'\" te .\" Copyright (c) 2008, 2015, Oracle and/or its affiliates. All rights reserved. .TH nsswitch.conf 4 "23 Sep 2015" "SunOS 5.11" "File Formats" .SH NAME nsswitch.conf \- configuration file for the name service switch .SH SYNOPSIS .LP .nf \fBsvc:/system/name-service/switch\fR .fi .LP .nf \fB/etc/nsswitch.conf\fR .fi .SH DESCRIPTION .sp .LP The operating system uses a number of databases of information about hosts, ipnodes, users (\fBpasswd\fR(4), \fBshadow\fR(4), and \fBuser_attr\fR(4)), and groups. Data for these can come from a variety of \fBsources: hostnames\fR and host addresses, for example, can be found in \fB/etc/hosts\fR, \fBNIS\fR, \fBLDAP\fR, \fBDNS\fR, or Multicast \fBDNS\fR. Zero or more sources can be used for each database; the sources and their lookup order are specified in svc:/system/name-service/switch service. For the purposes of backwards compatibility, the \fB/etc/nsswitch.conf file\fR is regenerated from the SMF properties configured in the \fBsvc:/system/name-service/switch\fR service. The \fB/etc/nsswitch.conf\fR file is considered obsolete. .sp .LP The following databases use the \fBswitch\fR file: .sp .sp .TS tab(); cw(2.18i) cw(3.32i) lw(2.18i) lw(3.32i) . DatabaseUsed By \fBalias\fR\fBsendmail\fR(1M) \fBauth_attr\fR\fBgetauthnam\fR(3C) \fBautomount\fR\fBautomount\fR(1M) \fBbootparam\fR\fBrpc.bootparamd\fR(1M) \fBether\fR\fBethers\fR(3SOCKET) \fBgroup\fR\fBgetgrnam\fR(3C) \fBhost\fRT{ \fBgethostbyname\fR(3NSL), \fBgetaddrinfo\fR(3SOCKET). See \fBInteraction with netconfig\fR. T} \fBnetgroup\fR\fBinnetgr\fR(3C) \fBnetmask\fR\fBifconfig\fR(1M) \fBnetwork\fR\fBgetnetbyname\fR(3SOCKET) \fBpasswd\fRT{ \fBgetpwnam\fR(3C), \fBgetspnam\fR(3C), \fBgetusernam\fR(3C) T} \fBprof_attr\fR\fBgetprofnam\fR(3C), \fBgetexecprof\fR(3C) \fBproject\fRT{ \fBgetprojent\fR(3PROJECT), \fBgetdefaultproj\fR(3PROJECT), \fBinproj\fR(3PROJECT), \fBnewtask\fR(1), \fBsetproject\fR(3PROJECT) T} \fBprotocol\fR\fBgetprotobyname\fR(3SOCKET) \fBpublickey\fR\fBgetpublickey\fR(3NSL), \fBsecure_rpc\fR(3NSL) \fBrpc\fR\fBgetrpcbyname\fR(3NSL) \fBservice\fR\fBgetservbyname\fR(3SOCKET). See \fBInteraction with netconfig\fR. \fBuser_attr\fR\fBgetuserattr\fR(3C) .TE .sp .LP The following sources can be used: .sp .sp .TS tab(); cw(2.18i) cw(3.32i) lw(2.18i) lw(3.32i) . SourceUses \fBfiles\fRT{ \fB/etc/hosts\fR, \fB/etc/passwd\fR, \fB/etc/inet/ipnodes\fR, \fB/etc/shadow\fR, \fB/etc/security/auth_attr\fR, \fB/etc/user_attr\fR T} \fBnis\fR\fBNIS\fR(\fBYP\fR) \fBldap\fR\fBLDAP\fR \fBad\fRActive Directory \fBdns\fRT{ Valid only for hosts and ipnodes. Uses the Internet Domain Name Service. T} \fBmdns\fRT{ Valid only for hosts and ipnodes. Uses the Multicast Domain Name Service. T} \fBcompat\fRT{ The \fBcompat\fR source is obsolete. It implements \fB+\fR and \fB-\fR interaction from SunOS 4. The primary purpose of the \fBcompat\fR pseudo database has been replaced by the \fBpam_list\fR(5) module. See \fBpam_list\fR(5). T} .TE .sp .LP \fB/etc/inet/ipnodes\fR is a symbolic link to \fB/etc/hosts\fR. .sp .LP The \fBconfig\fR property group of the \fBsvc:/system/name-service/switch\fR service contains the configuration for the \fBnsswitch.conf\fR file. .sp .LP The \fBconfig/default\fR property sets the default property for all \fBnsswitch\fR databases, while the other properties can be used to override the default property if desired. .sp .LP For instance: .sp .in +2 .nf config/default set to "files", and config/host set to "files dns" defaults all databases to local files database access, except for the host database which will search files first and dns second, if dns access is configured. .fi .in -2 .sp .sp .LP The following single-valued properties are supported: .sp .in +2 .nf config/default Default db configuration config/host Override for host db config/password Override for passwd db config/group Override for