[v4] nss: Make nsswitch.conf more distribution friendly.
Commit Message
On 8/16/19 4:53 PM, Florian Weimer wrote:
> * Carlos O'Donell:
>
>> +More databasess may be added later.
>
> Another typo: databasess
>
> Rest looks good to me.
Hrm, I ran spell check, maybe I need to delete my defaults :-)
Re-ran aspell, all clean.
v6.
OK?
Comments
* Carlos O'Donell:
> On 8/16/19 4:53 PM, Florian Weimer wrote:
>> * Carlos O'Donell:
>>
>>> +More databasess may be added later.
>>
>> Another typo: databasess
>>
>> Rest looks good to me.
>
> Hrm, I ran spell check, maybe I need to delete my defaults :-)
> Re-ran aspell, all clean.
>
> v6.
>
> OK?
Yes, looks good now.
Thanks,
Florian
On 8/16/19 5:11 PM, Florian Weimer wrote:
> * Carlos O'Donell:
>
>> On 8/16/19 4:53 PM, Florian Weimer wrote:
>>> * Carlos O'Donell:
>>>
>>>> +More databasess may be added later.
>>>
>>> Another typo: databasess
>>>
>>> Rest looks good to me.
>>
>> Hrm, I ran spell check, maybe I need to delete my defaults :-)
>> Re-ran aspell, all clean.
>>
>> v6.
>>
>> OK?
>
> Yes, looks good now.
Pushed.
I'm rebasing Fedora right now against these changes.
I look forward to reviewing any other changes from downstream
distributions to improve these files.
@@ -1,3 +1,9 @@
+2019-08-16 Carlos O'Donell <carlos@redhat.com>
+
+ * nss/nsswitch.conf: Expand comments, and simplify defaults.
+ * manual/nss.texi (NSS Basics): List all known databases.
+ (Services in the NSS configuration): Mention automount.
+
2019-08-15 Florian Weimer <fweimer@redhat.com>
nptl: Move pthread_attr_init implementation into libc.
@@ -56,13 +56,17 @@ functions to access the databases.
@noindent
The databases available in the NSS are
+@cindex aliases
@cindex ethers
@cindex group
+@cindex gshadow
@cindex hosts
+@cindex initgroups
@cindex netgroup
@cindex networks
-@cindex protocols
@cindex passwd
+@cindex protocols
+@cindex publickey
@cindex rpc
@cindex services
@cindex shadow
@@ -75,16 +79,22 @@ Ethernet numbers,
@comment @pxref{Ethernet Numbers}.
@item group
Groups of users, @pxref{Group Database}.
+@item gshadow
+Group passphrase hashes and related information.
@item hosts
Host names and numbers, @pxref{Host Names}.
+@item initgroups
+Supplementary group access list.
@item netgroup
Network wide list of host and users, @pxref{Netgroup Database}.
@item networks
Network names and numbers, @pxref{Networks Database}.
-@item protocols
-Network protocols, @pxref{Protocols Database}.
@item passwd
User identities, @pxref{User Database}.
+@item protocols
+Network protocols, @pxref{Protocols Database}.
+@item publickey
+Public keys for Secure RPC.
@item rpc
Remote procedure call names and numbers.
@comment @pxref{RPC Database}.
@@ -96,8 +106,8 @@ User passphrase hashes and related information.
@end table
@noindent
-There will be some more added later (@code{automount}, @code{bootparams},
-@code{netmasks}, and @code{publickey}).
+@c We currently don't implement automount, netmasks, or bootparams.
+More databases may be added later.
@node NSS Configuration File, NSS Module Internals, NSS Basics, Name Service Switch
@section The NSS Configuration File
@@ -159,6 +169,10 @@ these files since they should be placed in a directory where they are
found automatically. Only the names of all available services are
important.
+Lastly, some system software may make use of the NSS configuration file
+to store their own configuration for similar purposes. Examples of this
+include the @code{automount} service which is used by @code{autofs}.
+
@node Actions in the NSS configuration, Notes on NSS Configuration File, Services in the NSS configuration, NSS Configuration File
@subsection Actions in the NSS configuration
@@ -1,20 +1,69 @@
+#
# /etc/nsswitch.conf
#
-# Example configuration of GNU Name Service Switch functionality.
+# An example Name Service Switch config file. This file should be
+# sorted with the most-used services at the beginning.
#
+# Valid databases are: aliases, ethers, group, gshadow, hosts,
+# initgroups, netgroup, networks, passwd, protocols, publickey,
+# rpc, services, and shadow.
+#
+# Valid service provider entries include (in alphabetical order):
+#
+# compat Use /etc files plus *_compat pseudo-db
+# db Use the pre-processed /var/db files
+# dns Use DNS (Domain Name Service)
+# files Use the local files in /etc
+# hesiod Use Hesiod (DNS) for user lookups
+# nis Use NIS (NIS version 2), also called YP
+# nisplus Use NIS+ (NIS version 3)
+#
+# See `info libc 'NSS Basics'` for more information.
+#
+# Commonly used alternative service providers (may need installation):
+#
+# ldap Use LDAP directory server
+# myhostname Use systemd host names
+# mymachines Use systemd machine names
+# mdns*, mdns*_minimal Use Avahi mDNS/DNS-SD
+# resolve Use systemd resolved resolver
+# sss Use System Security Services Daemon (sssd)
+# systemd Use systemd for dynamic user option
+# winbind Use Samba winbind support
+# wins Use Samba wins support
+# wrapper Use wrapper module for testing
+#
+# Notes:
+#
+# 'sssd' performs its own 'files'-based caching, so it should generally
+# come before 'files'.
+#
+# WARNING: Running nscd with a secondary caching service like sssd may
+# lead to unexpected behaviour, especially with how long
+# entries are cached.
+#
+# Installation instructions:
+#
+# To use 'db', install the appropriate package(s) (provide 'makedb' and
+# libnss_db.so.*), and place the 'db' in front of 'files' for entries
+# you want to be looked up first in the databases, like this:
+#
+# passwd: db files
+# shadow: db files
+# group: db files
-passwd: db files
-group: db files
-initgroups: db [SUCCESS=continue] files
-shadow: db files
-gshadow: files
-
-hosts: files dns
-networks: files dns
-
-protocols: db files
-services: db files
-ethers: db files
-rpc: db files
-
-netgroup: db files
+# In alphabetical order. Re-order as required to optimize peformance.
+aliases: files
+ethers: files
+group: files
+gshadow: files
+hosts: files dns
+initgroups: files
+netgroup: files
+networks: files dns
+passwd: files
+protocols: files
+publickey: files
+rpc: files
+shadow: files
+services: files