Linux NIS Setup on Ubuntu 22.04: Network Information Service Installation & Practical Guide

A hands-on guide to installing a Network Information Service (NIS) server and client on Ubuntu 22.04, publishing user accounts from one central machine, resolving them on another, and testing a network user login.

1. Learning outcomes

• Explain the purpose of NIS and its server/client architecture.
• Install and configure an NIS server and an Ubuntu NIS client.
• Generate and query NIS maps.
• Configure the NIS domain, ypbind, and NSS.
• Verify centralized account lookup and test a user session.
• Diagnose common RPC, firewall, binding, and NSS errors.

2. NIS in brief

Network Information Service (NIS), historically called Yellow Pages (YP), distributes selected network databases (user, group and host information) from a central server to client machines. A client consults NIS through the system’s name-service mechanisms instead of relying only on local files.

• ypserv: serves NIS map requests.
• ypbind: binds a machine to an NIS server (needed on clients, and on the server itself if you want to run ypmatch/ypcat there).
• rpcbind: maps RPC program numbers to network ports.
• NIS domain: a logical name for the NIS database set; it is not necessarily a DNS domain.
• NIS maps: indexed databases generated from source files and Makefile rules.
• NSS: decides which sources Linux consults for users, groups and other identities.

3. Lab topology and assumptions

NIS domain: labnis. Both VMs must be able to reach each other. Use static or reserved addresses for a repeatable lab.

Basic network check (both VMs)

hostname
ip -br address
ping -c 3 10.20.47.193   # run on client
ping -c 3 10.20.47.28    # run on server

Confirm the addresses and connectivity before installing NIS. If ping fails, fix VM networking first.

4. Preparation (both VMs)

Set hostnames

On the server:

sudo hostnamectl set-hostname nis-server

On the client:

sudo hostnamectl set-hostname nis-client1

For reliable name resolution in a small isolated lab, add matching entries to /etc/hosts on both VMs (keep the existing localhost lines):

sudo nano /etc/hosts

10.20.47.193 nis-server
10.20.47.28  nis-client1

Update packages

sudo apt update
sudo apt upgrade -y

5. Install and configure the NIS server

Step 5.1 — Install packages (Server)

sudo apt install nis rpcbind yp-tools -y

The installer may ask for an NIS domain. Enter labnis. If the prompt does not appear, set it in the next step.

Step 5.2 — Set the NIS domain (Server)

sudo domainname labnis
echo "labnis" | sudo tee /etc/defaultdomain
domainname

The final command should print labnis.

Step 5.3 — Make this machine the NIS master (Server)

Ubuntu starts ypserv only when it is told this host is a server. Edit /etc/default/nis and change these lines:

sudo nano /etc/default/nis

NISSERVER=master
YPSERVARGS="-p 857"

NISSERVER=master enables the server role. YPSERVARGS="-p 857" pins ypserv to a fixed port so the firewall rule in section 7 is predictable (otherwise RPC picks a random port on each start).

Optionally restrict who may query the server by editing /etc/ypserv.securenets. Replace the open 0.0.0.0 0.0.0.0 line with your lab subnet, for example:

255.255.255.0   10.20.47.0

Keep the 255.0.0.0 127.0.0.0 localhost line.

Step 5.4 — Point the server at itself (Server)

So that ypwhich, ypcat and ypmatch work on the server too, bind it to its own NIS service:

sudo nano /etc/yp.conf

domain labnis server 127.0.0.1

(Only the server uses 127.0.0.1. The client must not; see section 8.)

Step 5.5 — Start services (Server)

sudo systemctl enable --now rpcbind
sudo systemctl restart ypserv
sudo systemctl enable ypserv ypbind
sudo systemctl status rpcbind ypserv --no-pager

Both should be active. ypbind is started later, after the maps exist.