group db config/network Override for network db config/protocol Override for protocol db config/rpc Override for rpc db config/ether Override for ether db config/netmask Override for netmask db config/bootparam Override for bootparam db config/publickey Override for publickey db config/netgroup Override for netgroup db config/automount Override for automount db config/alias Override for alias db config/service Override for service db config/project Override for project db config/auth_attr Override for auth_attr db config/prof_attr Override for prof_attr db config/tnrhtp Override for tnrhtp db config/tnrhdb Override for tnrhdb db .fi .in -2 .sp .sp .LP The \fBcompat\fR switch source is considered obsolete. It has been replaced with the \fBpam_list\fR(5) module. The \fBcompat\fR module can still be enabled with the following properties: .sp .in +2 .nf config/enable_passwd_compat Enable passwd compat config/enable_group_compat Enable group compat .fi .in -2 .sp .sp .LP Typically the property values are simple, such as \fB"files" "files nis"\fR. However, when multiple sources are specified, it is sometimes necessary to define precisely the circumstances under which each source is tried. A source can return one of the following codes: .sp .sp .TS tab(); cw(2.18i) cw(3.32i) lw(2.18i) lw(3.32i) . StatusMeaning \fBSUCCESS\fRRequested database entry was found. \fBUNAVAIL\fRT{ Source is not configured on this system or internal failure. T} \fBNOTFOUND\fRSource responded "\fBno such entry\fR" \fBTRYAGAIN\fRT{ Source is busy or not responding, might respond to retries. T} .TE .sp .LP For each status code, two actions are possible: .sp .sp .TS tab(); cw(2.18i) cw(3.32i) lw(2.18i) lw(3.32i) . ActionMeaning \fBcontinue\fRTry the next source in the list. \fBreturn\fRReturn now. .TE .sp .LP Additionally, for \fBTRYAGAIN\fR only, the following actions are possible: .sp .sp .TS tab(); cw(2.18i) cw(3.32i) lw(2.18i) lw(3.32i) . ActionMeaning \fBforever\fRRetry the current source forever. \fIn\fRT{ Retry the current source \fIn\fR more times, where \fIn\fR is an integer between \fB0\fR and \fBMAX_INT\fR (that is, 2.14 billion). After \fIn\fR retries has been exhausted, the \fBTRYAGAIN\fR action transitions to \fBcontinue\fR, until a future request receives a response, at which time \fBTRYAGAIN\fR=\fIn\fR is restored. T} .TE .sp .LP The complete syntax of an entry is: .sp .in +2 .nf ::= ":" [ []]* ::= "[" + "]" ::= "=" ::= "success" | "notfound" | "unavail" | "tryagain" .fi .in -2 .sp .LP For every status except \fBTRYAGAIN\fR, the action syntax is: .sp .in +2 .nf ::= "return" | "continue" .fi .in -2 .sp .LP For the \fBTRYAGAIN\fR status, the action syntax is: .sp .in +2 .nf ::= "return" | "continue" | "forever" | ::= 0...MAX_INT .fi .in -2 .sp .LP Each property is a single valued string. The names are case-sensitive, but and names are case-insensitive. .sp .LP If a database property and the default property are both absent, the system defaults to the \fB"files"\fR source. Additionally, if the name service cache service (\fBsvc:/system/name-service/cache\fR) is disabled, then the name service switch may revert to a \fB"files"\fR configuration for all databases. .sp .LP The default criteria for \fBDNS\fR and the \fBNIS\fR server in "DNS-forwarding mode" is [\fBSUCCESS\fR=return \fBNOTFOUND\fR=continue \fBUNAVAIL\fR=continue \fBTRYAGAIN\fR=3]. .sp .LP The default criteria for all other sources is [\fBSUCCESS\fR=return \fBNOTFOUND\fR=continue \fBUNAVAIL\fR=continue \fBTRYAGAIN\fR=forever]. .sp .LP The default, or explicitly specified, criteria are meaningless following the last source in an entry; and they are ignored, since the action is always to return to the caller irrespective of the status code the source returns. .SS "Interaction with \fBnetconfig\fR" .sp .LP In order to ensure that they all return consistent