[Samba] Any downsides to using MS Services for Unix NIS server?

[Andrew Bartlett]

On Sat, 2005-12-03 at 23:57 -0800, SAMBA wrote:
> Other than NIS is extremely insecure, and anyone concerned with security
> would not use it.  If you are using SFU, just use LDAP/Kerberos instead
> of NIS.  You'll get the same results, but with more security.

The main issues with NIS security (compared with unsigned LDAP
connections) is that passwords my be present in the tables.  This isn't
the case with the AD implementation anyway (I think you would need to
use Kerberos authentication, as there are no NIS compatible passwords in
AD, to my knowlege).  

> You don't have to use IDMAP to have GID/UID based on SID.  You can
> manually enter it yourself as per design you're your network.  Also
> check out PADL NSS/PAM modules.  There's also I think some scripts for
> automating migration from NIS to LDAP.

In Samba, IDMAP is the plugin interface for assigning the UID/GID
mappings, and can be backed onto many sources, including attributes in
the AD LDAP server (that would be used by the SFU 3.5 NIS server).

> -----Original Message-----
> From: samba-bounces+letz_samba=realmspace.com at lists.samba.org
> [mailto:samba-bounces+letz_samba=realmspace.com at lists.samba.org] On
> Behalf Of Jim Hatfield
> Sent: Friday, November 25, 2005 2:51 AM
> To: samba at lists.samba.org
> Subject: [Samba] Any downsides to using MS Services for Unix NIS server?
> 
> I have both an AD domain and an existing NIS setup, and would like
> to merge the accounts. It would seem from reading the help files
> that installing Services for Unix on my domain controllers and using
> the AD-integrated NIS server would work well. I wouldn't need to use
> winbind, and I would have not only consistent but predictable ID
> mapping, ie I can ensure that INTERNAL\jhatfield maps to UID 115,
> which is what it is on the existing NIS server.
> 
> Are there any downsides to doing this - it seems much simpler than
> deploying winbind that I feel there must be a catch!

I think you should be able to use winbindd, which assists with windows
clients (which expect SIDs), while still maintaining your centralised
mapping.  See idmap_ad.

Andrew Bartlett

-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Student Network Administrator, Hawker College  http://hawkerc.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/samba/attachments/20051204/89cff9a0/attachment.bin