Step 5.6 — Initialise the NIS master database (Server)

This is the step that creates the domain directory /var/yp/labnis and the first set of maps. Without it, make -C /var/yp has nothing to build into.

sudo /usr/lib/yp/ypinit -m

When asked for the list of NIS servers, nis-server is already shown. Press Ctrl+D to finish the list, then answer y to confirm. The script builds the default maps and finishes with a message that nis-server has been set up as an NIS master server.

Now start the binder and check it:

sudo systemctl restart ypbind
sleep 3
ypwhich

Expected output: localhost (or nis-server).

6. Create a user and generate NIS maps (Server)

Step 6.1 — Create a demonstration account

sudo useradd -m -u 2001 studentnis
sudo passwd studentnis

Set a password interactively. -m creates the server-side home directory and -u 2001 assigns a predictable UID.

getent passwd studentnis
id studentnis

Step 6.2 — Build NIS maps

sudo make -C /var/yp

The NIS Makefile reads the local account files and creates or updates the indexed maps. A new local user is not visible to clients until the maps are rebuilt. Typical output includes Updating passwd.byname and Updating passwd.byuid.

Step 6.3 — Verify maps on the server

ypwhich -m
ypmatch studentnis passwd.byname
ypmatch 2001 passwd.byuid

Both lookups should return the account record. Common map names: passwd.byname, passwd.byuid, group.byname, hosts.byname.

7. Allow NIS/RPC through the firewall (Server)

Ubuntu’s default firewall front-end is UFW. This lab’s server uses firewalld (public zone, interface ens33); if it is not installed, run sudo apt install firewalld first. Either way, check what is active rather than assuming: an inactive UFW does not mean there is no firewall.

Step 7.1 — Identify the active zone

sudo firewall-cmd --get-active-zones
sudo firewall-cmd --zone=public --list-all

Step 7.2 — Open the lab ports

Allow the RPC portmapper (111) and the pinned ypserv port (857). Limiting the source to the lab subnet is better than opening the ports to everyone:

sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.20.47.0/24" port port="111" protocol="tcp" accept'
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.20.47.0/24" port port="111" protocol="udp" accept'
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.20.47.0/24" port port="857" protocol="tcp" accept'
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.20.47.0/24" port port="857" protocol="udp" accept'
sudo firewall-cmd --reload

Verify:

sudo firewall-cmd --zone=public --list-rich-rules
sudo ss -lntup | grep -E ':111|:857'
rpcinfo -p localhost

8. Install and configure the NIS client

Step 8.1 — Install packages (Client)

sudo apt install nis rpcbind yp-tools libnss-nis -y

The nis package already provides ypbind; no separate ypbind-mt package is needed. Enter labnis if asked for the domain.

Step 8.2 — Set the domain and client role (Client)

sudo domainname labnis
echo "labnis" | sudo tee /etc/defaultdomain
domainname
grep NISSERVER /etc/default/nis

NISSERVER must be false on the client so it does not try to act as a server.

Step 8.3 — Configure /etc/yp.conf (Client)

sudo nano /etc/yp.conf

Remove any other active domain, ypserver or broadcast lines and keep exactly one:

domain labnis server 10.20.47.193

Step 8.4 — Start client binding (Client)

sudo systemctl enable --now rpcbind
sudo systemctl enable ypbind
sudo systemctl restart ypbind
sleep 3
ypwhich

Expected server: 10.20.47.193 (or nis-server).

9. Enable NIS account lookup through NSS (Client)

Direct NIS queries (ypcat, ypmatch) can work while getent, id and login still fail. Those tools use the Name Service Switch (NSS), which must be told to consult NIS. The module package libnss-nis was installed in step 8.1.

sudo nano /etc/nsswitch.conf

Add nis to the end of these two lines, leaving everything else in the file untouched:

passwd:         files systemd nis
group:          files systemd nis

• files checks local files such as /etc/passwd first.
• systemd is Ubuntu’s default extra source; keep it.
• nis adds NIS lookups. Because the password hash travels in the merged passwd map, the shadow line does not need NIS.

10. Verify the complete configuration (Client)

Run these in order and compare against the expected result.

