YPSERV(8)

👑 YPSERV(8) — the NIS Server glow-up ✨

okay bestie, sit down, hydrate, because this is the ypserv manual page and it's from the NIS Reference Manual and it's literally the moment. this is the daemon that makes your whole network's lookup game iconic. let's get into it 💅

---

🎀 NAME 🎀

ypserv — the NIS Server, no cap 👑

---

🌸 SYNOPSIS 🌸

/usr/sbin/ypserv [-d [path]] [-p port]

that's it. that's the whole vibe check. two little flags and she's ready to serve 🫶

---

🦋 DESCRIPTION 🦋

so. the Network Information Service (NIS) is this super simple network lookup service made of databases and processes, okay? and those databases? they're gdbm files living in a directory tree rooted at /var/yp. that's the home base, periodt.

the ypserv daemon is typically activated at system startup. and here's the thing — ypserv only runs on NIS server machines that have a complete NIS database. she's not doing half-finished homework, she's a full-database girly.

on the other machines that are using NIS services, you have to run ypbind as a client — or, under Linux, you could use the libc with NYS support instead. cute alternative, love that for them.

ypbind must run on every machine which has NIS client processes. ypserv may or may not be running on the same node, but she must be running somewhere on the network. she could be next door, she could be across the country, doesn't matter — she's somewhere, being the main character 💫

and on startup? ypserv parses the file /etc/ypserv.conf. first thing she does. every time. iconic behavior.

---

💖 OPTIONS 💖

• -d, --debug [path] — makes the server run in debugging mode. normally, ypserv only reports errors (access violations, dbm failures) using the syslog(3) facility — she's lowkey private like that 🙈. but in debug mode? she does not background herself, and she prints extra status messages to stderr for each request that she receives. path is an optional parameter, and ypserv will use this directory instead of /var/yp. so yes, you can move her whole house if you want 🏠
• -p, --port port — ypserv will bind herself to this port. why tho? because this makes it possible to have a router filter packets to the NIS ports, so that access to the NIS server from hosts on the Internet can be restricted. security slay, honestly 🔥
• -v, --version — prints the version number. short, sweet, does exactly what it says on the tin ⭐

---

🔒 SECURITY 🔒

okay this is the serious part, bestie, pay attention, this is not the time to be scrolling 🚨

In general, any remote user can issue an RPC to ypserv and retrieve the contents of your NIS maps — if he knows your domain name. like. any remote user. if they know the domain name. that's the whole lock. 💀

to prevent such unauthorized transactions, ypserv supports a feature called securenets, which can be used to restrict access to a given set of hosts.

at startup, ypserv will attempt to load the securenets information from a file called /var/yp/securenets. this file contains entries that consist of a netmask and a network pair separated by white spaces, or network/number of bits of netmask entries. One per line. and lines starting with #? those are comments, so go off, annotate your heart out 📝

🌈 a sample securenets file, because visuals help

# allow connections from local host -- necessary
host 127.0.0.1
host ::1
# same as 255.255.255.255 127.0.0.1
#
# allow connections from any host
# on the 131.234.223.0 network
255.255.255.0   131.234.223.0
# allow connections from any host
# between 131.234.214.0 and 131.234.215.255
255.255.254.0   131.234.214.0
# allow some IPv6 connections
FE80::0202:B3FF::/96
# allow IPv6 connections from all machines
::/0

look at her. netmasks AND networks AND IPv6. we love a versatile queen 🧚

---

so if ypserv receives a request from an address that fails to match a rule, the request will be ignored and a warning message will be logged. and if the /var/yp/securenets file does not exist? ypserv will allow connections from any host. like, everyone. the whole internet. no gatekeeping whatsoever 😭

fr fr, if that file isn't there, you're wide open. go make the file.

in /etc/ypserv.conf you could specify some access rules for special maps and hosts. but — and I need you to hear me on this — it is not very secure. it makes the life only a little bit harder for a potential hacker. that's it. a little bit. crumbs of difficulty. 🥲

if a mapname doesn't match a rule, ypserv will look for the YP_SECURE key in the map. if it exists, ypserv will only allow requests on a reserved port. noted, logged, respected ✅

and for security reasons, ypserv will only accept ypproc_xfr requests for updating maps from the same master server as the old one. which means — and this is the part that bites — you have to reinstall the slave servers if you change the master server for a map. no shortcuts, no clever workarounds, that's just the deal 💀

---

📂 FILES 📂

• /etc/ypserv.conf — configuration file.
• /var/yp/securenets — which hosts are allowed to contact ypserv.

---

👯 SEE ALSO 👯

domainname(1), ypcat(1), ypmatch(1), ypserv.conf(5), netgroup(5), makedbm(8), revnetgroup(8), ypinit(8), yppoll(8), yppush(8), ypset(8), ypwhich(8), ypxfr(8), rpc.ypxfrd(8)

the whole friend group, all invited to the function 🫶

and a lil history lesson for you, because lore matters: the Network Information Service (NIS) was formerly known as Sun Yellow Pages (YP). the functionality of the two remains the same; only the name has changed. so if you see yp everywhere and you're like "bestie why" — that's why. rebrand. 🌈

also: the name Yellow Pages is a registered trademark in the United Kingdom of British Telecommunications plc, and may not be used without permission. so like, don't. legal said no 💅

---

🖋️ AUTHOR 🖋️

ypserv was written by Peter Eriksson <pen@lysator.liu.se>.

Thorsten Kukuk <kukuk@linux-nis.org> added support for master/slave server and is the new Maintainer. passing the crown, we love to see it 👑

---

and that's the page, bestie — NIS Reference Manual, dated 12/31/2020, YPSERV(8), and you absolutely ate this. go forth and serve those maps. mwah 💖✨