Subject: Re: [NetBSD] NIS secure maps and password cipher
To: None <netbsd-help@NetBSD.org>
From: Chuck Yerkes <chuck+nbsd@2003.snew.com>
List: netbsd-help
Date: 07/22/2003 01:13:05
Quoting Fonz (avwerven@liacs.nl):
> According to the manpages, NetBSD supports secure NIS maps. However, the
> Free- and OpenBSD manpages claim that only them two support it. So, does
> NetBSD mean something else by secure NIS maps, or are the Free- and Open-
> BSD manuals outdated?
>
> For another thing, I'd like my NetBSD machines to be NIS clients to a
> server running OpenBSD. As such, the NIS passwords are encrypted with
> Blowfish rather than MD5. Is there an easy way to tell NetBSD to use
> Blowfish for password encryption?
Saying "NIS" and "Secure" in the same sentence just makes me
shudder a bit.
NIS throws passwords around a network; you find NIS servers
by broadcasting to the LAN; I've dealt with hosts binding to
machines that USED to be servers and had old maps.
If the client could be 100% sure that it's talking to who it
thinks it's talking, and the server would only send information
to machine's it's 100% sure are the clients, and the data
across the network was strongly encrypted, then I'd go for
it.
So I go for Kerberos. It was designed for machines on untrusted LANs.
A reasonable alternative is a secure (SSL of IPSec) connection
to LDAP - which scales better and is of more use.