1995-04-09 23:59:06 +02:00
|
|
|
.\" Copyright (c) 1991, 1993, 1995
|
|
|
|
|
.\" The Regents of the University of California. All rights reserved.
|
|
|
|
|
.\"
|
|
|
|
|
.\" Redistribution and use in source and binary forms, with or without
|
|
|
|
|
.\" modification, are permitted provided that the following conditions
|
|
|
|
|
.\" are met:
|
|
|
|
|
.\" 1. Redistributions of source code must retain the above copyright
|
|
|
|
|
.\" notice, this list of conditions and the following disclaimer.
|
|
|
|
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
|
.\" notice, this list of conditions and the following disclaimer in the
|
|
|
|
|
.\" documentation and/or other materials provided with the distribution.
|
|
|
|
|
.\" 3. All advertising materials mentioning features or use of this software
|
|
|
|
|
.\" must display the following acknowledgement:
|
|
|
|
|
.\" This product includes software developed by the University of
|
|
|
|
|
.\" California, Berkeley and its contributors.
|
|
|
|
|
.\" 4. Neither the name of the University nor the names of its contributors
|
|
|
|
|
.\" may be used to endorse or promote products derived from this software
|
|
|
|
|
.\" without specific prior written permission.
|
|
|
|
|
.\"
|
|
|
|
|
.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
|
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
|
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
|
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
|
|
|
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
|
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
|
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
|
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
|
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
|
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
|
.\" SUCH DAMAGE.
|
|
|
|
|
.\"
|
1995-07-21 00:33:02 +02:00
|
|
|
.\" $Id: ypbind.8,v 1.2 1995/04/26 19:03:15 wpaul Exp $
|
1995-04-09 23:59:06 +02:00
|
|
|
.\"
|
|
|
|
|
.Dd April 9, 1995
|
|
|
|
|
.Dt YPBIND 8
|
|
|
|
|
.Os
|
|
|
|
|
.Sh NAME
|
|
|
|
|
.Nm ypbind
|
|
|
|
|
.Nd "NIS domain binding daemon"
|
|
|
|
|
.Sh SYNOPSIS
|
|
|
|
|
.Nm ypbind
|
|
|
|
|
.Op Fl ypset
|
|
|
|
|
.Op Fl ypsetme
|
|
|
|
|
.Op Fl s
|
1995-07-21 00:33:02 +02:00
|
|
|
.Op Fl S Ar domainname,server1,server2,...
|
1995-04-09 23:59:06 +02:00
|
|
|
.Sh DESCRIPTION
|
|
|
|
|
.Nm ypbind
|
|
|
|
|
is the process that maintains NIS binding information. At startup,
|
|
|
|
|
it searches for an NIS server responsible for serving the system's
|
|
|
|
|
default domain (as set by the
|
|
|
|
|
.Xr domainname 1
|
ypbind.c: Major overhaul.
- Moved to a more client-driven model. We aggressively attempt to keep
the default domain bound (as before) but we give up on non-default
domains if we lose contact with a server and fail to get a response
after one round of broadcasting. This helps drastically reduce the
amount of network bandwitdh that ypbind consumes: if a client references
the secondary domain at some later point, this will prod ypbind into
establishing a new binding anyway, so continuously broadcasting without
need is pointless.
Note that we still actively seek out a binding for our default domain
even if no client program has queried us yet. I'm not exactly sure if
this matches SunOS's behavior or not, but I decided to do it this way
since we can get into all sorts of trouble if our default domain comes
unbound. Even so, we're still much quieter than we used to be.
- Removed a bunch of no-longer pertinent comments and a couple of
chunks of #ifdef 0'ed code that no longer fit in to the new layout.
- Theo deRaadt must have become frustrated with the callback mechanism
in clnt_broadcast(), because he shamelessly stole the clnt_broadcast()
code right out of the RPC library and hacked it up to suit his needs.
(Comments and all! :)
I can understand why: clnt_broadcast() blocks while awaiting replies.