results, \fBgethostbyname\fR(3NSL), \fBgetaddrinfo\fR(3SOCKET), and \fBgetservbyname\fR(3SOCKET) functions are all implemented in terms of the same internal library function. This function obtains the system-wide source lookup policy for \fBhosts\fR, \fBipnodes\fR, and \fBservices\fR based on the \fBinet\fR family entries in \fBnetconfig\fR(4) and uses the switch entries only if the \fBnetconfig\fR entries have a \fB-\fR (hyphen) in the last column for \fBnametoaddr\fR libraries. See the nsswitch.conf(4) section in \fBgethostbyname\fR(3NSL) and \fBgetservbyname\fR(3SOCKET) for details. .SS "Interaction with server in DNS-forwarding Mode" .sp .LP The \fBNIS\fR (\fBYP\fR) server can be run in DNS-forwarding mode, where it forwards lookup requests to \fB DNS\fR for \fBhost-names\fR and \fB-addresses\fR that do not exist in its database. In this case, specifying \fBnis\fR as a source for \fBhosts\fR is sufficient to get \fBDNS\fR lookups; \fBdns\fR need not be specified explicitly as a source. .SS "Interaction with Password Aging" .sp .LP When password aging is turned on, only a limited set of possible name services are supported and must follow those rules: .RS +4 .TP .ie t \(bu .el o \fBpasswd\fR line must have 1, 2 or 3 entries .RE .RS +4 .TP .ie t \(bu .el o First \fBpasswd\fR entry must be files .RE .RS +4 .TP .ie t \(bu .el o \fBpasswd\fR entries other than files, \fBnis\fR, \fBldap\fR, and \fBcompat\fR are ignored and skipped during password update. (It is necessary to use source-specific tool to update password in such database). .RE .sp .LP Any other settings causes the \fBpasswd\fR(1) command to fail when it attempts to change the password after expiration and prevents the user from logging in. These are the \fBonly\fR permitted settings when password aging has been turned on. Otherwise, you can work around incorrect \fBpasswd\fR: lines by using the \fB-r repository\fR argument to the \fBpasswd\fR(1) command and using \fBpasswd -r repository\fR to override the \fBnsswitch.conf\fR settings and specify in which name service you want to modify your password. .SS "Interaction with +/- syntax" .sp .LP The \fB+/-\fR syntax is considered obsolete. It has been replaced both by the \fBnsswitch\fR configuration and the \fBpam_list\fR(5) module. This syntax will be removed in a future release. .sp .LP Releases prior to SunOS 5.0 did not have the name service switch but did allow the user some policy control. In \fB/etc/passwd\fR one could have entries of the form \fI+user\fR (include the specified user from \fBNIS\fR passwd.byname), \fI-user\fR (exclude the specified user) and \fB+\fR (include everything, except excluded users, from \fBNIS\fR passwd.byname). The desired behavior was often \fBeverything in the file followed by everything in NIS\fR, expressed by a solitary \fB+\fR at the end of \fB/etc/passwd\fR. The switch provides an alternative for this case (\fBpasswd: files nis\fR) that does not require \fB+\fR entries in \fB/etc/passwd\fR and \fB/etc/shadow\fR (the latter is a new addition to SunOS 5.0, see \fBshadow\fR(4)). .sp .LP If this is not sufficient, the \fBNIS/YP\fR compatibility source provides full \fB+/-\fR semantics. It reads \fB/etc/passwd\fR for \fBgetpwnam\fR(3C) functions and \fB/etc/shadow\fR for \fBgetspnam\fR(3C) functions and, if it finds \fB+/-\fR entries, invokes an appropriate source. By default, the source is \fBnis\fR, but this can be overridden by specifying \fBldap\fR as the source for the pseudo-database \fBpasswd_compat\fR. .sp .LP In \fBcompat\fR mode, for every \fB/etc/passwd\fR entry, there must be a corresponding entry in the \fB/etc/shadow\fR file. .sp .LP The NIS/YP compatibility source also provides full \fB+/-\fR semantics for \fBgroup\fR; the relevant pseudo-database is \fBgroup_compat\fR. .SS "Interaction with Location Profiles" .sp .LP The \fBnsswitch\fR