NIS domain binding daemon
utility is the process that
maintains NIS binding information. At startup, it searches for an NIS server
responsible for serving the system's default domain (as set by the
command) using network broadcasts. Once it receives a reply, it will store the
address of the server and other information in a special file located in
. The NIS routines in the
standard C library can then use this file when processing NIS requests. There
may be several such files since it is possible for an NIS client to be bound
to more than one domain.
After a binding has been established,
will send DOMAIN_NONACK requests to the NIS server at one minute intervals. If
it fails to receive a reply to one of these requests,
assumes that the server is no longer
running and resumes its network broadcasts until another binding is
utility will also
log warning messages using the
facility each time it detects that a server has stopped responding, as well as
when it has bound to a new server.
The following options are available:
- It is possible to force
ypbind to bind
to a particular NIS server host for a given domain by using the
YPBINDPROC_SETDOM requests by default since it has no way of knowing
exactly who is sending them. Using the
-ypset flag causes
ypbind to accept YPBINDPROC_SETDOM
requests from any host. This option should only be used for diagnostic
purposes and only for limited periods since allowing arbitrary users to
reset the binding of an NIS client poses a severe security risk.
- This is similar to the
except that it only permits YPBINDPROC_SETDOM requests to be processed if
they originated from the local host.
ypbind to run in secure mode: it
will refuse to bind to any NIS server that is not running as root (i.e.,
that is not using privileged TCP ports).
- Allow the system administrator to lock
ypbind to a particular domain and group
of NIS servers. Up to ten servers can be specified. There must not be any
spaces between the commas in the domain/server specification. This option
is used to ensure that the system binds only to one domain and only to one
of the specified servers, which is useful for systems that are both NIS
servers and NIS clients: it provides a way to restrict what machines the
system can bind to without the need for specifying the
-ypsetme options, which are often
considered to be security holes. The specified servers must have valid
entries in the local /etc/hosts file.
IP addresses may be specified in place of hostnames. If
ypbind cannot make sense out of the
arguments, it will ignore the
and continue running normally.
ypbind will consider the
domainname specified with the
to be the system default domain.
ypbind to use a 'many-cast'
rather than a broadcast for choosing a server from the restricted mode
server list. In many-cast mode,
will transmit directly to the YPPROC_DOMAIN_NONACK procedure of the
servers specified in the restricted list and bind to the server that
responds the fastest. This mode of operation is useful for NIS clients on
remote subnets where no local NIS servers are available. The
-m flag can only be used in conjunction
-S flag above (if used without
-S flag, it has no effect).
utility will not make continuous
attempts to keep secondary domains bound. If a server for a secondary domain
fails to respond to a ping,
broadcast for a new server only once before giving up. If a client program
attempts to reference the unbound domain,
will try broadcasting again. By
maintain a binding for the default domain whether client programs reference it
- the files used to hold binding information for each NIS domain
- system configuration file where the system default domain and ypbind
startup options are specified
Theo de Raadt