Jump to content United States-English
HP.com Home Products and Services Support and Drivers Solutions How to Buy
» Contact HP
More options
HP.com home
HP-UX Reference > N

nsswitch.conf(4)

HP-UX 11i Version 3: February 2007
» 

Technical documentation

» Feedback
Content starts here

 » Table of Contents

 » Index

NAME

nsswitch.conf — configuration file for the name-service switch

SYNOPSIS

/etc/nsswitch.conf

DESCRIPTION

The operating system uses a number of "databases" of information about hosts, users (passwd), groups and so forth. Data for these can come from a variety of sources: host-names and -addresses, for example, may be found in /etc/hosts, NIS, LDAP, or DNS. One or more sources may be used for each database; the sources and their lookup order are specified in the /etc/nsswitch.conf file.

The following databases use the switch:

Database

Used by

aliases

sendmail

automount

automount

group

getgrnam()

hosts

gethostbyname()

ipnodes

getipnodebyname()

netgroup

innetgr()

networks

getnetbyname()

passwd

getpwnam(), getspnam()

protocols

getprotobyname()

publickey

getpublickey(), secure_rpc()

rpc

getrpcbyname()

sendmailvars

sendmail

services

getservbyname()

The following sources may be used:

Source

Uses

files

/etc/hosts, /etc/passwd, and so forth

nis

NIS (YP)

ldap

LDAP Directory Server

dns

Valid only for hosts, ipnodes; uses the Internet Domain Name Service.

compat

Valid only for passwd and group; implements + and -.

(See Interaction with +/- syntax below)

There is an entry in /etc/nsswitch.conf for each database. Typically these entries will be simple, like protocols: files or networks: files nis. However, when multiple sources are specified it is sometimes necessary to define precisely the circumstances under which each source will be tried. A source can return one of the following codes:

Status

Meaning

SUCCESS

Requested database entry was found

UNAVAIL

Source is not responding or corrupted

NOTFOUND

Source responded "no such entry"

TRYAGAIN

Source is busy, might respond to retries

For each status code, two actions are possible:

Action

Meaning

continue

Try the next source in the list

return

Return now

The complete syntax of an entry is

<entry> ::= <database> ":" [<source> [<criteria>]]* <source> <criteria> ::= "[" <criterion>+ "]" <criterion> ::= <status> "=" <action> <status> ::= "success" | "notfound" | "unavail" | "tryagain" <action> ::= "return" | "continue"

Each entry occupies a single line in the file. Lines that are blank, or that start with white space character are ignored. Everything on a line following a # character is also ignored; the # character can begin anywhere in a line, to be used to begin comments. The database and source names are case-sensitive, but action and status names are case-insensitive.

The default criteria are to continue on anything except SUCCESS; in other words, [SUCCESS=return NOTFOUND=continue UNAVAIL=continue TRYAGAIN=continue].

The default, or explicitly specified, criteria are meaningless following the last source in an entry; and are ignored since the action is always to return to the caller irrespective of the status code the source returns.

Interaction with netconfig

In order to ensure that they all return consistent results based on the inet family of entries, gethostbyname(), getservbyname(), and netdir_getbyname() functions are all implemented in terms of the same internal switch library functions. These functions obtain the system-wide source lookup policy for hosts and services based on the inet family entries in netconfig(). For services and hosts only the "-" in the last column, which represents nametoaddr libraries, is supported.

NIS (YP) server in DNS-forwarding Mode

The NIS (YP) server can be run in "DNS-forwarding mode" (see rpc.nisd_resolv(1M)), where it forwards lookup requests to DNS for host-names and host-addresses that do not exist in its database. In this case, specifying nis as a source for hosts is sufficient to get DNS lookups; dns need not be specified explicitly as a source.

Interaction with +/- syntax

Releases prior to HP-UX 10.30 did not have the name-service switch support for passwd and group but did allow the user some policy control. In /etc/passwd one could have entries of the form +user (include the specified user from NIS passwd.byname), -user (exclude the specified user) and + (include everything, except excluded users, from NIS passwd.byname). The desired behavior was often "everything in the file followed by everything in NIS", expressed by a solitary + at the end of /etc/passwd. The switch provides an alternative for this case (passwd: files nis) that does not require + entries in /etc/passwd.

If this is not sufficient, the compat source provides full +/- semantics. It reads /etc/passwd for getpwnam() functions and, if it finds +/- entries, invokes an appropriate source. The only source supported by pseudo-database passwd_compat is nis.

The compat source also provides full +/- semantics for group; the relevant pseudo-database is group_compat.

Useful Configurations

The compiled-in default entries for all databases use NIS (YP) as the enterprise level name-service and are identical to those in the default configuration of this file:

passwd:

files nis

group:

files nis

hosts:

dns [NOTFOUND=return] nis [NOTFOUND=return] files

ipnodes:

dns [NOTFOUND=return] nis [NOTFOUND=return] files

networks:

nis [NOTFOUND=return] files

protocols:

nis [NOTFOUND=return] files

rpc:

nis [NOTFOUND=return] files

publickey:

nis [NOTFOUND=return] files

netgroup:

nis

automount:

files nis

aliases:

files nis

services:

files nis

sendmailvars:

files

The policy nis [NOTFOUND=return] files implies if nis is UNAVAIL, continue on to files, and if nis returns NOTFOUND, return to the caller"; in other words, treat nis as the authoritative source of information and try files only if nis is down.

