Why not YP, er, NIS

July 27, 2011

A commentator on the last entry asked:

Any particular reason you don't like NIS and/or LDAP?

The answer for NIS is relatively easy. Shorn of various bits and pieces, NIS is just a file distribution mechanism. Well we have one of those, and ours is simpler, far more flexible, more powerful, and much more transparent and thus easier to understand and reason about. There is nothing particularly unique about our mechanism; these days there are a great many ways to distribute files around (and then do things on the remote end).

(Many of these ways are better than what we have.)

The only advantage NIS has in a modern environment is that things can update slightly faster. In exchange you have to live with a pile of complexity, fragility, and opaqueness. This tradeoff is almost never worth it.

NIS itself is a creation of an era when almost none of this was true. Back in those days there were no good tools for file replication, networks were drastically slower, central servers were so wimpy that distributing files to a bunch of clients at once would do bad things, and things like /etc/passwd and all of the other files were sufficiently large (especially for decent sized sites) that you simply did not want them sitting on every machine's disk chewing up space (and making various lookups in the files take longer). But that era is long gone, and NIS should have gone with it.

(I assume that NIS lives on because it is the canned solution for file 'replication' for various important system files.)


Comments on this page:

From 69.158.17.191 at 2011-07-27 18:12:16:

I think NIS lives on because it works and people don't want to bother re-inventing the wheel. It's a bit inappropriate nowadays (except perhaps if you use the 'shadow' map and not put the password hash in the 'passwd' map).

Similarly with LDAP, while it may be a bit complicated to get going for some, but there are quite a few HOWTOs out there that let you get going fairly quickly.

Of course distributing files is a lot easier with things like Cfengine and Puppet now as well, so distributing the various /etc files is fairly simple. Though it it's handy to be able to use the "host" LDAP attribute to restrict people's logins to only certain hosts:

http://wiki.debian.org/LDAP/PAM#Allowing_logins_on_a_per-host_basis

We're currently using it and it's quite handy as we have many different groups and sub-groups of people: even if many people are in a group, only some of those people should be logging onto some of the machines owned by that group, and it's usually easier to use the "host" attr than setting up yet another group.

Written on 27 July 2011.
« Disabling an account can be kind of complex
Another reason why version control systems should support history rewriting »

Page tools: View Source, View Normal, Add Comment.
Search:
Login: Password:
Atom Syndication: Recent Comments.

Last modified: Wed Jul 27 00:58:31 2011
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.