Changing this behavior requires surgery. However, you can work around
this: fork the broadcast into a child process and relay the results
back to the parent via a pipe. (Careful obervation has shown that the
SunOS ypbind forks children for broadcasting too, though I can only
guess what sort of interprocess communication it uses. pipe() seems to
do the job well enough.)
This may seem like the long way around, but it's not really that
hard to implement, and I'd prefer to use documented RPC library functions
wherever possible. We're careful to limit the number of simultaneous
broadcasters to avoid swamping the system (the current limit is 5).
Each clnt_broadcast() call only sends out a small number of packets
at increasing intervals. We're also careful not to spawn more than one
bradcaster for a given domain.
- Used clntudp_bufcreate() and clnt_call() to implement a ping()
function for directly querying a particular server so that we can
check if it's still alive. This lets me completely remove the old
bradcasting code and use actual RPC library calls instead, at the
cost of more than a few handfulls of torn-out hair. (Make no mistake
folks: I *HATE* RPC.) Currently, the ping interval is one minute.
- Fixed another potential 'nfds too big for select()' bug: use
_rpc_dtablesize() instead of getdtablesize().
- Quieted gcc -Wall a bit.
- Probably a bunch of other stuff that I've forgotten.
ypbind.8:
- Updated man page to reflect modifications.
ypwhich.c:
- Small mind-o fix from last time: decode error results from
ypbind correctly (*groan*)
yplib.c:
- same as above
- Change behavior of _yp_dobind() a little: if we get back a 'Domain
not bound' error for a given domain, retry a few times before giving
up and passing the error back to the caller. We have to sleep for a
few seconds between tries since the 'Domain not bound' error comes
back immediately (by repeatedly looping, we end up pounding on ypbind).
We retry at most 20 times at 5 second intervals. This gives us a full
minute to get a response. This seems to deviate a bit from SunOS
behavior -- it appears to wait forever -- but I don't like the idea
of perpetually hanging inside a library call.
Note that this should fix the problems some people have with bindings
not being established fast enough at boot time; sometimes amd is started
in /etc/rc after ypbind has run but before it gets a binding set up. The
automounter gets annoyed at this and tends to exit. By pausing ther YP
calls until a binding is ready, we avoid this situation.
- Another _yp_dobind() change: if we determine that our binding files
are unlocked or nonexistent, jump directly to code that pokes ypbind
into restablishing the binding. Again, if it fails, we'll time out
eventually and return.
1995-04-26 21:03:16 +02:00
|
|
|
command) using network broadcasts.
|
|
|
|
|
Once it receives a reply,
|
1995-04-09 23:59:06 +02:00
|
|
|
it will store the address of the server and other
|
|
|
|
|
information in a special file located in
|
|
|
|
|
.Pa /var/yp/binding .
|
|
|
|
|
The NIS routines in the standard C library can then use this file
|
|
|
|
|
when processing NIS requests. There may be several such files
|
|
|
|
|
since it is possible for an NIS client to be bound to more than
|
|
|
|
|
one domain.
|
|
|
|
|
.Pp
|
|
|
|
|
After a binding has been established,
|
|
|
|
|
.Nm ypbind
|
|
|
|
|
will send DOMAIN_NONACK requests to the NIS server at one minute
|
|
|
|
|
intervals. If it fails to receive a reply to one of these requests
|
|
|
|
|
.Nm ypbind
|
ypbind.c: Major overhaul.
- Moved to a more client-driven model. We aggressively attempt to keep
the default domain bound (as before) but we give up on non-default
domains if we lose contact with a server and fail to get a response
after one round of broadcasting. This helps drastically reduce the
amount of network bandwitdh that ypbind consumes: if a client references
the secondary domain at some later point, this will prod ypbind into
establishing a new binding anyway, so continuously broadcasting without
need is pointless.
Note that we still actively seek out a binding for our default domain
even if no client program has queried us yet. I'm not exactly sure if
this matches SunOS's behavior or not, but I decided to do it this way
since we can get into all sorts of trouble if our default domain comes
unbound. Even so, we're still much quieter than we used to be.
