A.15 Chapter 14: Network-Based Authentication Systems

• Don't use your Internet domain name as your NIS domain.

• Use NIS+ instead of NIS, if possible. Don't run NIS+ in compatibility mode.

• Use netgroups to restrict access to services, including login.

• Make sure that your version of ypbind listens only on privileged ports.

• Make sure that there is an asterisk (*) in the password field of any line beginning with a plus sign (+) in both the passwd and group files of any NIS client.

• Make sure that there is no line beginning with a plus sign (+) in the passwd or group files on any NIS server.

• If you are using Kerberos, understand its limitations. Protect the Kerberos controller at all costs.

• If you are using LDAP for authentication, secure connections with TLS/SSL.