1NSSWITCH.CONF(5) Linux Programmer's Manual NSSWITCH.CONF(5)
2
6 nsswitch.conf - System Databases and Name Service Switch configuration
7 file
8
10 Various functions in the C Library need to be configured to work cor‐
11 rectly in the local environment. Traditionally, this was done by using
12 files (e.g., `/etc/passwd'), but other nameservices (like the Network
13 Information Service (NIS) and the Domain Name Service (DNS)) became
14 popular, and were hacked into the C library, usually with a fixed
15 search order.
16 The Linux libc5 with NYS support and the GNU C Library 2.x (libc.so.6)
18 contain a cleaner solution of this problem. It is designed after a
19 method used by Sun Microsystems in the C library of Solaris 2. We fol‐
20 low their name and call this scheme "Name Service Switch" (NSS). The
21 sources for the "databases" and their lookup order are specified in the
22 /etc/nsswitch.conf file.
23 The following databases are available in the NSS:
25 aliases
27 Mail aliases, used by sendmail(8). Presently ignored.
28 ethers Ethernet numbers.
30 group Groups of users, used by getgrent(3) functions.
32 hosts Host names and numbers, used by gethostbyname(3) and similar
34 functions.
35 netgroup
37 Network wide list of hosts and users, used for access rules. C
38 libraries before glibc 2.1 only support netgroups over NIS.
39 networks
41 Network names and numbers, used by getnetent(3) functions.
42 passwd User passwords, used by getpwent(3) functions.
44 protocols
46 Network protocols, used by getprotoent(3) functions.
47 publickey
49 Public and secret keys for Secure_RPC used by NFS and NIS+.
50 rpc Remote procedure call names and numbers, used by getrpcbyname(3)
52 and similar functions.
53 services
55 Network services, used by getservent(3) functions.
56 shadow Shadow user passwords, used by getspnam(3).
58 An example /etc/nsswitch.conf (namely, the default used when /etc/nss‐
60 witch.conf is missing):
61 passwd: compat
63 group: compat
64 shadow: compat
65 hosts: dns [!UNAVAIL=return] files
67 networks: nis [NOTFOUND=return] files
68 ethers: nis [NOTFOUND=return] files
69 protocols: nis [NOTFOUND=return] files
70 rpc: nis [NOTFOUND=return] files
71 services: nis [NOTFOUND=return] files
72 The first column is the database. The rest of the line specifies how
74 the lookup process works. You can specify the way it works for each
75 database individually.
76 The configuration specification for each database can contain two dif‐
78 ferent items:
79 * The service specification like `files', `db', or `nis'.
80 * The reaction on lookup result like `[NOTFOUND=return]'.
81 For libc5 with NYS, the allowed service specifications are `files',
83 `nis', and `nisplus'. For hosts, you could specify `dns' as extra ser‐
84 vice, for passwd and group `compat', but not for shadow.
85 For glibc, you must have a file called /lib/libnss_SERVICE.so.X for
87 every SERVICE you are using. On a standard installation, you could use
88 `files', `db', `nis', and `nisplus'. For hosts, you could specify `dns'
89 as extra service, for passwd, group, and shadow `compat'. These ser‐
90 vices will not be used by libc5 with NYS. The version number X is 1
91 for glibc 2.0 and 2 for glibc 2.1.
92 The second item in the specification gives the user much finer control
94 on the lookup process. Action items are placed between two service
95 names and are written within brackets. The general form is
96 `[' ( `!'? STATUS `=' ACTION )+ `]'
98 where
100 STATUS => success | notfound | unavail | tryagain
102 ACTION => return | continue
103 The case of the keywords is insignificant. The STATUS values are the
105 results of a call to a lookup function of a specific service. They
106 mean:
107 success
109 No error occurred and the wanted entry is returned. The default
110 action for this is `return'.
111 notfound
113 The lookup process works ok but the needed value was not found.
114 The default action is `continue'.
115 unavail
117 The service is permanently unavailable. This can either mean
118 the needed file is not available, or, for DNS, the server is not
119 available or does not allow queries. The default action is
120 `continue'.
121 tryagain
123 The service is temporarily unavailable. This could mean a file
124 is locked or a server currently cannot accept more connections.
125 The default action is `continue'.
126 Interaction with +/- syntax (compat mode)
128 Linux libc5 without NYS does not have the name service switch but does
129 allow the user some policy control. In /etc/passwd you could have
130 entries of the form +user or +@netgroup (include the specified user
131 from the NIS passwd map), -user or -@netgroup (exclude the specified
132 user), and + (include every user, except the excluded ones, from the
133 NIS passwd map). Since most people only put a + at the end of
134 /etc/passwd to include everything from NIS, the switch provides a
135 faster alternative for this case (`passwd: files nis') which doesn't
136 require the single + entry in /etc/passwd, /etc/group, and /etc/shadow.
137 If this is not sufficient, the NSS `compat' service provides full +/-
138 semantics. By default, the source is `nis', but this may be overridden
139 by specifying `nisplus' as source for the pseudo-databases passwd_com‐
140 pat, group_compat and shadow_compat. This pseudo-databases are only
141 available in GNU C Library.
142
144 A service named SERVICE is implemented by a shared object library named
145 libnss_SERVICE.so.X that resides in /lib.
146 /etc/nsswitch.conf configuration file
148 /lib/libnss_compat.so.X implements `compat' source for glibc2
149 /lib/libnss_db.so.X implements `db' source for glibc2
150 /lib/libnss_dns.so.X implements `dns' source for glibc2
151 /lib/libnss_files.so.X implements `files' source for glibc2
152 /lib/libnss_hesiod.so.X implements `hesiod' source for glibc2
153 /lib/libnss_nis.so.X implements `nis' source for glibc2
154 /lib/libnss_nisplus.so.2 implements `nisplus' source for glibc 2.1
156 Within each process that uses nsswitch.conf, the entire file is read
157 only once; if the file is later changed, the process will continue
158 using the old configuration.
159 With Solaris, it isn't possible to link programs using the NSS Service
160 statically. With Linux, this is no problem.
161Linux 1999-01-17 NSSWITCH.CONF(5)