- Removed a bunch of no-longer pertinent comments and a couple of
chunks of #ifdef 0'ed code that no longer fit in to the new layout.
- Theo deRaadt must have become frustrated with the callback mechanism
in clnt_broadcast(), because he shamelessly stole the clnt_broadcast()
code right out of the RPC library and hacked it up to suit his needs.
(Comments and all! :)
I can understand why: clnt_broadcast() blocks while awaiting replies.
Changing this behavior requires surgery. However, you can work around
this: fork the broadcast into a child process and relay the results
back to the parent via a pipe. (Careful obervation has shown that the
SunOS ypbind forks children for broadcasting too, though I can only
guess what sort of interprocess communication it uses. pipe() seems to
do the job well enough.)
This may seem like the long way around, but it's not really that
hard to implement, and I'd prefer to use documented RPC library functions
wherever possible. We're careful to limit the number of simultaneous
broadcasters to avoid swamping the system (the current limit is 5).
Each clnt_broadcast() call only sends out a small number of packets
at increasing intervals. We're also careful not to spawn more than one
bradcaster for a given domain.
- Used clntudp_bufcreate() and clnt_call() to implement a ping()
function for directly querying a particular server so that we can
check if it's still alive. This lets me completely remove the old
bradcasting code and use actual RPC library calls instead, at the
cost of more than a few handfulls of torn-out hair. (Make no mistake
folks: I *HATE* RPC.) Currently, the ping interval is one minute.
- Fixed another potential 'nfds too big for select()' bug: use
_rpc_dtablesize() instead of getdtablesize().
- Quieted gcc -Wall a bit.
- Probably a bunch of other stuff that I've forgotten.
ypbind.8:
- Updated man page to reflect modifications.
ypwhich.c:
- Small mind-o fix from last time: decode error results from
ypbind correctly (*groan*)
yplib.c:
- same as above
- Change behavior of _yp_dobind() a little: if we get back a 'Domain
not bound' error for a given domain, retry a few times before giving
up and passing the error back to the caller. We have to sleep for a
few seconds between tries since the 'Domain not bound' error comes
back immediately (by repeatedly looping, we end up pounding on ypbind).
We retry at most 20 times at 5 second intervals. This gives us a full
minute to get a response. This seems to deviate a bit from SunOS
behavior -- it appears to wait forever -- but I don't like the idea
of perpetually hanging inside a library call.
Note that this should fix the problems some people have with bindings
not being established fast enough at boot time; sometimes amd is started
in /etc/rc after ypbind has run but before it gets a binding set up. The
automounter gets annoyed at this and tends to exit. By pausing ther YP
calls until a binding is ready, we avoid this situation.
- Another _yp_dobind() change: if we determine that our binding files
are unlocked or nonexistent, jump directly to code that pokes ypbind
into restablishing the binding. Again, if it fails, we'll time out
eventually and return.
1995-04-26 21:03:16 +02:00
|
|
|
assumes that the server is no longer running and resumes its network
|
1995-04-09 23:59:06 +02:00
|
|
|
broadcasts until another binding is established.
|
|
|
|
|
.Nm ypbind
|
|
|
|
|
will also log warning messages using the syslog(3) facility each time
|
|
|
|
|
it detects that a server has stopped responding, as well as when it
|
|
|
|
|
has bound to a new server.
|
|
|
|
|
.Pp
|
|
|
|
|
.Sh OPTIONS
|
|
|
|
|
The following options are supported by
|
|
|
|
|
.Nm ypbind :
|
|
|
|
|
.Bl -tag -width flag
|
|
|
|
|
.It Fl ypset
|
|
|
|
|
It is possible to force
|
|
|
|
|
.Nm ypbind
|
|
|
|
|
to bind to a particular NIS server host for a given domain by using the
|
|
|
|
|
.Xr ypset 8
|
|
|
|
|
command. However,
|
|
|
|
|
.Nm ypbind
|
|
|
|
|
refuses YPBINDPROC_SETDOM requests by default since it has no way of
|
|
|
|
|
knowing exactly who is sending them. Using the
|
|
|
|
|
.Fl ypset
|
|
|
|
|
flag causes
|
|
|
|
|
.Nm ypbind
|
|
|
|
|
to accept YPBINDPROC_SETDOM requests from any host. This option should only
|
|
|
|
|
be used for diagnostic purposes and only for limited periods since allowing
|
ypbind.c: Major overhaul.
