ypmake.conf(5)

NAME
ypmake.conf - configuration file for ypmake

SYNOPSIS
/var/yp/ypmake.conf

DESCRIPTION
The ypmake.conf file can be used to tailor the NIS map generation process on a per-domain basis. In this file, you can specify alternative source files, special file protection modes for individual maps, and instruct ypmake how to generate additional maps.

The file is organized in several sections, one for each domain. The start of a section is signalled by the domain keyword, followed by the name of the NIS domain name.

The hash character (#) starts a comment that extends until the end of the line. Currently, commands cannot be continued across newlines.

OPTIONS
This paragraph details the commands recognized by ypmake. In this description, map_spec denotes a generic map name, whereas map_file denotes the file name of the map proper, as installed in /var/yp after having been built successfully. For builtin maps such as passwd.byname, the map_spec is always derived by replacing the dot by an underscore. This subtle distinction was added to support the use of short filenames.

A map_alias denotes a generic name such as passwd, referring to all maps derived directly from /etc/passwd. The special alias default denotes the default set of maps to be rebuilt when ypmake is invoked without arguments.

domain domainname
    Signals the start of a new section. All subsequent statements will apply exclusively to the specified NIS domain. The section is terminated either by another domain statement, or the end of file.

alias map_alias map_spec:map_spec:...
    Instructs ypmake to treat map_alias as an alias for the list of maps or aliases listed. If the alias already exists, the specified maps will be appended to the alias, rather than replacing it.

source map_spec filename [command]
    Instructs ypmake to generate the specified map from filename rather than from the system-wide configuration file located in /etc.

mode map_spec fileprot
    By default, ypmake creates all map files with a protection of 0444. This can be overridden with the mode command.

privport map_spec
    Causes ypmake to add the YP_SECURE entry to the specified NIS map. This instructs ypserv to reject all map queries that do not originate from a privileged port. This is supposed to add some kind of marginal protection when distributing your shadow password over NIS.

    Note that the current Linux ypserv uses a different protection scheme based on a configuration file.

secure map_spec
    Causes ypmake to add the YP_AUTHDES entry to the specified NIS map. This tells ypserv to reject all map queries that do not use secure RPC.

    Note that this feature has not been added to ypserv yet. It's not a very useful feature, anyway, because a NIS domain should either perform all its NIS business over secure RPC, or you can dump it altogether.

push [yes|no]
    If set to yes, ypmake will try to push newly built maps to all slave servers using yppush. Otherwise, maps will not be propagated to slave servers.

The following set of options deal with the addition of new maps to ypmake:

map map_spec map_file
    Tells ypmake to install the target map_spec as a handle for the given map file.

module map_spec script
    Tells ypmake where to find the map builder for the specified map. This can be anywhere in perl's default include path, or in /usr/lib/yp/ypmake. The file has to contain a perl function that derives the map information and prints out key-value pairs to the file OUT, separated by a tab. All generic processing (such as creation and locking of the map file itself) is handled transparently by ypmake.

EXAMPLES
To add new maps to the default map set that is rebuilt whenever you invoke ypmake without arguments, put something like this into your ypmake.conf:

    alias   default          netgroup:revnetgroup

This adds the netgroup.byuser, netgroup.byhost, and netgroup maps to the list of default targets.

As another example of a ypmake.conf file, consider the following:

    # Alias for maps relevant to secure rpc
    alias   secure          publickey:netid
    # get the following maps from alternative sources
    source  passwd          /etc/master/passwd
    source  group           /etc/master/group
    source  hosts           /etc/master/hosts
    source  netgroup        /etc/master/netgroup
    source  publickey       /etc/master/publickey

This defines the alias secure as a shorthand for the publickey.byname and netid.byname maps, and installs alternative source files for a number of maps.

The following example demonstrates how to protect the shadow NIS maps from unauthorized access (at least as long as no packet spoofing is involved):

    privport shadow        # require root privs
    privport gshadow       # require root privs

Finally, here's an example how to implement a new pair of maps called foo.byname and foo.bynumber:

    map      foo_byname    foo.byname
    map      foo_bynumber  foo.bynumber
    alias    foo           foo_byname:foo_bynumber
    source   foo           /etc/master/foo
    module   foo           /usr/lib/yp/ypmake/foo

First, this defines the handles foo_byname and foo_bynumber for the two maps, and installs an alias called foo for the pair. The source command tells ypmake where to look for the source file when deciding whether to rebuild the map or not. If it decides that the maps have to be rebuilt, it includes the perl module /usr/lib/yp/ypmake/foo and invokes the foo_byname and/or foo_bynumber functions that should be defined in this file. The /usr/lib/yp/ypmake contains the implementations of the generic maps supported by ypmake, which could serve as an example on how to implement customized maps.

FILES

/var/yp/domain/ypmake.conf
    Location of the configuration file for domain.

/usr/sbin/ypmake
    Location of the ypmake script.

/usr/lib/yp/ypmake
    Location of the perl include files that generate the individual maps.

AUTHOR
Olaf Kirch, <okir@monad.swb.de>