multihost master.passwd sync
Michael Collette
metrol at metrol.net
Tue May 27 12:11:04 PDT 2003
On Tuesday 27 May 2003 12:04 pm, Eric Anderson wrote:
> Michael Collette wrote:
> > On Tuesday 27 May 2003 11:30 am, Andy Harrison wrote:
>
> [..snip..]
>
> >>>NIS [yp(8)] ?
> >>
> >>Lord no... even if you setup a backup nis server, an ailing master
> >> server can really screw up your day.
> >>
> >>I think I thought of a solution though. root cronjob to pgp encrypt the
> >>file, change perms so that it can be accessed by a user that is allowed
> >> to copy the file to the target host. The file is in encrypted using the
> >> public key of root the target machine, so only root on the target will
> >> be able to pgp extract the file.
> >
> > Why not just preconfigure SSH keys between the boxes and scp the file
> > across? Seems like a lot of extra work to bring PGP into the mix.
> >
> > Personally, I'm real curious about utilizing an LDAP backend to replace
> > NIS. Read a bit about it, but haven't had a chance to play with it just
> > yet. It sounds like a far more elegant solution for what you're looking
> > to do as well. Assuming it all works as advertised that is.
>
> I've started this exact process - replacing my NIS gunk with LDAP.. Not
> too far through yet, but I'll try to keep good notes for anyone else who
> may want them..
>
> Eric
FYI, O'Reilley has a fairly new book out concerning this topic. I've only
scratched the surface of it thus far, but it's the best I've seen on this
topic thus far. I was doing some real serious shopping for an LDAP book a
couple of months ago.
Anyhow, what I'm talking about...
http://www.oreilly.com/catalog/ldapsa/
Later on,
--
"Always listen to experts. They'll tell you what can't be done, and why.
Then do it."
- Robert A. Heinlein
More information about the freebsd-security
mailing list