reopen 651356 retitle 651356 base-files: Please reintroduce libnss_compat in default nsswitch.conf thanks
I'm reopening and retitling, to have the history and the discussion on this topic gathered in one location. I noticed this change in the new base-files, and believe it is a very bad idea to do this change, and that the argument presented to change it is flawed. [Roger Leigh] > Please consider switching to "files" in place of "compat" in the > default nsswitch.conf (patch attached). "compat" is for compatibility > with libc5, which we switched away from well over a decade ago. The > compatibility it provides includes including NSS databases with the > addition of special magic lines to passwd, group etc. However, modern > glibc has separate nis nss modules for this purpose, making the compat > mode redundant. > > For this reason, I would recommend using "files" only for new > installs, which would enable the phasing out of "compat" libc5 usage > over the next stable release. The above statement must be based on some misunderstanding. The 'compat' statement is to support netgroup based user and group access to a machine, and is not some obsolete setup that should be expected to go away any time soon. This is not to be compatible with libc5, but to be compatible with other unix platforms like Solaris. What you call 'special magic lines' are in fact a very convenient and powerful way to limit access to the machine to only a subset of the users in for example NIS and LDAP, and we use it all the time here at the University of Oslo. For example the passwd file will have entries like this: +@somegroup +someuser This will make the users in the somegroup netgroup and the someuser visible on the machine in question. The "modernt glibc" modules that can be used for a similar purpose is not as nice to set up, nor are they very convenient to handle in a network environment with a lot of computers. Please undo this change and reinsert the 'compat' entries in nsswitch.conf. -- Happy hacking Petter Reinholdtsen -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
