From: kapela@prism.poly.edu (Theodore S. Kapela)
Subject: Re: Sys admin have root access to user stat
Summary: Root entry in NIS?
Organization: Polytechnic University, New York
Date: Thu, 16 Apr 92 14:24:58 GMT

In article <peterj.703408912@i4> peterj@swanee.ee.uwa.oz.au (Peter E. Jones) writes:
>williamm@zeus.swindon.rtsg.mot.com (Martin Williams) writes:
>
>>gregc@clif.ypsi.mi.us (Greg Cronau) writes:
>>>Under NIS you only have ONE master password file for ALL machines, it only
>...
>>I may be being dense here but surely if your _only_ passwd file
>>as you appear to be saying Greg, is the NIS master how do you
>>log onto a system in a situation where the NIS is not up??
>>for example Single-User ? Surely you need a local passwd
>>file for that??! :-)
>
>There's a "+" at the end of local files to mean also now read NIS maps.
>So you can have purely local users if you want or netwide ones.
>

I think we are getting a little confused.  The original thread dealt with
a grad-student working as a Sys Admin wanting (needing?) to have the
root passwd to each workstation he was responsible for.  I don't remember
what led up to it, but Greg made the note (above) about one passwd file
for all workstations.  Martin took this to mean (as I did too) that
*all* passwords (including root's) would be located in the NIS maps.  Peter
then made another comment about the meaning of a "+" at the end of the
local password file.  If there was no local password file, how can
there be a "+" at the end of it? 

A little clarification:

First, Most *nix systems will refuse to boot into multiuser if 
the local password file does not exist, or if there is not a valid
"root" entry.  Some may boot into single-user; some may stop, waiting to
be booted from an installation/maintenance tape/diskette/whatever.
I do not believe that an NIS entry for root is valid.  (If someone 
is *SUCCESSFULLY* doing this, securely, please post and prove me wrong)

Therefore, each workstation must have a local entry (IE: not NIS) for
user "root" in the local password file.  NIS shouldn't even come in here.

Now, where NIS *does* enter the picture:

(I won't discuss security considerations here, since that is a complete
discussion on its own.)

This is only one method to accomplish what the original poster wanted, and
I am making no claims as to the best method.  Since several references
have been made to having a root-id (IE: 0) entry in NIS maps, but no one
actually came out and said it, I am.

A previous posting (actually, a few of them) mentioned having more than
one entry with UID 0 in the local password file.  Instead of placing this
entry in the local file, place it in the NIS maps, and verify that all
workstations have a "+" entry in them.  This may either be the global
"+" at the end of the password file, or a "+user" entry (this is probably 
better).  This would then be the login the grad student used for root
access to the workstations.  One login.  One password.  Nothing to 
write down.  When the grad student leaves, change the entry in the
NIS maps.  One change. One place.


-- 
..............................................................................
 Theodore S. Kapela				kapela@poly.edu
 Center for Applied Large-Scale Computing	ted@{ishara|puscs}.poly.edu
 Polytechnic University