openSUSE 11.2 NIS server and Firewall problem

Hello,

I’ve been setting up NIS for the first time. When I have the firewall on, the NIS client can’t find the NIS server. When the firewall is off, it can. These are both on the same computer (the server).

I have both the NIS client and server opened in the firewall – all the setup has been done through yast so far.

Is there something else that needs to be done that I missing?

Or if not, perhaps it just a minor setup bug in the scripts in which case could someone tell me what ports I would additionally need to open manually in the firewall to make it work that wouldn’t already be opened?

On a different note, in a recent discussion on another thread someone told me that openSUSE was going to be unsupported from around May this year – has anyone heard of this or should I just ignore it? I thought with 40k users registered on the website Novell would find something better to do with all of us rather that just drop us so I am a little skeptical.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> On a different note, in a recent discussion on another thread someone
> told me that openSUSE was going to be unsupported from around May this
> year – has anyone heard of this or should I just ignore it? I thought
> with 40k users registered on the website Novell would find something
> better to do with all of us rather that just drop us so I am a little
> skeptical.

Can you link me that thread please?


VampirD
No in elenath hîlar nan hâd gîn
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.12 (GNU/Linux)
Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/

iEYEARECAAYFAkuFB/QACgkQJQ+0ABWtaVnGLQCfVJ1yCusKOn70PLiwfL03fVc/
CEAAoLyLigoKoSxHDvInLQv18joFa3gH
=+nvZ
-----END PGP SIGNATURE-----

Each openSUSE version has a lifetime. After that official support stops. That’s true. If you want longer support you’d have to go for the latest SUSE Linux from Novell.

About NIS, I’m using NIS+NFS in a number of places, also at home. How exactly did you set it up? Did you try connecting from another machine?

Here’s the link: opensuse 11.2 shutting down - openSUSE Forums

However I guess I was tired or something because rereading it the guy mentioned May 2011, next year, so that’s in line with what you were saying about keeping up with the latest version. Sorry for the confusion.

I have been connecting between two computers with ssh and Samba for a long time. I use samba because sometimes I need to connect from my windows computer, which one day soon I hope to eliminate altogether.

I have not used NFS yet… still many things to learn on Linux.

The other Linux computer cannot find the NIS server when the servers’ firewall is up either and likewise can with the servers’ firewall is down.

The client computer does not have a firewall up since it’s all local and there is no direct inbound connection from it to the Internet – actually, mostly because it was the first Linux computer I ever setup and firewall was just one more thing to learn at the time. When I upgrade the client computer from 11.0 to 11.2 I’ll turn on the firewall for it.

Some more info.:

When you ask exactly “how”, all as I have done is use the yast gui so nothing non-standard at all and like I said, when the firewall is off, it works, and what else would you open in the firewall other than “nis server” and “nis client” to allow them to talk with each other?

Any takers??? I’m at a loss here, especially after spending an hour playing with firewall settings to try and get a clue as to what’s going on.

Well, it would seem to be a question of having appropriate ports opened.

Are you running 2 or more network interfaces on the server, so that separate interfaces are assigned to internal and external zones?

If you currently have set the firewall option to protect the internal network, then switch it off. Alternatively, you would need to make sure that all the necessary ports for the required services are opened on the internal zone.

Some more info about your firewall and network set-up could be helpful.

Paul

I have only one interface setup and you will see that in the screenshots I’ve created.

Please have a look at these screeshots, they are of the Firewall, NIS server and NIS client.

I’ve included every screen that has anything that I setup on these three programs, hopefully that show you what you need but if you need more please just tell me what else I can give you.

I’ve named the files so it should be obvious what each one is.

http://www.seowebsales.com/files/images/nis/Firewall-Allowed-Services.png
http://www.seowebsales.com/files/images/nis/Firewall-Interfaces.png
http://www.seowebsales.com/files/images/nis/Firewall-Summary.png
http://www.seowebsales.com/files/images/nis/NIS-Client-Firewall-OFF.png
http://www.seowebsales.com/files/images/nis/NIS-Client-Firewall-ON.png
http://www.seowebsales.com/files/images/nis/NIS-Client.png
http://www.seowebsales.com/files/images/nis/NIS-Master-Server.png
http://www.seowebsales.com/files/images/nis/NIS-Server-Maps.png
http://www.seowebsales.com/files/images/nis/NIS-Server.png

In the NIS client set-up, change the server address from 127.0.0.1 (ie localhost) to the actual IP address of the NIS server.

At the moment, that’s all I can suggest.

Paul

Thanks Paul!

Perhaps this is an 11.2 bug since there is nothing obvious as to why the setup is not working with the firewall on. I’ve never logged a bug but I think I will for this unless you have a better idea.

I have actually changed the IP from 127.0.0.0 to 192.168.17.154 but every time I come back to the screen it’s back to 127.0.0.0. I figured this was by design since it’s all on the same system.

Mmmm.

Just another thought. In the Yast firewall setup, go to the allowed services page, and select internal zone and set up your required services there.

Paul

No change but thanks. I had to actually turn on the firewall for the internal zone to make it work since the firewall by default allows everything on the internal zone. However, I did it anyway just in case there was a bug issue that this would get around.

Hi Paul,

I submitted a bug report and got this reply:

“the yast module searches nis servers by using broadcasts. Broadcasts are blocked by the firewall even if the nis ports are open. So just specify the ip manually.”

So I guess that solves it unless you have any other ideas.

Well, it looks like there is a facility in the Yast firewall setup to allow broadcasts. I guess if you know the appropriate broadcast ports for nis, then you could enter that data there?

Bear in mind, I have never used NIS and know nothing about it. So, I googled and found this guide:

Quick HOWTO : Ch30 : Configuring NIS - Linux Home Networking

Now, if you bring up a console, su to root and run:

rpcinfo -p

then you might get some clues as to which are the broadcast ports you need to open. I assume that the UDP ports would be of interest. You would enter ports as a comma-separated list for the appropriate interface, on the Broadcast set-up page mentioned above. If this works, then you could perhaps remove ports one-by-one until it fails, so you only have the needed broadcast port open.

Also, in the NIS server setup, did you set up the query alIowed IP range? I didn’t see that from your screen captures. But when I tried to duplicate your setup on my home PC, there is page in the Yast NIS server setup where you needed to enter the range of IP’s allowed to query.

Maybe something here will take you further??? I’m sorry about this “blind leading the blind” approach, but no-one else seems to be offering suggestions:(

Paul