Links To or From Table Entries Do Not Work
You cannot use the nisln command (or any other command) to create links between entries in tables. NIS+ commands do not follow links at the entry level.
NIS+ Ownership and Permission Problems
This section describes problems related to user ownership and permissions. Common symptoms include:
Error messages with operative clauses such as:
Unable to stat NIS+ directory name
Another Symptom:
User or root unable to perform any namespace task.
No Permission
The most common permission problem is the simplest: you have not been granted permission to perform some task that you try to do. Use niscat -o on the object in question to determine what permissions you have. If you need additional permission, you, the owner of the object, or the system administrator can either change the permission requirements of the object (as described in Chapter 15, Administering NIS+ Access Rights,) or add you to a group that does have the required permissions (as described in Chapter 17, Administering NIS+ Groups).
No Credentials
Without proper credentials for you and your machine, many operations will fail. Use nismatch on your home domain's cred table to make sure you have the right credentials. See "Corrupted Credentials" for more on credentials-related problems.
Server Running at Security Level 0
A server running at security level 0 does not create or maintain credentials for NIS+ principals.
If you try to use passwd on a server that is running at security level 0, you will get the error message: You name do not have secure RPC credentials in NIS+ domain domainname.
Security level 0 is only to be used by administrators for initial namespace setup and testing purposes. Level 0 should not be used in any environment where ordinary users are active.
User Login Same as Machine Name
A user cannot have the same login ID as a machine name. When a machine is given the same name as a user (or vice versa), the first principal can no longer perform operations requiring secure permissions because the second principal's key has overwritten the first principal's key in the cred table. In addition, the second principal now has whatever permissions were granted to the first principal.
For example, suppose a user with the login name of saladin is granted namespace read-only permissions. Then a machine named saladin is added to the domain. The user saladin will no longer be able to perform any namespace operations requiring any sort of permission, and the root user of the machine saladin will only have read-only permission in the namespace.
Symptoms:
The user or machine gets "permission denied" type error messages.
Either the user or root for that machine cannot successfully run keylogin.
Security exception on LOCAL system. UNABLE TO MAKE REQUEST. error message.
If the first principal did not have read access, the second principal might not be able to view otherwise visible objects.
Note - When running nisclient or nisaddcred, if the message Changing Key is displayed rather than Adding Key, there is a duplicate user or host name already in existence in that domain.
Diagnosis:
Run nismatch to find the host and user in the hosts and passwd tables to see if there are identical host names and user names in the respective tables:
nismatch username passwd.org_dir |
Then run nismatch on the domain's cred table to see what type of credentials are provided for the duplicate host or user name. If there are both LOCAL and DES credentials, the cred table entry is for the user; if there is only a DES credential, the entry is for the machine.
Solution:
Change the machine name. (It is better to change the machine name than to change the user name.) Then delete the machine's entry from the cred table and use nisclient to reinitialize the machine as an NIS+ client. (If you wish, you can use nistbladm to create an alias for the machine's old name in the hosts tables.) If necessary, replace the user's credentials in the cred table.
Bad Credentials
NIS+ Security Problems
This section describes common password, credential, encryption, and other security-related problems.
Security Problem Symptoms
Error messages with operative clauses such as:
Password [problems]
User or root unable to perform any namespace operations or tasks. (See also "NIS+ Ownership and Permission Problems".)