. Please enter new password: Please retype new password:   The NIS password has been changed on host01.rootlinks.net.

変更できました。

• ypchfn

GECOSフィールドの変更です。

Shell

[user01@host02 ~]$ ypchfn Changing NIS account information for user01 on host01.rootlinks.net. Please enter password: Changing full name for user01 on host01.rootlinks.net. To accept the default, simply press return. To enter an empty field, type the word "none". Name []: Guest User01 Location []: RootLinks Office Phone []: Home Phone []: Error while changing the GECOS information. The GECOS information has not been changed on host01.rootlinks.net.

1 2 3 4 5 6 7 8 9 10 11 12 13

[user01@host02 ~]$ ypchfn Changing NIS account information for user01 on host01.rootlinks.net. Please enter password:   Changing full name for user01 on host01.rootlinks.net. To accept the default, simply press return. To enter an empty field, type the word "none". Name []: Guest User01 Location []: RootLinks Office Phone []: Home Phone []: Error while changing the GECOS information. The GECOS information has not been changed on host01.rootlinks.net.

またまたエラーです。調べたら明示的にypchfn,ypchshの機能を有効にする必要がありました。
NISサーバ側で”-e chsh -e chfn”の設定を追加します。

Shell

[root@host01 ~]# vi /etc/sysconfig/yppasswdd [root@host01 ~]# cat /etc/sysconfig/yppasswdd # The passwd and shadow files are located under the specified # directory path. rpc.yppasswdd will use these files, not /etc/passwd # and /etc/shadow. #ETCDIR=/etc # This option tells rpc.yppasswdd to use a different source file # instead of /etc/passwd # You can't mix usage of this with ETCDIR #PASSWDFILE=/etc/passwd # This option tells rpc.yppasswdd to use a different source file # instead of /etc/passwd. # You can't mix usage of this with ETCDIR #SHADOWFILE=/etc/shadow # Additional arguments passed to yppasswd YPPASSWDD_ARGS="--port 836 -e chsh -e chfn" [root@host01 ~]# systemctl restart yppasswdd

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

[root@host01 ~]# vi /etc/sysconfig/yppasswdd [root@host01 ~]# cat /etc/sysconfig/yppasswdd # The passwd and shadow files are located under the specified # directory path. rpc.yppasswdd will use these files, not /etc/passwd # and /etc/shadow. #ETCDIR=/etc   # This option tells rpc.yppasswdd to use a different source file # instead of /etc/passwd # You can't mix usage of this with ETCDIR #PASSWDFILE=/etc/passwd   # This option tells rpc.yppasswdd to use a different source file # instead of /etc/passwd. # You can't mix usage of this with ETCDIR #SHADOWFILE=/etc/shadow   # Additional arguments passed to yppasswd YPPASSWDD_ARGS="--port 836 -e chsh -e chfn" [root@host01 ~]# systemctl restart yppasswdd

NISクライアント側で再度ypchfnを実行してみます。

Shell

[user01@host02 ~]$ ypchfn Changing NIS account information for user01 on host01.rootlinks.net. Please enter password: Changing full name for user01 on host01.rootlinks.net. To accept the default, simply press return. To enter an empty field, type the word "none". Name []: Guest User01 Location []: RootLinks Office Phone []: Home Phone []: The GECOS information has been changed on host01.rootlinks.net. [user01@host02 ~]$ finger Login Name Tty Idle Login Time Office Office Phone Host root root pts/1 Mar 15 22:30 (192.168.1.2) user01 Guest User01 pts/0 Mar 15 21:56 RootLinks (192.168.1.2)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

[user01@host02 ~]$ ypchfn Changing NIS account information for user01 on host01.rootlinks.net. Please enter password:   Changing full name for user01 on host01.rootlinks.net. To accept the default, simply press return. To enter an empty field, type the word "none". Name []: Guest User01 Location []: RootLinks Office Phone []: Home Phone []:   The GECOS information has been changed on host01.rootlinks.net.   [user01@host02 ~]$ finger Login     Name           Tty      Idle  Login Time   Office     Office Phone   Host root      root           pts/1          Mar 15 22:30                           (192.168.1.2) user01    Guest User01   pts/0          Mar 15 21:56 RootLinks                 (192.168.1.2)

• ypchsh

ユーザのログインシェルを変更します。

Shell

[user01@host02 ~]$ ypchsh Changing NIS account information for user01 on host01.rootlinks.net. Please enter password: Changing login shell for user01 on host01.rootlinks.net. To accept the default, simply press return. To use the system's default shell, type the word "none". Login shell [/bin/bash]: /bin/sh The login shell has been changed on host01.rootlinks.net.

1 2 3 4 5 6 7 8 9 10

[user01@host02 ~]$ ypchsh Changing NIS account information for user01 on host01.rootlinks.net. Please enter password:   Changing login shell for user01 on host01.rootlinks.net. To accept the default, simply press return. To use the system's default shell, type the word "none". Login shell [/bin/bash]: /bin/sh   The login shell has been changed on host01.rootlinks.net.

ユーザがパスワードを忘れてログイン出来なくなった場合はNISサーバ側でリセットしてNISデータベースに反映させればログインできるようになります。

しかしパスワードの複雑チェックでデフォルトだとここまでやるんですね。
BAD PASSWORD: The password fails the dictionary check – it is based on a dictionary word
これって辞書攻撃にヤバイよってことですよね(^^;