We are using an LDAP server with both Solaris and RHEL servers and planning to migrate more servers over to RHEL. However we have an issue with LDAP on all Red Hat servers. When we type "getent passwd", all users on the entire LDAP Server are shown, instead of only the users that have access to this server. Normally about 10 to 50 people have access to a server, so Solaris prints out this list of users, while Red Hat flat out prints out a list of all users that exist in the LDAP (about 650).
We use nscd/nslcd on RHEL 6.2. Migrating to sssd is not a solution short-term, although we are considering doing so in the future.
I have found out that this can be changed by using compat as a source for /etc/nsswitch.conf, which enumerates so you only see the users with access to the +netgroup in /etc/passwd.
- What is normal behavior on Red Hat Linux Servers?
- Is there a security risk in users being able to see all other users?
- Do you recommend using compat in /etc/nsswitch.conf as a solution?