|
 |
8a8cfb |
commit 4b7c74179c8928d971d370e1137d202f891a4cf5
|
|
|
8a8cfb |
Author: Carlos O'Donell <carlos@redhat.com>
|
|
|
8a8cfb |
Date: Wed Mar 20 12:40:18 2019 -0400
|
|
|
8a8cfb |
|
|
|
8a8cfb |
nss: Make nsswitch.conf more distribution friendly.
|
|
|
8a8cfb |
|
|
|
8a8cfb |
The current default nsswitch.conf file provided by glibc is not very
|
|
|
8a8cfb |
distribution friendly. The file contains some minimal directives that no
|
|
|
8a8cfb |
real distribution uses. This update aims to provide a rich set of
|
|
|
8a8cfb |
comments which are useful for all distributions, and a broader set of
|
|
|
8a8cfb |
service defines which should work for all distributions.
|
|
|
8a8cfb |
|
|
|
8a8cfb |
Tested defaults on x86_64 and they work. The nsswitch.conf file more
|
|
|
8a8cfb |
closely matches what we have in Fedora now, and I'll adjust Fedora to
|
|
|
8a8cfb |
use this version with minor changes to enable Fedora-specific service
|
|
|
8a8cfb |
providers.
|
|
|
8a8cfb |
|
|
|
8a8cfb |
v2
|
|
|
8a8cfb |
- Add missing databases to manual.
|
|
|
8a8cfb |
- Add link to manual from default nsswitch.conf.
|
|
|
8a8cfb |
- Sort nsswitch.conf according to most used database first.
|
|
|
8a8cfb |
|
|
|
8a8cfb |
v3
|
|
|
8a8cfb |
- Only mention implemented services in 'NSS Basics.'
|
|
|
8a8cfb |
- Mention 'automount' in 'Services in the NSS configuration.'
|
|
|
8a8cfb |
- Sort services in alphabetical order.
|
|
|
8a8cfb |
|
|
|
8a8cfb |
v4
|
|
|
8a8cfb |
- Project name is 'Samba'.
|
|
|
8a8cfb |
|
|
|
8a8cfb |
v5
|
|
|
8a8cfb |
- Fix typo in manual/nss.texi.
|
|
|
8a8cfb |
|
|
|
8a8cfb |
v6
|
|
|
8a8cfb |
- Fix another typo in manual/nss.texi. Ran spell checker this time.
|
|
|
8a8cfb |
|
|
|
8a8cfb |
diff --git a/manual/nss.texi b/manual/nss.texi
|
|
|
8a8cfb |
index 164ae33246..821469a78a 100644
|
|
|
8a8cfb |
--- a/manual/nss.texi
|
|
|
8a8cfb |
+++ b/manual/nss.texi
|
|
|
8a8cfb |
@@ -56,13 +56,17 @@ functions to access the databases.
|
|
|
8a8cfb |
@noindent
|
|
|
8a8cfb |
The databases available in the NSS are
|
|
|
8a8cfb |
|
|
|
8a8cfb |
+@cindex aliases
|
|
|
8a8cfb |
@cindex ethers
|
|
|
8a8cfb |
@cindex group
|
|
|
8a8cfb |
+@cindex gshadow
|
|
|
8a8cfb |
@cindex hosts
|
|
|
8a8cfb |
+@cindex initgroups
|
|
|
8a8cfb |
@cindex netgroup
|
|
|
8a8cfb |
@cindex networks
|
|
|
8a8cfb |
-@cindex protocols
|
|
|
8a8cfb |
@cindex passwd
|
|
|
8a8cfb |
+@cindex protocols
|
|
|
8a8cfb |
+@cindex publickey
|
|
|
8a8cfb |
@cindex rpc
|
|
|
8a8cfb |
@cindex services
|
|
|
8a8cfb |
@cindex shadow
|
|
|
8a8cfb |
@@ -75,16 +79,22 @@ Ethernet numbers,
|
|
|
8a8cfb |
@comment @pxref{Ethernet Numbers}.
|
|
|
8a8cfb |
@item group
|
|
|
8a8cfb |
Groups of users, @pxref{Group Database}.
|
|
|
8a8cfb |
+@item gshadow
|
|
|
8a8cfb |
+Group passphrase hashes and related information.
|
|
|
8a8cfb |
@item hosts
|
|
|
8a8cfb |
Host names and numbers, @pxref{Host Names}.
