Hi everyone,
I'm no NIS expert and I came accross a serious security hole in an environment running NIS for linux machines. Users in this environment own their machines, meaning the have root access and manage their boxes themselves. However, they are nis clients. If they become root on their own machines they can sudo to any nis user account. Is there anyway to prevent this? We can not take away the users root access because they will complain that it is their box and they want root access (I know, it's a sorry situation).
Is it possible to force password authentication even from root for nis users?

It seems this goes against *nix rules of root access but I'm hoping someone else has encountered this and has a work around.

The ideal situation would be:
1 - users have their own boxes with their own root access.
2 - they are nis clients
3 - user can su - to his/her nis user account ONLY by using password authentication.


Thanks in advance.

The root user can do anything on a *nix system. In the environment that you describe, the only way to prevent the system owners from using /bin/su - to access the NIS user would be to remove their root privileges.

Thanks for the reply jhphilput. So I've decided to remove NIS access to the users. The work around is that they can keep there box have root access to it with the exception that they create the same account (with the same uid and gid as on the nis environment). This allows them to access the mount points and keeps permissions/owners the same. Now I need to read up on the best way to secure the already existing nis environment and prevent anyone from joining it. Any suggestions?

I haven't worked a lot with NIS, but the last time I worked with it the paper at this site: http://www.sans.org/reading_room/whi...sadmin/107.php was helpful. The paper itself is out of date at this point, but it may still give you some useful information.

Thanks a lot! The document is definitely helpful.