One of the NIS users can’t login – why

“I want to talk to people in the office down the hall, but there's no phone there, and I don't know how to install one. What is the best way to set up a string and paper cups between the offices?”

Any solution you come up with other than normal NIS or LDAP will probably be "simpler" to set up, but will also be non-standard and error-prone. Consider using standard tools and facilities for standard tasks instead of reinventing yet another wheel. Please, think of your successor!

tYes, in many ways:

1. Have a netgroup created by your NIS administrator and "+" the netgroup in /etc/passwd
2. Explicitly "+" the users who should be allowed to log in to this host in /etc/passwd
3. "+" everyone (or a netgroup that is a superset) and explicitly "-" the users who SHOULD NOT be allowed to log in to this host in /etc/passwd

Number 1 is usually considered "more correct" from an admin standpoint
Number 2 is convenient if you don't have a lot of users who need to access this host and your admin team is slow creating/updating netgroups.
Number 3 is best if there are a few users who should be excluded but everyone else (or everyone else in a specific netgroup) should have access - e.g. denying an intern access to the NIS master server :-)

(If you have had the misfortune to be dropped into a NIS environment and don't have much experience with it I suggest picking up a copy of the O'Reilly "Managing NFS & NIS" Book - http://oreilly.com/catalog/9781565925106 - It's a good bet if you're in a NIS shop someone has a copy laying around :)