1. Domain: domainname → labnis
2. Bound server: ypwhich → 10.20.47.193 (or nis-server)
3. Direct map query:

   ypcat passwd.byname | grep studentnis

   Expected: a record like studentnis:$y$…:2001:2001::/home/studentnis:/bin/sh (the second field is the password hash).

4. NSS lookup:

   getent passwd studentnis
   id studentnis

   Expected: the account record and UID/GID 2001.

11. Practical: log in as an NIS user (Client)

Step 11.1 — Ensure a client home directory

NIS shares account information; it does not create or mount the home directory. For this simple lab, create it locally on the client:

sudo mkdir -p /home/studentnis
sudo chown 2001:2001 /home/studentnis
sudo chmod 700 /home/studentnis

In a real multi-client environment, home directories are normally provided over NFS or other shared storage.

Step 11.2 — Switch to the NIS user

su - studentnis

Enter the password set on the server. Note that su run as root does not ask for a password; run it from a normal user account to test the password path. The dash starts a login-style shell.

Step 11.3 — Verify identity and session

whoami
id
pwd
touch ~/nis-client-test.txt
ls -l ~/nis-client-test.txt
exit

Expected: user studentnis, UID and GID 2001, and the test file created in the client’s local home directory.

12. Practical: central account lifecycle

Step 12.1 — Create a second account (Server)

sudo useradd -m -u 2002 student2
sudo passwd student2
sudo make -C /var/yp

Create the account and home, set a password, then regenerate the maps.

Step 12.2 — Verify (Client)

getent passwd student2
id student2
ypmatch student2 passwd.byname

Step 12.3 — Optional login test (Client)

sudo mkdir -p /home/student2
sudo chown 2002:2002 /home/student2
sudo chmod 700 /home/student2
su - student2

Use the password set on the server and leave with exit.

Step 12.4 — Modify an account (Server, then Client)

sudo usermod -s /bin/bash student2
sudo make -C /var/yp

On the client:

getent passwd student2

Observe the shell field change. Any change to account data must be followed by a map rebuild.

Step 12.5 — Remove an account (instructor demonstration only)

sudo userdel student2
sudo make -C /var/yp

On the client, getent passwd student2 should now return nothing. Remove leftover home directories only after confirming nothing needed is inside; do not delete accounts or data without understanding the consequences.

13. Troubleshooting guide

sudo firewall-cmd --get-active-zones
sudo firewall-cmd --zone=public --list-all
sudo ss -lntup | grep -E ':111|:857'

domain labnis server 10.20.47.193

sudo systemctl restart ypbind
ypwhich

sudo apt install libnss-nis
grep -E '^(passwd|group):' /etc/nsswitch.conf

sudo make -C /var/yp
ypmatch username passwd.byname

ypwhich
ypcat passwd.byname | grep username
getent passwd username

14. Security and good lab practice

• Use isolated host-only or internal VM networking.
• Never use real personal accounts or production passwords.
• Treat the passwd map as confidential: it contains password hashes.
• Limit ypserv.securenets and firewall rules to the lab subnet.
• Remember NIS is a legacy service and is not recommended for modern secure production identity management.
• Snapshot the VMs before the practical and revert afterwards if needed.

15. Student exercise and self-check

Hands-on checklist

• Record server/client hostnames and IP addresses.
• Show domainname and ypwhich on the client.
• Capture ypmatch and getent output for studentnis (hide the hash).
• Create a new user on the server, rebuild maps, and resolve it on the client.
• Switch to an NIS user and show whoami and id.
• Explain why a local client home directory or NFS is needed.
• Describe one RPC/firewall issue and one NSS issue and their fixes.

Quick quiz (click to reveal each answer)

Reflection questions

1. How is an NIS account different from a local account?
2. What is the difference between a direct NIS query and an NSS lookup?
3. Why does a missing home directory not mean the NIS account is missing?
4. Why is NIS unsuitable for an internet-facing production network?

16. Command reference