configuration is managed in Location profiles (refer to \fBnetcfg\fR(1M) for more information about location profiles). These profiles are either fixed, meaning the network configuration is being managed in the traditional way, or reactive, meaning the network configuration is being managed automatically, reacting to changes in the network environment according to policy rules specified in the profiles. .sp .LP When a fixed location (there can currently be only one, the DefaultFixed location) is active, changes made to the SMF repository will be applied to the location when it is disabled, and thus will be restored if that location is later re-enabled. .sp .LP When a reactive location is active, changes should not be applied directly to the SMF repository; these changes will not be preserved in the location profile, and will thus be lost if the location is disabled, or if the system's network configuration, as managed by \fBsvc:/network/physical:default\fR and \fBsvc:/network/location:default\fR, is refreshed or restarted. Changes should instead be applied to the location itself, using the \fBnetcfg\fR(1M) command; this will save the change to the location profile repository, and will also apply it to the SMF repository (if the change is made to the currently active location). .sp .LP The \fBnsswitch\fR configuration data is stored as the name of a file in the \fBnsswitch.conf\fR format. That name is stored in the \fBnameservices-config-file\fR property of a location profile. .SS "Hard-wired Policies" .sp .LP The compiled-in default entries for all databases is \fB"files"\fR. .SS "Useful Configuration Notes" .sp .LP The files source for the ipnodes and hosts databases is identical, as \fB/etc/inet/ipnodes\fR is a symbolic link to \fB/etc/hosts\fR. The host property is used for host lookups. .sp .LP When using Active Directory, \fBdns\fR is required to perform hosts resolution. .sp .LP In order to get information from the Internet Domain Name Service for hosts that are not listed in the enterprise level name service \fBLDAP\fR, use the following configuration and set up the \fB/etc/resolv.conf\fR file (see \fBresolv.conf\fR(4) for more details): .sp .ne 2 .mk .na \fBhosts:\fR .ad .RS 10n .rt files dns .RE .SS "Enumeration - \fBgetXXXent()\fR" .sp .LP Many of the databases have enumeration functions: \fBpasswd\fR has \fBgetpwent()\fR, \fBhosts\fR has \fBgethostent()\fR, and so on. These were reasonable when the only source was \fBfiles\fR but often make little sense for hierarchically structured sources that contain large numbers of entries, much less for multiple sources. The interfaces are still provided and the implementations strive to provide reasonable results, but the data returned can be incomplete (enumeration for \fBhosts\fR is simply not supported by the \fBdns\fR source), inconsistent (if multiple sources are used), formatted in an unexpected fashion (for a host with a canonical name and three aliases, a source might return four hostents, and they might not be consecutive), or very expensive (enumerating a \fBpasswd\fR database of 5,000 users is probably a bad idea). Furthermore, multiple threads in the same process using the same reentrant enumeration function (\fBgetXXXent_r()\fR are supported beginning with SunOS 5.3) share the same enumeration position; if they interleave calls, they enumerate disjoint subsets of the same database. .sp .LP In general, the use of the enumeration functions is deprecated. In the case of \fBpasswd\fR, \fBshadow\fR, and \fBgroup\fR, it might sometimes be appropriate to use \fBfgetgrent()\fR, \fBfgetpwent()\fR, and \fBfgetspent()\fR (see \fBgetgrnam\fR(3C), \fBgetpwnam\fR(3C), and \fBgetspnam\fR(3C), respectively), which use only the \fBfiles\fR source. .SH FILES .sp .LP A source named SSS is implemented by a shared object named \fBnss_SSS.so.1\fR that