|
|
|
8a8cfb |
+@item initgroups
|
|
|
8a8cfb |
+Supplementary group access list.
|
|
|
8a8cfb |
@item netgroup
|
|
|
8a8cfb |
Network wide list of host and users, @pxref{Netgroup Database}.
|
|
|
8a8cfb |
@item networks
|
|
|
8a8cfb |
Network names and numbers, @pxref{Networks Database}.
|
|
|
8a8cfb |
-@item protocols
|
|
|
8a8cfb |
-Network protocols, @pxref{Protocols Database}.
|
|
|
8a8cfb |
@item passwd
|
|
|
8a8cfb |
User identities, @pxref{User Database}.
|
|
|
8a8cfb |
+@item protocols
|
|
|
8a8cfb |
+Network protocols, @pxref{Protocols Database}.
|
|
|
8a8cfb |
+@item publickey
|
|
|
8a8cfb |
+Public keys for Secure RPC.
|
|
|
8a8cfb |
@item rpc
|
|
|
8a8cfb |
Remote procedure call names and numbers.
|
|
|
8a8cfb |
@comment @pxref{RPC Database}.
|
|
|
8a8cfb |
@@ -96,8 +106,8 @@ User passphrase hashes and related information.
|
|
|
8a8cfb |
@end table
|
|
|
8a8cfb |
|
|
|
8a8cfb |
@noindent
|
|
|
8a8cfb |
-There will be some more added later (@code{automount}, @code{bootparams},
|
|
|
8a8cfb |
-@code{netmasks}, and @code{publickey}).
|
|
|
8a8cfb |
+@c We currently don't implement automount, netmasks, or bootparams.
|
|
|
8a8cfb |
+More databases may be added later.
|
|
|
8a8cfb |
|
|
|
8a8cfb |
@node NSS Configuration File, NSS Module Internals, NSS Basics, Name Service Switch
|
|
|
8a8cfb |
@section The NSS Configuration File
|
|
|
8a8cfb |
@@ -159,6 +169,10 @@ these files since they should be placed in a directory where they are
|
|
|
8a8cfb |
found automatically. Only the names of all available services are
|
|
|
8a8cfb |
important.
|
|
|
8a8cfb |
|
|
|
8a8cfb |
+Lastly, some system software may make use of the NSS configuration file
|
|
|
8a8cfb |
+to store their own configuration for similar purposes. Examples of this
|
|
|
8a8cfb |
+include the @code{automount} service which is used by @code{autofs}.
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
@node Actions in the NSS configuration, Notes on NSS Configuration File, Services in the NSS configuration, NSS Configuration File
|
|
|
8a8cfb |
@subsection Actions in the NSS configuration
|
|
|
8a8cfb |
|
|
|
8a8cfb |
diff --git a/nss/nsswitch.conf b/nss/nsswitch.conf
|
|
|
8a8cfb |
index 39ca88bf51..f553588114 100644
|
|
|
8a8cfb |
--- a/nss/nsswitch.conf
|
|
|
8a8cfb |
+++ b/nss/nsswitch.conf
|
|
|
8a8cfb |
@@ -1,20 +1,69 @@
|
|
|
8a8cfb |
+#
|
|
|
8a8cfb |
# /etc/nsswitch.conf
|
|
|
8a8cfb |
#
|
|
|
8a8cfb |
-# Example configuration of GNU Name Service Switch functionality.
|
|
|
8a8cfb |
+# An example Name Service Switch config file. This file should be
|
|
|
8a8cfb |
+# sorted with the most-used services at the beginning.
|
|
|
8a8cfb |
#
|
|
|
8a8cfb |
+# Valid databases are: aliases, ethers, group, gshadow, hosts,
|
|
|
8a8cfb |
+# initgroups, netgroup, networks, passwd, protocols, publickey,
|
|
|
8a8cfb |
+# rpc, services, and shadow.
|
|
|
8a8cfb |
+#
|
|
|
8a8cfb |
+# Valid service provider entries include (in alphabetical order):
|
|
|
8a8cfb |
+#
|
|
|
8a8cfb |
+# compat Use /etc files plus *_compat pseudo-db
|
|
|
8a8cfb |
+# db Use the pre-processed /var/db files
|
|
|
8a8cfb |
+# dns Use DNS (Domain Name Service)
|
|
|
8a8cfb |
+# files Use the local files in /etc
|
|
|
8a8cfb |
+# hesiod Use Hesiod (DNS) for user lookups
|
|
|
8a8cfb |
+# nis Use NIS (NIS version 2), also called YP
|
|
|
8a8cfb |
+# nisplus Use NIS+ (NIS version 3)
|
|
|
8a8cfb |
+#
|
|
|
8a8cfb |
+# See `info libc 'NSS Basics'` for more information.
