NIS stands for Network Information Service. It is an RPC service,
called ypserv, which is used in
conjunction with portmap and other related
services to distribute maps of usernames, passwords, and other
sensitive information to any computer claiming to be within its
domain.
An NIS server is comprised of several applications. They include
the following:
-
/usr/sbin/rpc.yppasswdd — Also
called the yppasswdd service, this daemon
allows users to change their NIS passwords.
-
/usr/sbin/rpc.ypxfrd — Also
called the ypxfrd service, this daemon is
responsible for NIS map transfers over the network.
-
/usr/sbin/yppush — This
application propagates changed NIS databases to multiple NIS
servers.
-
/usr/sbin/ypserv — This is the
NIS server daemon.
NIS is rather insecure by todays standards. It has no host
authentication mechanisms and passes all of its information over
the network unencrypted, including password hashes. As a result,
extreme care must be taken to set up a network that uses NIS.
Further complicating the situation, the default configuration of
NIS is inherently insecure.
It is recommended that anyone planning to implement an NIS
server first secure the portmap service as
outlined in Section 5.2 Securing
Portmap, then address the following issues, such as network
planning.
Because NIS passes sensitive information unencrypted over the
network, it is important the service be run behind a firewall and
on a segmented and secure network. Any time NIS information is
passed over an insecure network, it risks being intercepted.
Careful network design in these regards can help prevent severe
security breaches.
Any machine within an NIS domain can use commands to extract
information from the server without authentication, as long as the
user knows the NIS server's DNS hostname and NIS domain name.
For instance, if someone either connects a laptop computer into
the network or breaks into the network from outside (and manages to
spoof an internal IP address), the following command reveals the
/etc/passwd map:
ypcat -d <NIS_domain> -h <DNS_hostname> passwd
|
If this attacker is a root user, they can obtain the /etc/shadow file by typing the following
command:
ypcat -d <NIS_domain> -h <DNS_hostname> shadow
|
 |
Note |
| |
If Kerberos is used, the /etc/shadow
file is not stored within an NIS map.
|
To make access to NIS maps harder for an attacker, create a
random string for the DNS hostname, such as o7hfawtgmhwg.domain.com. Similarly, create a
different randomized NIS domain name. This
makes it much more difficult for an attacker to access the NIS
server.
NIS listens to all networks, if the /var/yp/securenets file is blank or does not exist
(as is the case after a default installation). One of the first
things to do is to put netmask/network pairs in the file so that
ypserv only responds to requests from the
proper network.
Below is a sample entry from a /var/yp/securenets file:
255.255.255.0 192.168.0.0
|
 |
Warning |
| |
Never start an NIS server for the first time without creating
the /var/yp/securenets file.
|
This technique does not provide protection from an IP spoofing
attack, but it does at least place limits on what networks the NIS
server services.
All of the servers related to NIS can be assigned specific ports
except for rpc.yppasswdd — the
daemon that allows users to change their login passwords. Assigning
ports to the other two NIS server daemons, rpc.ypxfrd and ypserv,
allows for the creation of firewall rules to further protect the
NIS server daemons from intruders.
To do this, add the following lines to /etc/sysconfig/network:
YPSERV_ARGS="-p 834"
YPXFRD_ARGS="-p 835"
|
The following IPTables rules can be issued to enforce which
network the server listens to for these ports:
iptables -A INPUT -p ALL -s! 192.168.0.0/24 --dport 834 -j DROP
iptables -A INPUT -p ALL -s! 192.168.0.0/24 --dport 835 -j DROP
|
 |
Tip |
| |
Refer to Chapter 7 Firewalls for
more information about implementing firewalls with IPTables
commands.
|
One of the most glaring flaws inherent when NIS is used for
authentication is that whenever a user logs into a machine, a
password hash from the /etc/shadow map is
sent over the network. If an intruder gains access to an NIS domain
and sniffs network traffic, usernames and password hashes can be
quietly collected. With enough time, a password cracking program
can guess weak passwords, and an attacker can gain access to a
valid account on the network.
Since Kerberos uses secret-key cryptography, no password hashes
are ever sent over the network, making the system far more secure.
For more about Kerberos, refer to the chapter titled Kerberos in the Red Hat
Enterprise Linux Reference Guide.