resides in \fB/usr/lib\fR. .sp .ne 2 .mk .na \fB\fB/etc/nsswitch.conf\fR\fR .ad .RS 28n .rt Configuration file. (Obsolete.) .RE .sp .ne 2 .mk .na \fB\fB/usr/lib/nss_compat.so.1\fR\fR .ad .RS 28n .rt Implements \fBcompat\fR source. .RE .sp .ne 2 .mk .na \fB\fB/usr/lib/nss_dns.so.1\fR\fR .ad .RS 28n .rt Implements \fBdns\fR source. .RE .sp .ne 2 .mk .na \fB\fB/usr/lib/nss_files.so.1\fR\fR .ad .RS 28n .rt Implements \fBfiles\fR source. .RE .sp .ne 2 .mk .na \fB\fB/usr/lib/nss_mdns.so.1\fR\fR .ad .RS 28n .rt Implements \fBmdns\fR source. .RE .sp .ne 2 .mk .na \fB\fB/usr/lib/nss_nis.so.1\fR\fR .ad .RS 28n .rt Implements \fBnis\fR source. .RE .sp .ne 2 .mk .na \fB\fB/usr/lib/nss_ldap.so.1\fR\fR .ad .RS 28n .rt Implements \fBldap\fR source. .RE .sp .ne 2 .mk .na \fB\fB/usr/lib/nss_ad.so.1\fR\fR .ad .RS 28n .rt Implements ad source. .RE .sp .ne 2 .mk .na \fB\fB/usr/lib/nss_user.so.1\fR\fR .ad .RS 28n .rt Implements \fBuser\fR source. .RE .sp .ne 2 .mk .na \fB\fB/etc/netconfig\fR\fR .ad .RS 28n .rt Configuration file for \fBnetdir\fR(3NSL) functions that redirects hosts/devices policy to the switch. .RE .sp .ne 2 .mk .na \fB\fB/etc/nsswitch.files\fR\fR .ad .RS 28n .rt Sample configuration file that uses \fBfiles\fR only. .RE .sp .ne 2 .mk .na \fB\fB/etc/nsswitch.nis\fR\fR .ad .RS 28n .rt Sample configuration file that uses \fBfiles\fR and \fBnis\fR. .RE .sp .ne 2 .mk .na \fB\fB/etc/nsswitch.ldap\fR\fR .ad .RS 28n .rt Sample configuration file that uses \fBfiles\fR and \fBldap\fR. .RE .sp .ne 2 .mk .na \fB\fB/etc/nsswitch.ad\fR\fR .ad .RS 28n .rt Sample configuration file that uses \fBfiles\fR and \fBad\fR. .RE .sp .ne 2 .mk .na \fB\fB/etc/nsswitch.dns\fR\fR .ad .RS 28n .rt Sample configuration file that uses \fBfiles\fR, \fBdns\fR and \fBmdns\fR (\fBdns\fR and \fBmdns\fR only for hosts). .RE .SH SEE ALSO .sp .LP \fBkpasswd\fR(1), \fBnewtask\fR(1), \fBpasswd\fR(1), \fBautomount\fR(1M), \fBifconfig\fR(1M), \fBmdnsd\fR(1M), \fBnscfg\fR(1M), \fBnetcfg\fR(1M), \fBrpc.bootparamd\fR(1M), \fBsendmail\fR(1M), \fBgetgrnam\fR(3C), \fBgetnetgrent\fR(3C), \fBgetpwnam\fR(3C), \fBgetspnam\fR(3C), \fBgethostbyname\fR(3NSL), \fBgetpublickey\fR(3NSL), \fBgetrpcbyname\fR(3NSL), \fBnetdir\fR(3NSL), \fBsecure_rpc\fR(3NSL), \fBgetprojent\fR(3PROJECT), \fBgetdefaultproj\fR(3PROJECT), \fBinproj\fR(3PROJECT), \fBsetproject\fR(3PROJECT), \fBgetauthnam\fR(3C), \fBgetexecprof\fR(3C), \fBgetprofnam\fR(3C), \fBgetuserattr\fR(3C), \fBgetusernam\fR(3C), \fBethers\fR(3SOCKET), \fBgetaddrinfo\fR(3SOCKET), \fBgetnetbyname\fR(3SOCKET), \fBgetprotobyname\fR(3SOCKET), \fBgetservbyname\fR(3SOCKET), \fBauth_attr\fR(4), \fBhosts\fR(4), \fBnetconfig\fR(4), \fBproject\fR(4), \fBresolv.conf\fR(4), \fBuser_attr\fR(4), \fBypfiles\fR(4), \fBad\fR(5), \fBldap\fR(5), \fBpam_list\fR(5) .SH NOTES .sp .LP Within each process that uses \fBnsswitch.conf\fR, the entire file is read only once; if the file is later changed, the process continues using the old configuration. .sp .LP The use of both \fBnis\fR and \fBldap\fR as sources for the same database is strongly discouraged since both the name services are expected to store similar information and the lookups on the database can yield different results depending on which name service is operational at the time of the request. .sp .LP Do not use the \fBldap\fR and \fBad\fR keywords together when the Solaris LDAP client uses schema mapping to talk to Active Directory. .sp .LP Misspelled names of sources and databases are treated as legitimate names of (most likely nonexistent) sources and databases. .sp .LP \fBnsswitch.conf\fR does not control the name service configuration for everything in Solaris. .sp .LP The following functions do \fBnot\fR use the switch: \fBfgetgrent\fR(3C), \fBfgetprojent\fR(3PROJECT), \fBfgetpwent\fR(3C), \fBfgetspent\fR(3C), \fBgetpw\fR(3C), \fBputpwent\fR(3C), \fBshadow\fR(4).