NIS HOWTO: why NIS is obsolete and how to replace it

Updated November 2026

NIS (Network Information Service, once called Yellow Pages or YP) shares user accounts, groups, host names and automount maps across Unix machines. It dates from the 1980s, sends everything in clear text, and lets anyone who knows the domain name read your password hashes. Red Hat removed it from RHEL 9. If you still run it, the job today is to replace it with FreeIPA or LDAP plus SSSD, and to lock it down until you have.

The classic NIS(YP)/NYS/NIS+ HOWTO is kept by the Linux Documentation Project at tldp.org for reference. This page is about getting off NIS safely, as of November 2026.

Why NIS has to go

Where NIS still exists

NIS packages by distribution, as of November 2026
DistributionStatus
RHEL 9 and 10 (and Alma, Rocky)Removed: nss_nis, yp-tools, ypbind and ypserv. Red Hat says there is no direct replacement and recommends Identity Management (IdM, based on FreeIPA) with SSSD. RHEL 10 IdM also dropped its NIS server emulator.
FedoraStill packages ypserv and ypbind
Debian 13 / UbuntuStill packaged: nis, ypserv, yp-tools, libnss-nis

So a mixed network can keep NIS alive for a while on Debian or Fedora, but every RHEL-family machine you upgrade loses its NIS client. Plan the move before the next upgrade cycle.

Pick the replacement

Directory services that replace NIS
OptionWhat you getFits when
FreeIPA / RHEL IdM389 Directory Server, MIT Kerberos, a certificate authority (Dogtag), optional DNS, host-based access rules, sudo rules, automount maps; clients join with ipa-client-installMostly Linux networks, especially with RHEL or Fedora servers
OpenLDAP or 389 Directory Server + SSSDA plain LDAP directory; you add Kerberos and policy yourselfYou want a small, standards-only directory or already run LDAP
Active Directory or Samba AD + SSSDAccounts shared with Windows machinesMixed Windows and Linux networks

On every client, SSSD (System Security Services Daemon) replaces ypbind: it fetches users and groups, caches them for offline use, and handles Kerberos or LDAP logins. Setup for each option is in the LDAP HOWTO.

Migration plan

  1. Inventory. On a NIS client, list the maps the master serves and dump each one: 
    ypwhich               # which server this client uses
ypwhich -m            # every map and its master
ypcat passwd > nis-passwd.txt
ypcat group > nis-group.txt
ypcat -k netgroup > nis-netgroup.txt
ypcat -k auto.master > nis-auto.master.txt
    -k prints the keys too, which matters for netgroup and automount maps.
  2. Build the new directory and keep every UID and GID exactly as it was. Files on NFS servers and local disks store numbers, not names; changing a number orphans the files.
  3. Import groups, then users. Red Hat’s published NIS migration procedure loops over ypcat output and calls ipa group-add … --gid= and ipa user-add … --uid= --gidnumber= --gecos= --homedir= --shell=. A safe way is to generate the commands into a file, read it, then run it with Bash (the %q quoting is Bash syntax): 
    ypcat passwd | while IFS=: read -r name hash uid gid gecos home shell; do
  [ "$uid" -ge 1000 ] || continue
  printf 'ipa user-add %q --first=NIS --last=User --uid=%q --gidnumber=%q --gecos=%q --homedir=%q --shell=%q\n' \
    "$name" "$uid" "$gid" "$gecos" "$home" "$shell"
done > import-users.sh
less import-users.sh
kinit admin
bash import-users.sh
    For a plain LDAP directory, write the same fields into LDIF entries with the posixAccount object class instead.
  4. Passwords. NIS stores old crypt() hashes, and they cannot be converted. Red Hat notes that Directory Server does not convert existing hashes. Give users temporary passwords that must be changed at first login (ipa passwd alice), or have them set one through a self-service page. Do not lower the directory’s password storage scheme to weak crypt just to accept old hashes.
  5. Automount and netgroups. Recreate auto.master and its maps as IPA automount maps or LDAP automount entries, and netgroups as IPA netgroups or LDAP nisNetgroup entries. Red Hat advises using the ipa netgroup-* commands only for netgroups you created with netgroup-add.
  6. Move clients one at a time. Join each client (sudo ipa-client-install --mkhomedir, or configure SSSD for LDAP), then change /etc/nsswitch.conf from nis to sss: 
    passwd:     files sss
group:      files sss
netgroup:   files sss
automount:  files sss
    On Fedora and RHEL, authselect select sssd writes this for you. Test with getent passwd alice, id alice and a real login, then stop ypbind on that client.
  7. Freeze, then switch off. When the last client has moved, make NIS read-only for a few weeks as a fallback, then stop ypserv, remove the packages, and close the RPC ports.

Test with one account first. Create a single test user in the new directory with a UID that does not exist in NIS, join one spare client, and check login, home directory, sudo and NFS access before you import everybody.

If you must keep ypserv running for now

Reduce the damage while the migration runs:

Sources