If compatibility with the +/- syntax for passwd and group is required, simply modify the entries for passwd and group to:

passwd:

compat

group:

compat

To get information from the Internet Domain Name Service for hosts that are not listed in the enterprise level name-service, NIS, use the following configuration and set up the file /etc/resolv.conf. See resolver(4) for more details.

hosts:

nis dns [NOTFOUND=return] files

ipnodes:

nis dns [NOTFOUND=return] files

The file /etc/nsswitch.ldap contains an example configuration that can be copied to /etc/nsswitch.conf to set an LDAP policy. If the +/- netgroup syntax (used for access control as defined by nis) is desired, the administrator needs to configure libpam_authz.1 in the /etc/pam.conf file. See the ldapux(5) manpage for more information about LDAP-UX, pam_authz(5) manpage for more information on libpam_authz.1, and passwd(4) for more information about the +/- netgroup syntax. The ldapux(5) and pam_authz(5) manpages are in the LDAP-UX Integration product.

Enumeration -- getXXXent()

Many of the databases have enumeration functions: passwd has getpwent(), hosts has gethostent(), and so on. These were reasonable when the only source was files but often make little sense for hierarchically structured sources that contain large numbers of entries, much less for multiple sources.

The interfaces are still provided and the implementations strive to provide reasonable results, but the data returned may be incomplete (enumeration for hosts is simply not supported by the dns source), inconsistent (if multiple sources are used), very expensive (enumerating a passwd database of 5000 users is probably a bad idea) or formatted in an unexpected fashion. Furthermore, multiple threads in the same process using the same reentrant enumeration function (getXXXent_r() are supported) share the same enumeration position; if they interleave calls, they will enumerate disjoint subsets of the same database.

In general the use of the enumeration functions is deprecated. In the case of passwd, and group, it may sometimes be appropriate to use fgetgrent(), fgetpwent(), and fgetspent() (see getgrent(3C), and getpwent(3C), respectively), which use only the files source.

WARNINGS

Within each process that uses nsswitch.conf(), the entire file is read only once. If the file is later changed, the process will continue using the old configuration.

Programs that use the getXXbyYY() functions cannot be linked statically since the implementation of these functions requires dynamic linker functionality to access the shared objects /usr/lib/nss_SSS.sl.1 at run time.

Misspelled names of sources and databases will be treated as legitimate names of (most likely nonexistent) sources and databases.

The following functions do not use the switch: fgetgrent(), fgetpwent(), fgetspent(), getpw(), and putpwent().

The functions getipnodebyname() and getipnodebyaddr() were introduced with libc.2 and not found in libc.1.

Applications linked with libc.1 will display different default actions for NOTFOUND and TRYAGAIN. Applications linked with libc.1 will have the switch search terminate if the Name Service returns a result of NOTFOUND or TRYAGAIN.

This will be an issue for existing nsswitch.conf files that specify name service lookup criteria that contains no criterion between source entries.

Example: hosts: dns files

For applications linked with libc.1, the fallback to files will only occur if DNS returns UNAVAIL. For all other applications, the fallback to files will occur unless DNS returns SUCCESS.

For applications linked with libc.1 and other applications to have the same behavior, a criterion must be specified between source.

For libc.1 behavior:

hosts: dns [NOTFOUND=return TRYAGAIN=return] files

For the default system behavior:

hosts: dns [NOTFOUND=continue TRYAGAIN=continue] files

NIS+ is obsoleted on HP-UX 11i Version 3 and is no longer supported. LDAP is the recommended replacement for NIS+. HP fully supports the industry standard naming services based on LDAP.

Obsolescence

The ipnodes directive may not be supported in future HP-UX releases. In order to minimize the impact to applications, it is recommended that you have the same configuration for the hosts and the ipnodes directives.

AUTHOR

nsswitch.conf was developed by Sun Microsystems, Inc.

FILES

A source named SSS is implemented by a shared object named nss_SSS.1 that resides in /usr/lib.

/etc/nsswitch.conf

configuration file

/usr/lib/nss_compat.1

implements compat source

/usr/lib/nss_dns.1

implements dns source

/usr/lib/nss_files.1

implements files source

/usr/lib/nss_nis.1

implements nis source

/usr/lib/nss_ldap.1

implements ldap source

/etc/netconfig

configuration file for netdir() functions that redirects hosts/services policy to the switch

/etc/nsswitch.files

sample configuration file that uses files only

/etc/nsswitch.nis

sample configuration file that uses files and nis

/etc/nsswitch.ldap

sample configuration file that uses files and ldap

Printable version
Privacy statement Using this site means you accept its terms Feedback to webmaster
© 1983-2007 Hewlett-Packard Development Company, L.P.