Problems w/NIS Clients in Compat Mode

I have (3) RHEL machines - (2) are RHEL3-I386 and other is RHEL4-AMD64. I'm using OpenAFS for authentication and using NIS to push out the password maps (no /etc/shadow). I'm using NIS compat mode, using netgroups to specify user account access to each machine.

Here is the /etc/nsswitch.conf I'm using on the RHEL3 machines:

passwd: compat
shadow: compat
group: compat
hosts: files nis dns

I'm trying the same thing on the RHEL4 machine, but I can't login or even su to another user as root. 'getent passwd' shows all of the proper user ID's and 'groups username' brings up the proper NIS groups. 'su - username' returns "incorrect password".

I get can around this problem by creating local users with locked-out passwords. The problem with this is that they expire, causing the system to ask to change it (I don't want any local passwords). I'm specifically using NIS because it won't expire passwords; this is being controlled on the OpenAFS server side.

If I only had Linux machines I'd switch to LDAP in a heartbeat, but that's just not realistic at this point. I just can't figure out what RHEL4 did that RHEL3 didn't.

BTW - selinux is installed but disabled.

Doug
.

Relevant Pages

  • Re: How to remove users "only" on NIS database?
    ... In the beginning hashed passwords were in the /etc/passwd file. ... that information over the network. ... Therefore with NIS the shadow file is made available. ... won't have local root. ...
    (Debian-User)
  • Re: Security Configuration Settings?
    ... First I will answer your question about `compat' issue, ... can find other things related to Sun Solaris security. ... and + (include everything, except excluded users, from NIS passwd.byname). ...
    (Focus-SUN)
  • Re: Security Configuration Settings?
    ... > The compat setting allows you to add an extra pseudo database called ... > them up in LDAP. ... Of course, if you're using NIS, put nis as the keyword. ... > Subject: Security Configuration Settings? ...
    (Focus-SUN)
  • Re: Sparc Solaris NIS client Linux NIS server
    ... >> I'll check over the nsswitch.conf and verify that its right. ... >> insecurities with NIS. ... If "shadow" passwords are enabled properly, ... once I get the authentication working I will ...
    (comp.os.linux.setup)
  • Re: authentication question
    ... NIS has several problems. ... their passwords in the clear. ... in this case, though as when windows clients send encrypted passwords, ... > and have everything else authenticate off that. ...
    (RedHat)