nsswitch.conf(4) Kernel Interfaces Manual nsswitch.conf(4)
NAME
nsswitch.conf - configuration file for the name-service switch
SYNOPSIS
DESCRIPTION
The operating system uses a number of "databases" of information about hosts, users groups and so forth. Data for these can come from a
variety of sources: host-names and -addresses, for example, may be found in NIS, LDAP, or DNS. One or more sources may be used for each
database; the sources and their lookup order are specified in the file.
The following databases use the switch:
Database Used by
The following sources may be used:
Source Uses
and so forth
NIS (YP)
LDAP Directory Server
Valid only for uses the Internet Domain Name Service.
Valid only for and implements and
(See below)
There is an entry in for each database. Typically these entries will be simple, like or However, when multiple sources are specified it is
sometimes necessary to define precisely the circumstances under which each source will be tried. A source can return one of the following
codes:
Status Meaning
Requested database entry was found
Source is not responding or corrupted
Source responded "no such entry"
Source is busy, might respond to retries
For each status code, two actions are possible:
Action Meaning
Try the next source in the list
Return now
The complete syntax of an entry is
<entry> ::= <database> ":" [<source> [<criteria>]]* <source>
<criteria> ::= "[" <criterion>+ "]"
<criterion> ::= <status> "=" <action>
<status> ::= "success" | "notfound" | "unavail" | "tryagain"
<action> ::= "return" | "continue"
Each entry occupies a single line in the file. Lines that are blank, or that start with white space character are ignored. Everything on
a line following a character is also ignored; the character can begin anywhere in a line, to be used to begin comments. The database and
source names are case-sensitive, but action and status names are case-insensitive.
The default criteria are to continue on anything except in other words,
The default, or explicitly specified, criteria are meaningless following the last source in an entry; and are ignored since the action is
always to return to the caller irrespective of the status code the source returns.
Interaction with netconfig
In order to ensure that they all return consistent results based on the family of entries, and functions are all implemented in terms of
the same internal switch library functions. These functions obtain the system-wide source lookup policy for and based on the family entries
in For and only the "-" in the last column, which represents nametoaddr libraries, is supported.
NIS (YP) server in DNS-forwarding Mode
The NIS (YP) server can be run in "DNS-forwarding mode" (see rpc.nisd_resolv(1M)), where it forwards lookup requests to DNS for host-names
and host-addresses that do not exist in its database. In this case, specifying as a source for is sufficient to get DNS lookups; need not
be specified explicitly as a source.
Interaction with +/- syntax
Releases prior to HP-UX 10.30 did not have the name-service switch support for passwd and group but did allow the user some policy control.
In one could have entries of the form (include the specified user from NIS passwd.byname), (exclude the specified user) and (include every-
thing, except excluded users, from NIS passwd.byname). The desired behavior was often "everything in the file followed by everything in
NIS", expressed by a solitary at the end of The switch provides an alternative for this case that does not require entries in
If this is not sufficient, the source provides full semantics. It reads for functions and, if it finds entries, invokes an appropriate
source. The only source supported by pseudo-database is
The source also provides full semantics for the relevant pseudo-database is
Useful Configurations
The compiled-in default entries for all databases use NIS (YP) as the enterprise level name-service and are identical to those in the
default configuration of this file:
The policy
implies "if is continue on to and if returns return to the caller"; in other words, treat as the authoritative source of information
and try only if is down.
Notes
The routines and do not follow the compiled-in default behaviour for database. These routines use as default source, unless explicitly
specified in the file.
If compatibility with the syntax for passwd and group is required, simply modify the entries for and to:
To get information from the Internet Domain Name Service
for hosts that are not listed in the enterprise level name-service, NIS, use the following configuration and set up the file See
resolver(4) for more details.
The file contains an example configuration that can be copied to to set an LDAP policy. If the netgroup syntax (used for access control as
defined by is desired, the administrator needs to configure in the file. See the ldapux(5) manpage for more information about LDAP-UX,
pam_authz(5) manpage for more information on and passwd(4) for more information about the netgroup syntax. The ldapux(5) and pam_authz(5)
manpages are in the LDAP-UX Integration product.
Enumeration -- getXXXent()
Many of the databases have enumeration functions: has has and so on. These were reasonable when the only source was but often make little
sense for hierarchically structured sources that contain large numbers of entries, much less for multiple sources.
The interfaces are still provided and the implementations strive to provide reasonable results, but the data returned may be incomplete
(enumeration for is simply not supported by the source), inconsistent (if multiple sources are used), very expensive (enumerating a data-
base of 5000 users is probably a bad idea) or formatted in an unexpected fashion. Furthermore, multiple threads in the same process using
the same reentrant enumeration function (are supported) share the same enumeration position; if they interleave calls, they will enumerate
disjoint subsets of the same database.
In general the use of the enumeration functions is deprecated. In the case of and it may sometimes be appropriate to use and (see get-
grent(3C), and getpwent(3C), respectively), which use only the source.
WARNINGS
Within each process that uses the entire file is read only once. If the file is later changed, the process will continue using the old
configuration.
Programs that use the functions cannot be linked statically since the implementation of these functions requires dynamic linker functional-
ity to access the shared objects at run time.
Misspelled names of sources and databases will be treated as legitimate names of (most likely nonexistent) sources and databases.
The following functions do not use the switch: and
The functions and were introduced with and not found in
Applications linked with will display different default actions for and Applications linked with will have the switch search terminate if
the Name Service returns a result of or
This will be an issue for existing files that specify name service lookup criteria that contains no criterion between source entries.
Example:
For applications linked with the fallback to files will only occur if returns For all other applications, the fallback to files will occur
unless returns
For applications linked with and other applications to have the same behavior, a criterion must be specified between source.
For behavior:
For the default system behavior:
NIS+ is obsoleted on HP-UX 11i Version 3 and is no longer supported. LDAP is the recommended replacement for NIS+. HP fully supports the
industry standard naming services based on LDAP.
Obsolescence
The directive may not be supported in future HP-UX releases. In order to minimize the impact to applications, it is recommended that you
have the same configuration for the and the directives.
AUTHOR
was developed by Sun Microsystems, Inc.
FILES
A source named SSS is implemented by a shared object named that resides in configuration file
implements
source
implements
source
implements
source
implements
source
implements
source
configuration file for
functions that redirects hosts/services policy to the switch
sample configuration file that uses
only
sample configuration file that uses
and
sample configuration file that uses
and
SEE ALSO
automount(1M), rpc.nisd_resolv(1M), sendmail(1M), getgrent(3C), gethostent(3N), getnetent(3N), getnetgrent(3C), getprotoent(3N), getpub-
lickey(3N), getpwent(3C), getrpcent(3C), getservent(3N), getspent(3C), netdir(3N), secure_rpc(3N), netconfig(4), resolver(4), shadow(4),
ypfiles(4).
ldapux(5) and pam_authz(5) in the LDAP-UX Integration product.
nsswitch.conf(4)