|
|
|
8a8cfb |
+#
|
|
|
8a8cfb |
+# Commonly used alternative service providers (may need installation):
|
|
|
8a8cfb |
+#
|
|
|
8a8cfb |
+# ldap Use LDAP directory server
|
|
|
8a8cfb |
+# myhostname Use systemd host names
|
|
|
8a8cfb |
+# mymachines Use systemd machine names
|
|
|
8a8cfb |
+# mdns*, mdns*_minimal Use Avahi mDNS/DNS-SD
|
|
|
8a8cfb |
+# resolve Use systemd resolved resolver
|
|
|
8a8cfb |
+# sss Use System Security Services Daemon (sssd)
|
|
|
8a8cfb |
+# systemd Use systemd for dynamic user option
|
|
|
8a8cfb |
+# winbind Use Samba winbind support
|
|
|
8a8cfb |
+# wins Use Samba wins support
|
|
|
8a8cfb |
+# wrapper Use wrapper module for testing
|
|
|
8a8cfb |
+#
|
|
|
8a8cfb |
+# Notes:
|
|
|
8a8cfb |
+#
|
|
|
8a8cfb |
+# 'sssd' performs its own 'files'-based caching, so it should generally
|
|
|
8a8cfb |
+# come before 'files'.
|
|
|
8a8cfb |
+#
|
|
|
8a8cfb |
+# WARNING: Running nscd with a secondary caching service like sssd may
|
|
|
8a8cfb |
+# lead to unexpected behaviour, especially with how long
|
|
|
8a8cfb |
+# entries are cached.
|
|
|
8a8cfb |
+#
|
|
|
8a8cfb |
+# Installation instructions:
|
|
|
8a8cfb |
+#
|
|
|
8a8cfb |
+# To use 'db', install the appropriate package(s) (provide 'makedb' and
|
|
|
8a8cfb |
+# libnss_db.so.*), and place the 'db' in front of 'files' for entries
|
|
|
8a8cfb |
+# you want to be looked up first in the databases, like this:
|
|
|
8a8cfb |
+#
|
|
|
8a8cfb |
+# passwd: db files
|
|
|
8a8cfb |
+# shadow: db files
|
|
|
8a8cfb |
+# group: db files
|
|
|
8a8cfb |
|
|
|
8a8cfb |
-passwd: db files
|
|
|
8a8cfb |
-group: db files
|
|
|
8a8cfb |
-initgroups: db [SUCCESS=continue] files
|
|
|
8a8cfb |
-shadow: db files
|
|
|
8a8cfb |
-gshadow: files
|
|
|
8a8cfb |
-
|
|
|
8a8cfb |
-hosts: files dns
|
|
|
8a8cfb |
-networks: files dns
|
|
|
8a8cfb |
-
|
|
|
8a8cfb |
-protocols: db files
|
|
|
8a8cfb |
-services: db files
|
|
|
8a8cfb |
-ethers: db files
|
|
|
8a8cfb |
-rpc: db files
|
|
|
8a8cfb |
-
|
|
|
8a8cfb |
-netgroup: db files
|
|
|
8a8cfb |
+# In alphabetical order. Re-order as required to optimize peformance.
|
|
|
8a8cfb |
+aliases: files
|
|
|
8a8cfb |
+ethers: files
|
|
|
8a8cfb |
+group: files
|
|
|
8a8cfb |
+gshadow: files
|
|
|
8a8cfb |
+hosts: files dns
|
|
|
8a8cfb |
+initgroups: files
|
|
|
8a8cfb |
+netgroup: files
|
|
|
8a8cfb |
+networks: files dns
|
|
|
8a8cfb |
+passwd: files
|
|
|
8a8cfb |
+protocols: files
|
|
|
8a8cfb |
+publickey: files
|
|
|
8a8cfb |
+rpc: files
|
|
|
8a8cfb |
+shadow: files
|
|
|
8a8cfb |
+services: files
|