- Moved to a more client-driven model. We aggressively attempt to keep
the default domain bound (as before) but we give up on non-default
domains if we lose contact with a server and fail to get a response
after one round of broadcasting. This helps drastically reduce the
amount of network bandwitdh that ypbind consumes: if a client references
the secondary domain at some later point, this will prod ypbind into
establishing a new binding anyway, so continuously broadcasting without
need is pointless.
Note that we still actively seek out a binding for our default domain
even if no client program has queried us yet. I'm not exactly sure if
this matches SunOS's behavior or not, but I decided to do it this way
since we can get into all sorts of trouble if our default domain comes
unbound. Even so, we're still much quieter than we used to be.
- Removed a bunch of no-longer pertinent comments and a couple of
chunks of #ifdef 0'ed code that no longer fit in to the new layout.
- Theo deRaadt must have become frustrated with the callback mechanism
in clnt_broadcast(), because he shamelessly stole the clnt_broadcast()
code right out of the RPC library and hacked it up to suit his needs.
(Comments and all! :)
I can understand why: clnt_broadcast() blocks while awaiting replies.
Changing this behavior requires surgery. However, you can work around
this: fork the broadcast into a child process and relay the results
back to the parent via a pipe. (Careful obervation has shown that the
SunOS ypbind forks children for broadcasting too, though I can only
guess what sort of interprocess communication it uses. pipe() seems to
do the job well enough.)
This may seem like the long way around, but it's not really that
hard to implement, and I'd prefer to use documented RPC library functions
wherever possible. We're careful to limit the number of simultaneous
broadcasters to avoid swamping the system (the current limit is 5).
Each clnt_broadcast() call only sends out a small number of packets
at increasing intervals. We're also careful not to spawn more than one
bradcaster for a given domain.
- Used clntudp_bufcreate() and clnt_call() to implement a ping()
function for directly querying a particular server so that we can
check if it's still alive. This lets me completely remove the old
bradcasting code and use actual RPC library calls instead, at the
cost of more than a few handfulls of torn-out hair. (Make no mistake
folks: I *HATE* RPC.) Currently, the ping interval is one minute.
- Fixed another potential 'nfds too big for select()' bug: use
_rpc_dtablesize() instead of getdtablesize().
- Quieted gcc -Wall a bit.
- Probably a bunch of other stuff that I've forgotten.
ypbind.8:
- Updated man page to reflect modifications.
ypwhich.c:
- Small mind-o fix from last time: decode error results from
ypbind correctly (*groan*)
yplib.c:
- same as above
- Change behavior of _yp_dobind() a little: if we get back a 'Domain
not bound' error for a given domain, retry a few times before giving
up and passing the error back to the caller. We have to sleep for a
few seconds between tries since the 'Domain not bound' error comes
back immediately (by repeatedly looping, we end up pounding on ypbind).
We retry at most 20 times at 5 second intervals. This gives us a full
minute to get a response. This seems to deviate a bit from SunOS
behavior -- it appears to wait forever -- but I don't like the idea
of perpetually hanging inside a library call.
Note that this should fix the problems some people have with bindings
not being established fast enough at boot time; sometimes amd is started
in /etc/rc after ypbind has run but before it gets a binding set up. The
automounter gets annoyed at this and tends to exit. By pausing ther YP
calls until a binding is ready, we avoid this situation.
- Another _yp_dobind() change: if we determine that our binding files
are unlocked or nonexistent, jump directly to code that pokes ypbind
into restablishing the binding. Again, if it fails, we'll time out
eventually and return.
