What are disadvantages of using nsswitch compat?

Question

In my current LDAP set-up "getent passwd" shows all 600+ users that exist in the LDAP, not enumerating only the 20 LDAP-users that have permission to access this netgroup/server.

This can be solved by compat mode to filter the users:

nsswitch.conf
passwd: files compat
passwd_compat: ldap

in passwd file, add +@netgroup.

I wonder, what are the disadvantages of using this nsswitch compat mode?

Answer 1

A lot of stuff will assume you are using NIS (bad for several reasons) which is what compat really means (that you can use NIS syntax like +@netgroup etc). I assume you are not actually using YP on these boxes but creating the relevant files manually (or with puppet or whatever). In that case I don't see a major drawback, just a little extra config and you'll need to keep an eye on compadability (no pun intended). You may get the same results by setting up a filter in your ldap.conf which should be more forward compatible.

Interaction with +/- syntax (compat mode)

Linux libc5 without NYS does not have the name service switch but does allow the user some policy control. In /etc/passwd you could have entries of the form +user or +@netgroup (include the specified user from the NIS passwd map), -user or -@netgroup (exclude the specified user), and + (include every user, except the excluded ones, from the NIS passwd map). Since most people only put a + at the end of /etc/passwd to include everything from NIS, the switch provides a faster alternative for this case (passwd: files nis') which doesn't require the single + entry in /etc/passwd, /etc/group, and /etc/shadow. If this is not sufficient, the NSS compat' service provides full +/- semantics. By default, the source is nis', but this may be overriden by specifying nisplus' as source for the pseudo-databases passwd_compat, group_compat and shadow_compat. This pseudo-databases are only available in GNU C Library.