How to use nsswitch.conf to find Linux system information
TLDR at the bottom
nsswitch.conf: Which service to look at first
Name resolving can be done with several techniques. The
/etc/nsswitch.conf (name service switch configuration) file specifies the methods to use and the order in which to use them when looking for a certain type of information. You can also specify what action the system takes based on whether a method works or fails.
Each line in
nsswitch.conf specifies how to search for a piece of information, such as a user’s password. A line in
nsswitch.conf has the following format:
[[action]] [method [[action]]…
hosts: files dns mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] myhostname
info is the type of information that the line describes,
method is the method used to find the information, and
action is the response to the return status of the preceding
method. The action is enclosed within square brackets.
How nsswitch.conf works
When called upon to supply information that
nsswitch.conf describes, the system examines the line with the appropriate
info field. It uses the methods specified on the line starting with the method on the left. By default, when it finds the desired information, the system stops searching. Without an
action specification, when a method fails to return a result, the system tries the next method. It is possible for the search to end without finding the requested information.
nsswitch.conf file commonly controls searches for users (in
passwd), passwords (in
shadow), host IP addresses, and group information. The following list describes most of the types of information (
info in the format discussed earlier) that
nsswitch.conf controls searches for:
bootparamsDiskless and other booting options (See the
groupGroups of users (
hostsSystem information (
netgroupNetgroup information (
networksNetwork information (
passwdUser information (
protocolsProtocol information (
publickeyUsed for NFS running in secure mode
rpcRPC names and numbers (
servicesServices information (
shadowShadow password information (
Following is a list of the types of information that
nsswitch.conf controls searches for (
method). For each type of information, you can specify one or more of the following methods:
filesSearches local files such as
nisSearches the NIS database;
ypis an alias for
dnsQueries the DNS (
compat ±syntax in
The information provided by two or more methods may overlap: For example,
nis may each provide password information for the same user. With overlapping information, you need to consider which method you want to be authoritative (take precedence) and then put that method at the left of the list of methods.
nsswitch.conf file lists methods without actions, assuming no overlap (which is normal). In this case, the order is not critical: When one method fails, the system goes to the next one; all that is lost is a little time. Order becomes critical when you use actions between methods or when overlapping entries differ.
The first of the following lines from
nsswitch.conf causes the system to search for password information in
/etc/passwd and, if that fails, to use NIS to find the information. If the user you are looking for is listed in both places, the information in the local file would be used—it would be authoritative. The second line uses NIS; if that fails, it searches
/etc/hosts; if that fails, it checks with DNS to find host information.
passwd files nis
hosts nis files dns
Each method can optionally be followed by an action item that specifies what to do if the method succeeds or fails for any of a number of reasons. An action item has the following format:
where the opening and closing square brackets are part of the format and do not indicate that the contents are optional;
STATUS (by convention uppercase although it is not case sensitive) is the status being tested for; and
action is the action to be taken if
STATUS matches the status returned by the preceding method. The leading exclamation point (!) is optional and negates the status.
STATUS may have the following values:
NOTFOUNDThe method worked but the value being searched for was not found. Default action is * continue.
SUCCESSThe method worked and the value being searched for was found; no error was returned. * Default action is
UNAVAILThe method failed because it is permanently unavailable. For example, the required * file may not be accessible or the required server may be down. Default action is continue.
TRYAGAINThe method failed because it was temporarily unavailable. For example, a file may be * locked or a server overloaded. Default action is
action are as follows:
returnReturns to the calling routine with or without a value.
continueContinues with the next method. Any returned value is overwritten by a value found by the next method.
Example: The following line from
nsswitch.conf causes the system first to use DNS to search for the IP address of a given host. The action item following the DNS method tests whether the status returned by the method is not (!) UNAVAIL.
hosts dns [!UNAVAIL=return] files
The system takes the action associated with the
STATUS (return) if the DNS method does not return UNAVAIL (!UNAVAIL)—that is, if DNS returns SUCCESS, NOTFOUND, or TRYAGAIN. As a consequence, the following method
(files) is used only when the DNS server is unavailable: If the DNS server is not unavailable (read the two negatives as “is available”), the search returns the domain name or reports that the domain name was not found. The search uses the
files method (check the local
/etc/hosts file) only if the server is not available.
compat Method: ± in passwd, group, and shadow Files
You can put special codes in the
/etc/shadow files that cause the system, when you specify the
compat method in
nsswitch.conf, to combine and modify entries in the local files and the NIS maps. That is, a plus sign (
+) at the beginning of a line in one of these files adds NIS information; a minus sign (
–) removes information.
For example, to use these codes in the
passwd file, specify
passwd: compat in
nsswitch. conf. The system then goes through the
passwd file in order, adding or removing the appropriate NIS entries when it reaches each line that starts with a
Although you can put a plus sign at the end of the
passwd file, specify
passwd: compat in
nsswitch.conf to search the local
passwd file, and then go through the NIS map, it is more efficient to put
passwd: file nis in
nsswitch.conf and not modify the
/etc/nsswitch.conf #hosts: files dns mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] myhostname hosts: files dns
/etc/hosts, then returns “not found”.
- Processing continues to the next module.
mdns4_minimalmodule searches the local LAN subnet using Multicast DNS (mDNS), then returns “not found”.
[NOTFOUND=return]indicates that processing should not continue after this error; i.e. “not found” should be immediately returned to the program.
Why the extra
[NOTFOUND=return]? According to various sources, it’s there to speed up unsuccessful queries and to prevent information leakage, and to reduce load on public DNS servers.
Let’s say someone’s network actually used mDNS (which is common on Linux/macOS). If the user tried to resolve “MyLittleLaptop.local” and it wasn’t found, the system would keep trying the next module (
dns), and the query would be sent to the public DNS (e.g. to the school’s DNS servers, or to the coffee shop’s router).
But – according to the reservation by IETF – *.local names cannot possibly exist in public DNS, so such a query would be useless, all it does is reveal your personal information to the network admin. So the
[NOTFOUND=return] tag is added to stop it from reaching DNS completely.