Annotation of wikisrc/tutorials/how_to_set_up_nfs_and_nis.mdwn, revision 1.7

1.2       schmonz     1: **Contents**
                      2: 
                      3: [[!toc]]
                      4: 
                      5: #  Introduction 
                      6: 
                      7: This little article will try to make sense of the jungle that is NFS and NIS. For our example we will use NFS for keeping /home on a server, allowing us to work on the same files in our homedir from any computer in the network. 
                      8: 
                      9:   
                     10: 
                     11: 
                     12: #  NIS 
                     13: 
                     14: NIS (Network Information Service) is a directory system which is used to centralise configuration files like /etc/hosts and /etc/passwd. By using NIS for passwd, you can have the same users on each host in the network without the hassle of keeping the passwd file of all hosts synchronised. 
                     15: 
                     16: We will need NIS (or another directory service) to make sure the NFS user ids/group ids are the same on the server as on all clients. Otherwise, bad things will happen, as you can probably imagine (especially in our example of mounting /home over NFS). Note that using NIS with NFS is not mandatory, you can also keep the server and client's passwd in synch. 
                     17: 
1.5       plunky     18: NIS used to be called the "Yellow Pages", or YP for short. Because of trademarks it had to be renamed, but the programs are all still prefixed with `yp`. 
1.2       schmonz    19: 
                     20:   
                     21: 
                     22: 
                     23: #  Kernel options 
                     24: 
                     25: Before doing anything with NFS, ensure that your kernel has support for NFS sharing. This means your clients and servers must have NFS kernel support enabled. This is the case for GENERIC Kernels. For custom Kernels, the following lines must be in the kernel file: 
                     26:     
                     27:      file-system     NFS             # Network File System client
                     28:     
                     29: 
                     30: Your server also must have the following option: 
                     31:     
                     32:      options         NFSSERVER       # Network File System server
                     33:     
                     34: 
                     35: If you want to get funky and boot from NFS (not discussed in this article), your clients need these options as well: 
                     36:     
                     37:      options         NFS_BOOT_DHCP,NFS_BOOT_BOOTPARAM
                     38:     
                     39: 
                     40: #  Creating a NIS setup 
                     41: 
                     42: The first thing we should do is decide on a NIS domain name. This has nothing to do with your machine's Internet domain name. It is just a unique name that is used to identify machines in the same NIS block. 
                     43: 
1.7     ! kim        44: The domainname is set (as root) using the [[!template id=man name="domainname" section="1"]] program, or can be set in the /etc/mydomain file.   
1.5       plunky     45: Alternatively, in most BSD systems, it can be set in /etc/rc.conf under the variable `domainname`. 
1.2       schmonz    46:     
                     47: 
                     48:  root@earth# domainname planets
                     49:     
                     50: 
                     51:   
                     52: After this, we must initialise all files needed for the server to do its work. For this, we use the ypinit utility. 
                     53:     
                     54:      root@earth# ypinit -m
                     55:     
                     56: 
                     57: The -m means we are creating a master server. On more complex networks, you can even want slave servers. The tool will ask you for a list of YP servers to bind to.   
                     58: Since we're only using one server, just press RETURN (make sure your own server's internal address is in the list). 
                     59: 
1.5       plunky     60: Before we run `make` in /var/yp, as the tool says, we must enable the NIS daemons: rpcbind, ypserv and ypbind (in that order). After that, we can run `make` in /var/yp. 
1.2       schmonz    61: 
                     62: To test if your setup is working, try yptest. It should spew out the passwd file among others, so don't panic ;) 
                     63: 
                     64: To get stuff working on your client, you need to enable the yppasswdd, rpcbind and ypbind daemons as well. In order to do that, edit the /etc/rc.conf file and add there following: 
                     65:     
                     66:     #NIS server
                     67:     ypserv="YES"
                     68:     ypbind="YES"
                     69:     yppasswdd="YES"
                     70:     rpcbind="YES"
                     71:     
                     72: 
                     73: Then just run 
                     74:     
                     75:     # /etc/rc.d/rpcbind start
                     76:     # /etc/rc.d/ypserv start
                     77:     # /etc/rc.d/ypbind start
                     78:     # /etc/rc.d/yppasswdd start
                     79:     
                     80: 
1.7     ! kim        81: [[!template id=man name="rpc.yppasswdd" section="8"]] must be running on the NIS master server to allow users to change information in the password file.   
        !            82: [[!template id=man name="ypserv" section="8"]] provides information from NIS maps to the NIS clients on the network.   
        !            83: [[!template id=man name="ypbind" section="8"]] finds the server for a particular NIS domain and stores information about it in a "binding file".
1.2       schmonz    84: 
                     85: After that, you can use ypinit: 
                     86:     
                     87:      root@mars# ypinit -c
                     88:     
                     89: 
                     90: Then, add your NIS server's address to the list. To test if everything is working, use yptest on the client as well. **Note that ypbind will HANG if it can't find the server!**
                     91: 
1.5       plunky     92: If everything is working, you are ready to go! Just edit /etc/nsswitch.conf and put in some `nis` keywords. For example: 
1.2       schmonz    93:     
                     94:      passwd:           files nis
                     95:     
                     96: 
                     97: would first look up usernames/passwords/uids in /etc/passwd, and if it can't find it, it would look it up using NIS. Right after changing this file, you should be able to log in on your system using a username which is only in /etc/passwd on the server. That's all there is to it. 
