Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have some systems which currently use Likewise Open to integrate into an AD environment, but this creates UIDs/GIDs which are not compatible with the Unix UIDs/GIDs which some other systems use.

One suggestion has been to use the central AD as an LDAP and Kerberos server, and to have local information on the users and groups (with the correct UIDs/GIDs) shared out with NIS.

Since the NIS server would then not be giving out any password hashes, would this still be terribly insecure?

(I understand that NIS doesn't do host authentication, and the information travels over the wire unencrypted, but since this information is essentially public within this network I don't see those as problems in this case)

share|improve this question

1 Answer 1

up vote 1 down vote accepted

There are still a good number of shops out there using NIS in this fashion, and even more using unencrypted LDAP. Whether it is acceptable or not is a function of your local security policy and the degree to which you trust the other protections on your network. For what it's worth I think it sounds fine for a controlled environment.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.