Name Service Switch (NSS) and getent

When you run id alice or getent passwd alice, the kernel does not read /etc/passwd directly. It asks glibc’s NSS layer, which consults /etc/nsswitch.conf to decide which backing stores to query — and in what order.

Why this matters

On a host with only local accounts, NSS reads /etc/passwd. On a host joined to LDAP via SSSD, NSS reads both — and the LDAP results may include users that do not exist in /etc/passwd at all. A sysadmin who reads /etc/passwd to audit accounts on a centrally managed host sees only a fraction of the truth.

$ getent passwd alice; cat /etc/passwd | grep alice

alice:x:1000:1000:Alice Smith:/home/alice:/bin/bash
alice:x:1000:1000:Alice Smith:/home/alice:/bin/bash

/etc/nsswitch.conf

The configuration file is /etc/nsswitch.conf. It maps each database to a list of sources:

$ cat /etc/nsswitch.conf

passwd:         files systemd
group:          files systemd
shadow:         files
hosts:          files dns
networks:       files
services:       files
protocols:      files
rpc:            files
ethers:         files
netgroup:       nis
automount:      files

The common sources:

The order matters

passwd: files sss means: look in /etc/passwd first; if not found, ask SSSD; if SSSD does not know, fail. passwd: sss files would invert the priority and mean SSSD answers first.

getent — the right way to read identity

getent queries the NSS layer for a database:

getent passwd                # all users from all sources
getent passwd alice           # a specific user
getent group sudo             # a specific group
getent hosts example.com      # hosts resolution
getent services ssh           # service-to-port mapping

In scripts, always use getent instead of reading /etc/passwd or /etc/hosts directly. Tools that read these files directly break on centrally-managed hosts.

nscd and caching

NSS queries go through glibc on every call. To reduce latency, the nscd daemon caches results. On most modern distributions, nscd is deprecated in favour of SSSD’s own cache (which is nscd-compatible and behaves similarly).

$ systemctl status nscd 2>/dev/null | head -3; getent passwd | wc -l; cat /etc/passwd | wc -l

nscd.service - Name Service Cache Daemon
Active: inactive (dead)
5 /etc/passwd lines
5 /etc/passwd lines

Diagnosing NSS failures

$ strace -e openat getent passwd alice 2>&1 | grep -E passwd-nss

openat(AT_FDCWD, /etc/nsswitch.conf, O_RDONLY) = 3
openat(AT_FDCWD, /etc/passwd, O_RDONLY) = 4
...

Knowledge check