services file; it will only contain additional entries. So it appears reasonable to query the local files first and check NIS only if the service name isn't found. Hostname information, on the other hand, may change very frequently, so DNS or the NIS server should always have the most accurate account, while the local hosts file is only kept as a backup if DNS and NIS should fail. For hostnames, therefore, you normally want to check the local file last.
The following example shows how to force gethostbyname and gethostbyaddr to look in NIS and DNS before the hosts file and how to have the getservbyname function look in the local files before querying NIS. These resolver functions will try each of the listed services in turn; if a lookup succeeds, the result is returned; otherwise, they will try the next service in the list. The file setting for these priorities is:
# small sample /etc/nsswitch.conf
#
hosts: nis dns files
services: files nis
The following is a complete list of services and locations that may be used with an entry in the nsswitch.conf file. The actual maps, files, servers, and objects queried depend on the entry name. The following can appear to the right of a colon:
nis
Use the current domain NIS server. The location of the server queried is configured in the yp.conf file, as shown in the previous section. For the hosts entry, the hosts.byname and hosts.byaddr maps are queried.
nisplus or nis+
Use the NIS+ server for this domain. The location of the server is obtained from the /etc/nis.conf file.
dns
Use the DNS name server. This service type is useful only with the hosts entry. The name servers queried are still determined by the standard resolv.conf file.
files
Use the local file, such as the /etc/hosts file for the hosts entry.
compat
Be compatible with older file formats. This option can be used when either NYS or glibc 2.x is used for NIS or NIS+ lookups. While these versions normally can't interpret older NIS entries in passwd and group files, compat option allows them to work with those formats.
db
Look up the information from DBM files located in the /var/db directory. The corresponding NIS map name is used for that file.
Currently, the NIS support in GNU libc caters to the following nsswitch.conf databases: aliases, ethers.group, hosts, netgroup, network, passwd, protocols, publickey, rpc, services, and shadow. More entries are likely to be added.
Example 13.2 shows a more complete example that introduces another feature of nsswitch.conf. The [NOTFOUND=return] keyword in the hosts entry tells the NIS client to return if the desired item couldn't be found in the NIS or DNS database. That is, the NIS client will continue searching the local files only if calls to the NIS and DNS servers fail for some other reason. The local files will then be used only at boot time and as a backup when the NIS server is down.
Example 13.2: Sample nsswitch.conf File
# /etc/nsswitch.conf
#
hosts: nis dns [NOTFOUND=return] files
networks: nis [NOTFOUND=return] files
services: files nis
protocols: files nis
rpc: files nis
GNU libc provides some other actions that are described in the nsswitch manpage.
Using the passwd and group Maps
One of the major applications of NIS is synchronizing user and account information on all hosts in an NIS domain. Consequently, you usually keep only a small local /etc/passwd file, to which site-wide information from the NIS maps is appended. However, simply enabling NIS lookups for this service in nsswitch.conf is not nearly enough.
When relying on the password information distributed by NIS, you first have to make sure that the numeric user IDs of any users you have in your local passwd file match the NIS server's idea of user IDs. Consistency in user IDs is important for other purposes as well, like mounting NFS volumes from other hosts in your network.
If any of the numeric IDs in /etc/passwd or /etc/group differ from those in the maps, you have to adjust file ownerships for all files that belong to that user. First, you should change all uids and gids in passwd and group to the new values, then find that all files that belong to the users just changed and change their ownership. Assume news used to have a user ID of 9 and okir had a user ID of 103, which were changed to some other value; you could then issue the following commands as root:
# find / -uid 9 -print ›/tmp/uid.9
# find / -uid 103 -print ›/tmp/uid.103
# cat /tmp/uid.9 | xargs chown news
# cat /tmp/uid.103 | xargs chown okir
It is important that you execute these commands with the new passwd file installed, and that you collect all filenames before you change the ownership of any of them. To update the group ownerships of files, use a similar method with the gid instead of the uid, and chgrp instead of chown.
Once you do this, the numerical uids and gids on your system will agree with those on all other hosts in your NIS domain. The next step is to add configuration lines to nsswitch.conf that enable NIS lookups for user and group information:
# /etc/nsswitch.conf - passwd and group treatment
passwd: nis files
group: nis files
This affects where the login command and all its friends look for user information. When a user tries to log in, login queries the NIS maps first, and if this lookup fails, falls back to the local files. Usually, you will remove almost all users from your local files, and only leave entries for root and generic accounts like mail in it. This is because some vital system tasks may have to map uids to usernames or vice versa. For example, administrative cron jobs may execute the su command to temporarily become news, or the UUCP subsystem may mail a status