1995-04-26 21:03:16 +02:00
|
|
|
arbitrary users to reset the binding of an NIS client poses a severe
|
1995-04-09 23:59:06 +02:00
|
|
|
security risk.
|
|
|
|
|
.It Fl ypsetme
|
|
|
|
|
This is similar to the
|
|
|
|
|
.Fl ypset
|
|
|
|
|
flag, except that it only permits YPBINDPROC_SETDOM requests to be processed
|
|
|
|
|
if they originated from the local host.
|
|
|
|
|
.It Fl s
|
|
|
|
|
The
|
|
|
|
|
.Fl s
|
|
|
|
|
flag causes
|
|
|
|
|
.Nm ypbind
|
|
|
|
|
to run in secure mode: it will refuse to bind to any NIS server
|
|
|
|
|
that is not running as root (i.e. that is not using privileged
|
|
|
|
|
TCP ports).
|
1995-07-21 00:33:02 +02:00
|
|
|
.It Fl S Ar domainname,server1,server2,server3,...
|
|
|
|
|
The
|
|
|
|
|
.Fl S
|
|
|
|
|
flag allows the system administrator to lock ypbind to a particular
|
|
|
|
|
domain and group of NIS servers. Up to ten servers can be specified.
|
|
|
|
|
There must not be any spaces between the commas in the domain/server
|
|
|
|
|
specification. This option is used to insure that that the system binds
|
|
|
|
|
only to one domain and only to one of the specified servers, which
|
|
|
|
|
is useful for systems that are both NIS servers and NIS
|
|
|
|
|
clients: it provides a way to restrict what machines the system can
|
|
|
|
|
bind to without the need for specifying the
|
|
|
|
|
.Fl ypset
|
|
|
|
|
or
|
|
|
|
|
.Fl ypsetme
|
|
|
|
|
options, which are often considered to be security holes. The specified
|
|
|
|
|
servers must have valid entries in the local
|
|
|
|
|
.Pa /etc/hosts
|
|
|
|
|
file. IP addresses may be specified in place of hostnames. If
|
|
|
|
|
.Nm ypbind
|
|
|
|
|
can't make sense ouf of the arguments, it will ignore
|
|
|
|
|
the
|
|
|
|
|
.Fl S
|
|
|
|
|
flag and continue running normally.
|
|
|
|
|
.Pp
|
|
|
|
|
Note that
|
|
|
|
|
.Nm ypbind
|
|
|
|
|
will consider the domainname specified with the
|
|
|
|
|
.Fl S
|
|
|
|
|
flag to be the system default domain.
|
ypbind.c: Major overhaul.
- Moved to a more client-driven model. We aggressively attempt to keep
the default domain bound (as before) but we give up on non-default
domains if we lose contact with a server and fail to get a response
after one round of broadcasting. This helps drastically reduce the
amount of network bandwitdh that ypbind consumes: if a client references
the secondary domain at some later point, this will prod ypbind into
establishing a new binding anyway, so continuously broadcasting without
need is pointless.
Note that we still actively seek out a binding for our default domain
even if no client program has queried us yet. I'm not exactly sure if
this matches SunOS's behavior or not, but I decided to do it this way
since we can get into all sorts of trouble if our default domain comes
unbound. Even so, we're still much quieter than we used to be.
- Removed a bunch of no-longer pertinent comments and a couple of
chunks of #ifdef 0'ed code that no longer fit in to the new layout.
- Theo deRaadt must have become frustrated with the callback mechanism
in clnt_broadcast(), because he shamelessly stole the clnt_broadcast()
code right out of the RPC library and hacked it up to suit his needs.
(Comments and all! :)
I can understand why: clnt_broadcast() blocks while awaiting replies.
Changing this behavior requires surgery. However, you can work around
this: fork the broadcast into a child process and relay the results
back to the parent via a pipe. (Careful obervation has shown that the
SunOS ypbind forks children for broadcasting too, though I can only
guess what sort of interprocess communication it uses. pipe() seems to
do the job well enough.)
