How to make a group of machines using one machine's users access control?

[zishuai]

I found many labs did this.But I don't know how to make it .
That is to say there is one machine controling all the users in the lab. So after creating my account, I can use any machine in the lab.
Please tell me what did they do?
Thanks.

[slacker_x]

I think it's usually done on unix systems with NIS. I could be wrong though since I've never done it myself. I think you can also use LDAP. Windows networks have domain controllers that authenticate logons

[Craig McPherson]

The old school way, and the way that you'll probably find the most documentation on, is NIS (Network Information Service, also known as YP, Yellow Page service). You create user accounts in a NIS map on one machine, and run a NIS server on that machine. On the other machines, you configure them to authenticate users over NIS if a user isn't listed in their local passwd file, and set it up to use the NIS server.

There are simpler ways than using NIS, which is a somewhat complex and rather dated protocol. One option is to simply use rcp, scp, ftp, or sneakernet to distribute new copies of the passwd and shadow files whenever they change. You add a user on the server, and then you copy its passwd and shadow files to all the other machines. You can set up scripts to do this, or set up cron jobs on the server to "push" the files to all the other computers every hour or every day, or set up cron jobs on the clients to "pull" the files from the servers.

The protocol of the future is LDAP. It's meant as a replacement for NIS, as well as a lot of other things. There's not a wealth of user-friendly LDAP documentation in the world at the moment, but it'd be a smart move to try to learn it.

[zishuai]

Thank you two very much.
But I still have a question. In the labs, I found they seemed to use NFS. For instance, they use a shared /home directory as a NFS.
Is that true?
If I only use NIS or LDAP, the home directories on different computers differ from each other?
Thank you.

[slacker_x]

that is completely different than authentication. NFS allows the user to have the same home directory on every computer because the directory is mounted from the server.

[ 20 September 2001: Message edited by: slacker_x ]

[Craig McPherson]

NFS and NIS are often considered siblings, because in a way, they work hand-in-hand. NFS is useless without some way of making sure you have the same set of user accounts on each system, and NIS is the most common way of doing that (except on very small networks). That's not to say that NFS requires NIS in order to work: any way of keeping user accounts in sync will work, including NIS, LDAP, manually syncing password files, using scripts to push/pull password files, etc. And NIS and LDAP certainly don't require NFS to function: NIS is just concerned with user authenetication, and LDAP can be used for everything from user authentication to e-mail address books to keeping a catalog of your rubber band collection.

O'Reilly has a book called "Managing NFS and NIS" (or possibly "Managing NIS and NFS", not that it matters much) that covers the two protocols in great detail. The fact that a new edition of the book hasn't been published in a long, long time indicates that the two protocols are on the decline into obscurity (okay, I just noticed that O'Reilly just did publish a new edition after 10 years, but I stand by the rest of what I said). NIS is going to be driven into the ground by LDAP (LDAP can be used not only for UNIX authentication, but also for SAMBA authentication, and I think even Microsoft's Active Directory uses LDAP for certain things), and NFS is also fading away without a clear successor. Now that hard drives are cheap, NFS is generally no longer used for exporting entire /usr filesystems; it's mainly used just for home directories, and even that seems to be on the decline.

[slacker_x]

Craig:
If the home directory isn't being exported via NFS, then how are the users settings stored for multiple machines?

[Craig McPherson]

Originally posted by slacker_x:
<STRONG>Craig:
If the home directory isn't being exported via NFS, then how are the users settings stored for multiple machines?</STRONG>

For the most part, they're not. UNIX has taken something of a dive in terms of multiuser workstation systems. Where UNIX thrives now is on servers, on standalone systems for techies, and in "appliance systems", none of which really call for home directory sharing. At sites that still do use UNIX workstations, many just don't bother with shared home directories anymore. Certainly there are still plenty of old-school UNIX shops left, but there aren't as many as there used to be.

[slayer17]

The way we do it is with NFS and cron jobs like craig stated. We custom install a machine with just a local root and /usr and swap. Then we mount /home and others with NFS and cron passwd new or updated every hour. This way you can login to any machine and have your local setting and home dir at that machine. Works great. NIS is a *****.