                     98: 
1.4       plunky     99: #  The daemons 
1.2       schmonz   100: 
                    101: What are all those daemons for? Well, here's a quick rundown: 
                    102: 
                    103: Portmap/rpcbind is the program which maps RPC (Remote Procedure Call) program numbers to port numbers (hence, portmapper). Any program which wishes to know on what port a certain RPC program is listening can ask this from the portmapper daemon (rpcbind). Each RPC service has its own number, which can be looked up in /etc/rpc. These numbers are how rpcbind can match the running RPC services to the ports. In short: If rpcbind is not running, not a single RPC program will work. 
                    104: 
                    105: Ypserv is an authentication daemon for the RPC services, I believe. Ypbind is the daemon which can find the YP server for the specified domain. 
                    106: 
                    107:   
                    108: 
                    109: 
                    110: #  NFS 
                    111: 
                    112: Setting up NFS is a piece of cake. Just enter all directories you wish to export in /etc/exports and start the NFS daemon. In our example we would have: 
                    113:     
                    114:      /home             -network 192.168.0.0 -mask 255.255.0.0 -maproot=root
                    115:     
                    116: 
1.4       plunky    117: This exports /home only on the LAN 192.168.x.x. The maproot line is needed, because otherwise the client's root will not have superuser access. Now, start the mount daemon and the NFS daemons (mountd and nfsd) as root on your server, in that order. For that type: 
1.2       schmonz   118:     
1.3       riastrad  119:      root@mars# /etc/rc.d/rpcbind onestart
                    120:      root@mars# /etc/rc.d/mountd onestart
                    121:      root@mars# /etc/rc.d/nfsd onestart
                    122:      root@mars# /etc/rc.d/nfslocking onestart
1.2       schmonz   123:     
                    124: 
                    125: If you wish to start the NFS server on boot, add following lines to your /etc/rc.conf 
                    126:     
                    127:     nfs_server=yes
                    128:     rpcbind=yes
                    129:     mountd=${nfs_server}
                    130:     lockd=${nfs_server}
                    131:     statd=${nfs_server}
                    132:     
                    133: 
                    134: Now, try to mount from the client and type: 
                    135:     
                    136:      root@mars # mount -t nfs earth:/home /home
                    137:     
                    138: 
                    139: Voila, you're done. Just add all NFS volumes you want to mount to your /etc/fstab like this 
                    140:     
                    141:      earth:/home   /home    nfs   rw
                    142:     
                    143: 
                    144: and have them mounted at system startup. 
                    145: 
1.5       plunky    146: NOTE: I had much trouble with NFS which was caused by UDP packet fragmentation. This made all writes extremely slow (and other outgoing network traffic as well!) while reads were at an acceptable speed. To solve this, I added the (undocumented?) `tcp` option to fstab to mount NFS over TCP. You'll probably also need to add 
1.2       schmonz   147:     
                    148:     nfsd_flags='-t'
                    149:     
                    150: 
                    151: to rc.conf so the NFS server serves up TCP exports. 
                    152: 
                    153: If you just want to run NFS, you need to run the following daemons on your server: rpcbind, mountd, nfsd (in that order) 
                    154: 
                    155: #  Notes 
                    156: 
                    157: #  Concerning NFS 
                    158: 
                    159: If you find NFS is not suitable for you, you could try Coda. The Coda filesystem tries to overcome some of the drawbacks of NFS: 
                    160: 
                    161:   * Handling of (sudden) disconnections 
                    162:   * Its own authentication system 
                    163: 
                    164: And some others. The latest NFS versions are of course trying to integrate some of Coda's features as well. 
                    165: 
                    166:   
                    167: 
                    168: 
                    169: #  Concerning NIS 
                    170: 
                    171: A disadvantage of NIS is that it is not very secure. If security is a big concern, have a look at LDAP and NIS+, which are more complex directory services. For networks where security isn't that important (like most home networks), NIS will do. It is also much easier to set up than NIS+ or LDAP. 
                    172: 
                    173: On NetBSD (probably on other systems as well), the NIS server consults /etc/hosts.allow and /etc/hosts.deny (from Wietse Venema's tcpwrappers package) to determine if the requesting host is allowed to access the NIS directory. This can help you in securing NIS a little. 
                    174: 
                    175: My /etc/hosts.deny looks like this: 
                    176:     
                    177:      ypserv: ALL
                    178:      rpcbind: ALL
                    179:      ypbind: ALL
                    180:      nfsd: ALL
                    181:     
                    182: 
                    183: In my /etc/hosts.allow I have my LAN hosts. 
                    184: 
                    185:   
                    186: 
                    187: 
                    188: #  References 
                    189: 
                    190:   * O'Reilly's Managing NFS and NIS, 2nd Edition 
                    191:   * [Linux NFS howto](http://nfs.sourceforge.net/nfs-howto)
                    192:   * [The CODA project](http://www.coda.cs.cmu.edu/)
                    193:   * [The good old NetBSD Guide](http://www.netbsd.org/Documentation/#Guide)
                    194:   * [Replacing NIS with Kerberos and LDAP howto](http://www.ofb.net/~jheiss/krbldap/howto.html)
                    195: 
                    196: 
                    197: #  See also 
                    198: 
1.7     ! kim       199:   * [[!template id=man name="mount_nfs" section="8"]] manpage 
1.2       schmonz   200: 
                    201: 

CVSweb for NetBSD wikisrc <wikimaster@NetBSD.org> software: FreeBSD-CVSweb