This may seem like the long way around, but it's not really that
hard to implement, and I'd prefer to use documented RPC library functions
wherever possible. We're careful to limit the number of simultaneous
broadcasters to avoid swamping the system (the current limit is 5).
Each clnt_broadcast() call only sends out a small number of packets
at increasing intervals. We're also careful not to spawn more than one
bradcaster for a given domain.
- Used clntudp_bufcreate() and clnt_call() to implement a ping()
function for directly querying a particular server so that we can
check if it's still alive. This lets me completely remove the old
bradcasting code and use actual RPC library calls instead, at the
cost of more than a few handfulls of torn-out hair. (Make no mistake
folks: I *HATE* RPC.) Currently, the ping interval is one minute.
- Fixed another potential 'nfds too big for select()' bug: use
_rpc_dtablesize() instead of getdtablesize().
- Quieted gcc -Wall a bit.
- Probably a bunch of other stuff that I've forgotten.
ypbind.8:
- Updated man page to reflect modifications.
ypwhich.c:
- Small mind-o fix from last time: decode error results from
ypbind correctly (*groan*)
yplib.c:
- same as above
- Change behavior of _yp_dobind() a little: if we get back a 'Domain
not bound' error for a given domain, retry a few times before giving
up and passing the error back to the caller. We have to sleep for a
few seconds between tries since the 'Domain not bound' error comes
back immediately (by repeatedly looping, we end up pounding on ypbind).
We retry at most 20 times at 5 second intervals. This gives us a full
minute to get a response. This seems to deviate a bit from SunOS
behavior -- it appears to wait forever -- but I don't like the idea
of perpetually hanging inside a library call.
Note that this should fix the problems some people have with bindings
not being established fast enough at boot time; sometimes amd is started
in /etc/rc after ypbind has run but before it gets a binding set up. The
automounter gets annoyed at this and tends to exit. By pausing ther YP
calls until a binding is ready, we avoid this situation.
- Another _yp_dobind() change: if we determine that our binding files
are unlocked or nonexistent, jump directly to code that pokes ypbind
into restablishing the binding. Again, if it fails, we'll time out
eventually and return.
1995-04-26 21:03:16 +02:00
|
|
|
.Sh NOTES
|
|
|
|
|
.Nm ypbind
|
|
|
|
|
will not make continuous attempts to keep secondary domains bound.
|
|
|
|
|
If a server for a second dary domain fails to respond to a ping,
|
|
|
|
|
.Nm ypbind
|
|
|
|
|
will broadcast for a new server only once before giving up. If a
|
|
|
|
|
client program attempts to reference the unbound domain, ypbind will
|
|
|
|
|
try broadcasting again. By contrast,
|
|
|
|
|
.Nm ypbind
|
|
|
|
|
will automatically maintain a binding for the default domain whether
|
|
|
|
|
client programs reference it ot not.
|
1995-04-09 23:59:06 +02:00
|
|
|
.Sh FILES
|
|
|
|
|
.Bl -tag -width Pa -compact
|
|
|
|
|
.It Pa /var/yp/binding/[domainname].[version]
|
|
|
|
|
The files used to hold binding information for each NIS domain.
|
1995-07-21 00:33:02 +02:00
|
|
|
.It Pa /etc/sysconfig
|
|
|
|
|
System configuration file where the system default domain and
|
|
|
|
|
ypbind startup options are specified.
|
1995-04-09 23:59:06 +02:00
|
|
|
.El
|
|
|
|
|
.Sh SEE ALSO
|
|
|
|
|
.Xr syslog 3 ,
|
|
|
|
|
.Xr domainname 1 ,
|
|
|
|
|
.Xr ypserv 8 ,
|
|
|
|
|
.Xr ypset 8 ,
|
|
|
|
|
.Xr yp 8
|
|
|
|
|
.Sh AUTHOR
|
|
|
|
|
Theo de Raadt <deraadt@fsa.ca>
|