YP (NIS)

Synopsis #

YP (Yellow Pages), also known as NIS (Network Information Service), is a simple protocol for sharing configuration databases such as user accounts, group memberships, and hostnames across a trusted local network. OpenBSD includes support for both YP servers and clients in the base system.

YP is not the same as LDAP:

• YP is an older, RPC-based system developed by Sun Microsystems.
• LDAP (Lightweight Directory Access Protocol) is a modern, extensible protocol standardized in RFC 4511.
• OpenBSD includes YP and the ldapd(8) LDAP server in the base system.

YP is best suited for small, trusted networks where simplicity is valued over flexibility or cryptographic security. LDAP offers a richer schema model, encryption, and fine-grained access control, and is generally preferred in larger or more security-sensitive environments.

This chapter explains how to configure OpenBSD as a YP master, YP slave, or YP client.

YP Master Server Configuration #

The YP master server maintains the authoritative copy of all YP maps (databases). These maps are generated from files in /etc and served to clients and slave servers.

The required daemons are:

• portmap(8) : RPC port mapper
• ypserv(8) : YP service daemon
• ypbind(8) : Binds the master to a YP server for client operations

Enabling Required Services #

Set the YP domain before initializing the server or starting the YP daemons. The YP domain is separate from the DNS domain. Store it in /etc/defaultdomain for boot and apply it immediately with domainname(1) :

printf '%s\n' exampledomain | doas tee /etc/defaultdomain
doas domainname exampledomain

Initialize the master with ypinit(8) :

doas ypinit -m

The script uses the configured YP domain and prompts for the list of servers. The local master is included automatically. Enter any slave hostnames, one per line, then press Ctrl-D to finish the list and confirm it. With no slaves, press Ctrl-D at the first host prompt.

Enable and start the services after initialization has created /var/yp/exampledomain:

doas rcctl enable portmap ypserv ypbind
doas rcctl start portmap
doas rcctl start ypserv
doas rcctl start ypbind

Map Creation and Regeneration #

The YP maps are built from standard system files using Makefiles. The default source directory is /etc; the DIR variable in /var/yp/exampledomain/Makefile selects it. See Makefile.yp(8) for map settings and the user and group ID ranges included in the maps.

After initialization, build the maps. Use the same commands to regenerate all maps after changing the source files:

cd /var/yp
doas make

The Makefile processes standard maps such as passwd.byname, group.byname, hosts.byname, etc.

To regenerate the password maps:

cd /var/yp
doas make passwd

YP Slave Server Configuration #

Slave servers receive map updates from the master using ypxfr(8) .

Set the same YP domain on the slave before initializing it:

printf '%s\n' exampledomain | doas tee /etc/defaultdomain
doas domainname exampledomain
doas ypinit -s yp-master.example.net

Replace yp-master.example.net with the reachable master hostname. Initialization copies its maps to the slave.

Enable and start required daemons:

doas rcctl enable portmap ypserv ypbind
doas rcctl start portmap
doas rcctl start ypserv
doas rcctl start ypbind

On the master, add the slave to the ypservers map if it was not included during initialization, then reload ypserv so that it reads the updated server list before the next map push:

doas ypinit -u
doas rcctl reload ypserv

The ypservers map is stored in /var/yp/exampledomain/ypservers.db and identifies servers for map distribution; it is not an access control list. Server access restrictions are described in ypserv(8) .

To fetch a map immediately on the slave:

doas ypxfr passwd.byname

YP Client Configuration #

Clients use ypbind(8) to bind to a running YP server and request maps.

Setting the Domain #

Ensure /etc/defaultdomain contains the correct YP domain:

printf '%s\n' exampledomain | doas tee /etc/defaultdomain

Apply immediately:

doas domainname exampledomain

Enabling the Client #

The server list /etc/yp/exampledomain can restrict ypbind(8) to specified servers. This is recommended instead of broadcast discovery. Create /etc/yp if needed and place one server hostname per line in the file. These names must be resolvable without YP, for example through DNS or /etc/hosts.

Enable and start portmap and ypbind:

doas rcctl enable portmap ypbind
doas rcctl start portmap
doas rcctl start ypbind

Verifying Client Operation #

Use ypwhich(1) to confirm which server is being used:

ypwhich

Example output:

yp-master.example.net

To list available maps:

ypwhich -m

Use ypcat(1) to dump a map and ypmatch(1) to query a key. Replace alice with a user included in the map; default map settings exclude system accounts such as root:

ypcat passwd.byname
ypmatch alice passwd.byname

Enabling YP User and Group Lookups #

OpenBSD does not use /etc/nsswitch.conf for these lookups. Enable YP user inclusion through the password database as documented in passwd(5) . Run vipw(8) :

doas vipw

Add the following entry after the local accounts in /etc/master.passwd:

+:*::::::::

On saving, vipw checks the file and rebuilds the password databases and /etc/passwd. Do not edit the generated /etc/passwd directly.

To include YP groups, edit /etc/group with doas vi /etc/group and add this final line, as described in group(5) :

+:*::

These entries include all users and groups from the corresponding maps. The manuals also describe selecting or excluding individual entries. Exclusions must precede the inclusions they restrict. Group membership requires consistent group.byname, group.bygid, and netid.byname maps.

Before enabling YP group lookups, configure netid(5) entries for local accounts that must remain usable when YP is unavailable. A local password entry alone does not prevent login from waiting for unavailable YP group information.

Logging In with YP Accounts #

Users from YP maps can log in normally. Check that they have home directories and suitable login shells. If home directories are exported over NFS or provisioned on demand, this must be handled separately.

Verify a YP account through the system lookup routines:

id alice

To list users in the password map:

ypcat passwd.byname | cut -d: -f1

Security Considerations #

YP does not encrypt its network traffic, including transmitted password hashes. For this reason:

• OpenBSD uses master.passwd.byname and master.passwd.byuid for full password records. Clearing UNSECURE in the domain Makefile excludes hashes from the public passwd.* maps when they are rebuilt; it does not encrypt YP traffic. See Makefile.yp(8) for compatibility details.
• Restrict server selection with /etc/yp/exampledomain, and limit server access using ypserv(8) , pf(4) , and network segmentation.
• Do not run YP over untrusted or public networks.

SSH protects login traffic but does not protect YP queries between clients and servers.

Key Files and Tools #