NSS - Name Service Switch for users, groups, and hosts

NSS (Name Service Switch) is the framework that lets commands like ls -l, getent, and id look up users, groups, and hosts from multiple sources - local files, LDAP, SSSD, or DNS.

What NSS does

NSS handles:

• passwd: user lookup (getent passwd <user>).
• group: group lookup (getent group <group>).
• shadow: password hashes (root-readable only).
• hosts: hostname lookup (covered in the DNS section).
• services: port-to-name mapping.
• protocols: protocol numbers.
• networks: network names.
• And others.

Each database has a list of modules tried in order, defined in /etc/nsswitch.conf.

Configuration

cat /etc/nsswitch.conf

Output:

passwd:      files systemd
group:       files systemd
shadow:      files
hosts:       files myhostname dns
services:    files
protocols:   files
networks:    files
...

The format is <database>: <module1> <module2> .... Each module is tried in order until one returns a result.

Common modules:

A typical enterprise config

passwd:     files sss
group:      files sss
shadow:     files
hosts:      files dns

Local files (/etc/passwd) first, then SSSD for central identity (LDAP or AD).

shadow is listed without sss because SSSD-backed users are authenticated through PAM (pam_sss) rather than by having a password hash read out of a shadow entry. That is the boundary this lesson exists to teach: NSS resolves who a user is - uid, gid, home, shell - and PAM decides whether they may log in. The two are configured separately and fail separately.

Keep the split straight when you diagnose:

• getent passwd alice returns nothing → NSS problem. The host cannot resolve the identity at all, so ls -l shows a bare uid and the user has no home directory.
• getent passwd alice succeeds but ssh alice@host fails → PAM problem. The identity resolves; the authentication path does not.

Diagnose with getent

getent uses the same NSS stack as applications:

getent passwd alice              # all sources, in nsswitch.conf order
getent -s files passwd alice     # local files only
getent -s sss passwd alice       # SSSD only - proves which source answered
getent passwd | head             # all users
getent group admins              # specific group
getent hosts example.com         # hosts
getent services http             # services

If getent passwd <user> returns nothing but the user exists in LDAP, SSSD is misconfigured.

NSS and systemd-resolved

For hosts, NSS can use resolve (systemd-resolved stub) or myhostname:

hosts:      files myhostname resolve [!unavail=continue] dns

The [!unavail=continue] clause means “if resolve returns ‘unavailable’, continue to the next module”. Useful when systemd-resolved is not running.

NSS and central identity

With SSSD. The packages and the wiring tool are both distro-specific, so pick the path that matches the host:

# Debian / Ubuntu
sudo apt install sssd sssd-ldap libnss-sss libpam-sss
# Add sss to the NSS databases (review the file before and after)
sudoedit /etc/nsswitch.conf
# Wire the PAM stack - this is the authentication half
sudo pam-auth-update --enable sss
sudo systemctl enable --now sssd

# RHEL 8 / 9 / Fedora
sudo dnf install sssd sssd-ldap oddjob-mkhomedir
sudo authselect select sssd with-mkhomedir --force
sudo systemctl enable --now sssd

SSSD manages the connection to LDAP/AD, caches results, and provides them via NSS. Verify both halves separately, because they fail independently:

getent passwd alice          # NSS: can the host resolve the identity?
ssh alice@localhost          # PAM: can the identity actually log in?

Common pitfalls

• files listed after sss: local users are overridden by central. This is rarely what you want. Always list files first for local overrides.
• Missing sss module: LDAP users cannot log in even though LDAP is reachable. Install libnss-sss.
• Caching: SSSD caches for a configurable period. A change in central identity may not appear immediately. Invalidate with sss_cache -E.
• Permission: /etc/sssd/sssd.conf must be 600 and owned by root, or SSSD refuses to start.

Knowledge check