Assign Static Ports And Use Iptables Rules - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

For instance, if someone either connects a laptop computer into the network or breaks into the
network from outside (and manages to spoof an internal IP address), the following command reveals
the /etc/passwd map:
ypcat -d <NIS_domain> -h <DNS_hostname> passwd
If this attacker is a root user, they can obtain the /etc/shadow file by typing the following command:
ypcat -d <NIS_domain> -h <DNS_hostname> shadow
Note
If Kerberos is used, the /etc/shadow file is not stored within an NIS map.
To make access to NIS maps harder for an attacker, create a random string for the DNS hostname,
such as o7hfawtgmhwg.domain.com. Similarly, create a different randomized NIS domain name.
This makes it much more difficult for an attacker to access the NIS server.
43.2.3.3. Edit the /var/yp/securenets File
If the /var/yp/securenets file is blank or does not exist (as is the case after a default installation),
NIS listens to all networks. One of the first things to do is to put netmask/network pairs in the file so
that ypserv only responds to requests from the appropriate network.
Below is a sample entry from a /var/yp/securenets file:
255.255.255.0 192.168.0.0
Warning
Never start an NIS server for the first time without creating the /var/yp/securenets
file.
This technique does not provide protection from an IP spoofing attack, but it does at least place limits
on what networks the NIS server services.

43.2.3.4. Assign Static Ports and Use iptables Rules

All of the servers related to NIS can be assigned specific ports except for rpc.yppasswdd — the
daemon that allows users to change their login passwords. Assigning ports to the other two NIS server
daemons, rpc.ypxfrd and ypserv, allows for the creation of firewall rules to further protect the NIS
server daemons from intruders.
To do this, add the following lines to /etc/sysconfig/network:
Securing NIS
627