Question on /etc/nsswitch.conf

[Zack Weinberg]

On Thu, Sep 28, 2017 at 9:57 AM, Florian Weimer <fweimer@redhat.com> wrote:
> On 09/28/2017 03:54 PM, Zack Weinberg wrote:
>>
>> I expect there are, at least, a lot of existing installations with
>> "passwd: compat" in their nsswitch.conf, but probably most of them
>> don't use NIS.
>>
>> I was under the impression that the only thing compat does is look for
>> the +:::::: notation in /etc/passwd and forward to NIS.  If so, or
>> even if it's more complicated than that, maybe the Right Thing is to
>> build a libnss_compat.so even when !BUILD_OBSOLETE_NSL, but have it
>> error out on +:::::: rather than forwarding to NIS.  The big problem I
>> see with this idea is it might make it harder for TIRPC to drop in a
>> replacement.  Thoughts?
>
> It is possible to redirect the lookup to something else besides NIS, using
> passwd_compat, group_compat, shadow_compat stanzas in /etc/nsswitch.conf.

OK, so pull libnss_compat out of the nis directory, build and install
it unconditionally (but still leave it out of the default NSS rules)
and make sure it throws a sensible error if it encounters a forwarding
directive and the forwarded-to module isn't available?

zw