nsswitch.conf.4 (2010 09)

n
nsswitch.conf(4) nsswitch.conf(4)
passwd: compat
group: compat
To get information from the Internet Domain Name Service for hosts that are not listed in the enterprise
level name-service, NIS, use the following configuration and set up the file
/etc/resolv.conf
. See
resolver (4) for more details.
hosts: nis dns [NOTFOUND=return] files
ipnodes: nis dns [NOTFOUND=return] files
The file /etc/nsswitch.ldap
contains an example configuration that can be copied to
/etc/nsswitch.conf
to set an LDAP policy. If the
+/- netgroup syntax (used for access control as
defined by
nis) is desired, the administrator needs to configure
libpam_authz.1
in the
/etc/pam.conf
file. See the ldapux (5) manpage for more information about LDAP-UX, pam_authz (5)
manpage for more information on
libpam_authz.1
, and passwd (4) for more information about the
+/-
netgroup syntax. The ldapux (5) and pam_authz (5) manpages are in the LDAP-UX Integration product.
Enumeration -- getXXXent( )
Many of the databases have enumeration functions:
passwd
has getpwent(), hosts has gethos-
tent(), and so on. These were reasonable when the only source was
files but often make little sense
for hierarchically structured sources that contain large numbers of entries, much less for multiple
sources.
The interfaces are still provided and the implementations strive to provide reasonable results, but the
data returned may be incomplete (enumeration for
hosts is simply not supported by the dns source),
inconsistent (if multiple sources are used), very expensive (enumerating a passwd database of 5000
users is probably a bad idea) or formatted in an unexpected fashion. Furthermore, multiple threads in
the same process using the same reentrant enumeration function (getXXXent_r() are supported)
share the same enumeration position; if they interleave calls, they will enumerate disjoint subsets of the
same database.
In general the use of the enumeration functions is deprecated. In the case of
passwd, and
group,it
may sometimes be appropriate to use
fgetgrent(), fgetpwent(), and fgetspent() (see
getgrent (3C), and getpwent (3C), respectively), which use only the
files source.
WARNINGS
Within each process that uses
nsswitch.conf()
, the entire file is read only once. If the file is later
changed, the process will continue using the old configuration.
Programs that use the
getXXbyYY() functions cannot be linked statically since the implementation of
these functions requires dynamic linker functionality to access the shared objects
/usr/lib/nss_SSS.sl.1
at run time.
Misspelled names of sources and databases will be treated as legitimate names of (most likely nonex-
istent) sources and databases.
The following functions do not use the switch:
fgetgrent(), fgetpwent(), fgetspent(),
getpw(), and putpwent().
The functions
getipnodebyname() and getipnodebyaddr()
were introduced with libc.2 and
not found in
libc.1.
Applications linked with
libc.1 will display different default actions for NOTFOUND and TRYAGAIN.
Applications linked with libc.1 will have the switch search terminate if the Name Service returns a
result of NOTFOUND or TRYAGAIN.
This will be an issue for existing
nsswitch.conf files that specify name service lookup criteria that
contains no criterion between source entries.
Example:
hosts: dns files
For applications linked with libc.1, the fallback to files will only occur if DNS returns UNAVAIL.For
all other applications, the fallback to files will occur unless DNS returns SUCCESS.
For applications linked with
libc.1 and other applications to have the same behavior, a criterion must
be specified between source.
For
libc.1 behavior:
hosts: dns [NOTFOUND=return TRYAGAIN=return] files
HP-UX 11i Version 3: September 2010 − 3 − Hewlett-Packard Company 3