jackhamm's questions

I am not an iptables expert.

I have a use case to block all outgoing traffic that does not destined for either 10.0.0.0/8 or 167.114.0.0/16. I have two NIS servers (10.57.132.11, 10.57.132.40). I generated the below iptables ruleset which I thought would work, but if I run service iptables start, I am unable to also get ypbind to load. It times out on hitting the two NIS servers. I see nothing in the logs other than a timeout.

# Generated by iptables-save v1.4.7 on Fri Jul 17 11:08:39 2015
*filter
:INPUT ACCEPT [78622:10507056]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-I OUTPUT -d 10.57.132.11 -j ACCEPT
-I OUTPUT -d 10.57.132.40 -j ACCEPT
-I OUTPUT -d 167.114.0.0/16 -j ACCEPT 
-I OUTPUT -d 10.0.0.0/8 -j ACCEPT 
-P OUTPUT DROP

COMMIT
# Completed on Fri Jul 17 11:08:39 2015

Any thoughts on what I'm doing wrong? Thanks, Jack.

UPDATE: To clarify, ypbind binds when iptables is off, but won't bind when I turn the above ruleset on. Since it is only filtering OUTPUT and those rules seem correct, I don't understand the problem and I can't find anything useful in the logs.

Okay, first off, I know NIS is a turd, but it's what we've got until we do a major migration next year.

Today we had a NIS server outage which predictably prevents user logins. What surprised me was that I was unable to login in as root to any of the impacted machines.

This is our standard /etc/nsswitch.conf

passwd:     files nis
shadow:     files nis
group:      files nis

#hosts:     db files nisplus nis dns
hosts:      files db


bootparams: nisplus [NOTFOUND=return] files

ethers:     files
netmasks:   files
networks:   files
protocols:  files nis
rpc:        files
services:   files nis

netgroup:   files nis nisplus

My understanding is that the system should consult local files then NIS, but this was not what was occurring. Am I missing a setting somewhere that would allow root login regardless of nis state?