Changing the master NIS server

You may need to change your master server, for example, if you rearrange server configuration or the master server host is removed from service. Any server in the NIS domain can become the new master server because each one has all active maps. However, because the old NIS master's name is contained in the existing map, you can neither use an existing copy at the new master nor send a copy there with ypxfr. Rather, you must re-create these maps by running ypmake (or make) on the new master server to associate the new server listing with each map.

The old master server must be running NIS to complete this procedure. This is because nonmaster servers consult their own copies of maps, which include the name of the old master server, when they receive a map transfer request originating from yppush on the master. New maps with the new master server listing must come from the old master server for the maps to be incorporated on slave and copy-only servers. Therefore, if the old master is not available when you change master servers, you must rebuild your entire NIS system from scratch.

CAUTION:

The procedures described here assume that the new master is running SCO NIS. Other implementations of NIS configure servers in a different way; consult the documentation for your version of NIS before changing master servers.

To change NIS master servers, follow these steps:

Log into the new master server in multiuser mode.

Copy the /etc/passwd.yp file from the old master. If this file is not available, you must re-create distributed accounts manually. If you have modified the /etc/yp/ypmake or /etc/yp/Makefile file, you must also copy it from the old master.

Run the following commands to rebuild the maps:

cd /etc/yp
rm *.time
ypmake NOPUSH=1

By removing the timestamp files, you force the maps to be rebuilt regardless of prior modifications. The NOPUSH option to ypmake prevents maps from being pushed to other servers until you have completed this entire procedure.

If the map only exists as a ndbm database, you can remake it on the new master by unassembling an existing copy from any NIS server and running the unassembled version back through makedbm. For example, enter:

cd /etc/yp
ypcat -k mymap | ./makedbm - domain_name/mymap

Log into the old master server.

Copy the new maps from the new master server with the following command:

/etc/yp/ypxfr -h new_master -f mapname

This command must be run on the old master for every current NIS map. The -h option forces ypxfr to transfer the map from the new master; the -f option forces the transfer even if the contents of the old and new maps are the same.

Propagate the new maps from the old master server by running the following command on the old master server:

/etc/yp/yppush mapname

This command must be run on the old master for every current NIS map. When this is completed, all nonmaster servers will have received maps that include the new master listing.

If you are removing the old master server from NIS service, edit the ypservers map on the new master server following the instructions in ``Removing an NIS server from the server list''.

\: MAPS=`oawk '{print $1 ; }' /etc/yp/YP_MAP_X_LATE` for map in $MAPS; do echo moving $map ypxfr -h new_master -f $map yppush $map done

/etc/yp/YP_MAP_X_LATE

``NIS maps''

Infrastructure

All NAP enforcement methods can be implemented using a minimum of one computer running Windows Server 2008 R2 or Windows Server 2008. All enforcement methods require that NPS is installed on this computer and configured to evaluate the health of NAP clients. Additional required services depend on the enforcement method. For example, IPsec, VPN, and DHCP enforcement methods require a NAP enforcement server running Windows Server 2008 R2 or Windows Server 2008. The 802.1X enforcement method requires network hardware that supports the 802.1X authentication method and is capable of controlling port characteristics using RADIUS tunnel attributes. For more information, see NAP Configuration Overview.

MCITP Boot camp USA : MCITP CCNA Boot camp UK, MCITP MCSE CCNA Boot camp Asia, MCITP CCNA MCSE Bootcamp, MCITP MCSE RHCE Training

Cost

Because support for it is built into the Windows operating system, the cost of deploying NAP is typically low, but depends on how well your existing network hardware and software support your design. If you have deployed Windows Server 2008 R2 or Windows Server 2008 on your network, then you already have some or all of the components required to deploy NAP. Some NAP enforcement methods might require an upgrade of the components of your network infrastructure. For example, deploying NAP with 802.1X enforcement can be costly if you do not already have hardware that supports 802.1X authentication. If you already have hardware that supports 802.1X, then it is likely that you can deploy NAP with 802.1X enforcement at minimal cost. If your hardware does not support NAP, in some cases adding support can be as simple as downloading and installing new firmware. To determine the costs associated with a NAP deployment, review hardware and software requirements for the enforcement methods you have chosen and determine whether server and network hardware upgrades are required. Additional costs that might also be associated with a NAP deployment include planning and design costs and the training of support personnel.

Complexity

NAP with IPsec enforcement is generally the most complex enforcement method to deploy because it requires a public key infrastructure (PKI) and IPsec policies to create logical networks. However, Windows Server 2008 R2 and Windows Server 2008 include tools for managing and monitoring IPsec that eliminates much of this complexity. The 802.1X enforcement method is next in terms of complexity, followed by VPN enforcement. DHCP enforcement is the least complex enforcement method to deploy.

Security

IPsec enforcement is a powerful method for protecting compliant computers from any others; it can be combined with server and domain isolation to ensure that after a computer has demonstrated it is compliant, it will still be restricted to communicating only with authorized hosts. IPsec provides other benefits, too. Network packets are authenticated, which reduces the risk of man-in-the-middle and replay attacks, and traffic can be encrypted with IPsec, providing a high degree of protection from eavesdropping attacks.

Like IPsec, 802.1X offers a high degree of protection. Several enhancements to 802.1X are also available that provide improved security. Until a client has demonstrated that it complies with the organization�s health requirements, its access to the network will be restricted by the network switches and wireless access points. These restrictions can be very difficult to bypass, even by a determined malicious user.

VPN enforcement is a good choice for protecting remote access to the corporate network. Clients that connect to a NAP-enabled VPN server can be granted restricted access to the network at the point of entry using IP packet filters. The health of remote client computers is evaluated when the client connects and it is monitored during the VPN session. If a client computer becomes noncompliant, then access is restricted until the computer is compliant.

DHCP enforcement restricts noncompliant computers by providing a limited IPv4 address configuration. It is the least secure NAP enforcement method. It is easily bypassed by an advanced user who has administrative privileges on the computer.

Combining NAP enforcement methods

It is possible to use more than one enforcement method simultaneously. An organization might invest additional resources into combining these enforcement technologies because they have complementary strengths and weaknesses. NAP with VPN enforcement can be used to enforce organizational compliance policies on remote clients, while NAP with IPsec enforcement can be used for local clients. 802.1X and IPsec offer a particularly robust combination because together they can restrict network connectivity at multiple layers of the network protocol stack. The following table shows which enforcement methods can be combined. Keep in mind that the complexity of your NAP deployment will increase when you combine enforcement methods.

	IPsec	802.1X	VPN	DHCP
IPsec
802.1X			X
VPN		X		X
DHCP

Microsoft Course 20413