1 NETGROUP(4)             File Formats and Configurations            NETGROUP(4)
   2 
   3 
   4 
   5 NAME
   6        netgroup - list of network groups
   7 
   8 SYNOPSIS
   9        /etc/netgroup
  10 
  11 
  12 DESCRIPTION
  13        A netgroup defines a network-wide group of hosts and users. Use a
  14        netgroup to restrict access to shared NFS filesystems and to restrict
  15        remote login and shell access.
  16 
  17 
  18        Network groups are usually stored in network information services, such
  19        as LDAP, or NIS, but may alternatively be stored in the local
  20        /etc/netgroup file.  The netgroup line of the nsswitch.conf(4) file
  21        determines which of those sources are used.
  22 
  23 
  24        This manual page describes the format for a file that is used to supply
  25        input to a program such as ldapaddent(1M) for LDAP, or makedbm(1M) for
  26        NIS.  The same file format is used in the local /etc/netgroup file.
  27 
  28 
  29        Each line of the file defines the name and membership of a network
  30        group. The line should have the format:
  31 
  32          groupname     member...
  33 
  34 
  35 
  36 
  37        The items on a line can be separated by a combination of one or more
  38        spaces or tabs.
  39 
  40 
  41        The groupname is the name of the group being defined. This is followed
  42        by a list of members of the group. Each member is either another group
  43        name, all of whose members are to be included in the group being
  44        defined, or a triple of the form:
  45 
  46          (hostname,username,domainname)
  47 
  48 
  49 
  50 
  51        In each triple, any of the three fields hostname, username, and
  52        domainname, can be empty. An empty field signifies a wildcard that
  53        matches any value in that field. Thus:
  54 
  55          everything (,,this.domain)
  56 
  57 
  58 
  59 
  60        defines a group named "everything" for the domain "this.domain" to
  61        which every host and user belongs.
  62 
  63 
  64        The domainname field refers to the domain in which the triple is valid,
  65        not the domain containing the host or user. In fact, applications using
  66        netgroup generally do not check the domainname. Therefore, using
  67 
  68          (,,domain)
  69 
  70 
  71 
  72 
  73        is equivalent to
  74 
  75          (,,)
  76 
  77 
  78 
  79 
  80        You can also use netgroups to control NFS mount access (see
  81        share_nfs(1M)) and to control remote login and shell access (see
  82        hosts.equiv(4)). You can also use them to control local login access
  83        (see passwd(4), shadow(4), and compat in nsswitch.conf(4)).
  84 
  85 
  86        When used for these purposes, a host is considered a member of a
  87        netgroup if the netgroup contains any triple in which the hostname
  88        field matches the name of the host requesting access and the domainname
  89        field matches the domain of the host controlling access.
  90 
  91 
  92        Similarly, a user is considered a member of a netgroup if the netgroup
  93        contains any triple in which the username field matches the name of the
  94        user requesting access and the domainname field matches the domain of
  95        the host controlling access.
  96 
  97 
  98        Note that when netgroups are used to control NFS mount access, access
  99        is granted depending only on whether the requesting host is a member of
 100        the netgroup. Remote login and shell access can be controlled both on
 101        the basis of host and user membership in separate netgroups.
 102 
 103 FILES
 104        /etc/netgroup
 105                         Used by a network information service's utility to
 106                         construct a map or table that contains netgroup
 107                         information. For example, ldapaddent(1M) uses
 108                         /etc/netgroup to construct an LDAP container.
 109                         Alternatively, the /etc/netgroup file may be used
 110                         directly if the files source is specified in
 111                         nsswitch.conf(4) for the netgroup database.
 112 
 113 
 114 
 115 SEE ALSO
 116        ldapaddent(1M), makedbm(1M), share_nfs(1M), innetgr(3C), hosts(4),
 117        hosts.equiv(4), nsswitch.conf(4), passwd(4), shadow(4)
 118 
 119 NOTES
 120        Applications may make general membership tests using the innetgr()
 121        function. See innetgr(3C).
 122 
 123 
 124        Because the "-" character will not match any specific username or
 125        hostname, it is commonly used as a placeholder that will match only
 126        wildcarded membership queries. So, for example:
 127 
 128          onlyhosts (host1,-,our.domain) (host2,-,our.domain)
 129          onlyusers (-,john,our.domain) (-,linda,our.domain)
 130 
 131 
 132 
 133 
 134        effectively define netgroups containing only hosts and only users,
 135        respectively. Any other string that is guaranteed not to be a legal
 136        username or hostname will also suffice for this purpose.
 137 
 138 
 139        Use of placeholders will improve search performance.
 140 
 141 
 142        When a machine with multiple interfaces and multiple names is defined
 143        as a member of a netgroup, one must list all of the names. See
 144        hosts(4).  A manageable way to do this is to define a netgroup
 145        containing all of the machine names. For example, for a host "gateway"
 146        that has names "gateway-subnet1" and "gateway-subnet2" one may define
 147        the netgroup:
 148 
 149          gateway (gateway-subnet1,,our.domain) (gateway-subnet2,,our.domain)
 150 
 151 
 152 
 153 
 154        and use this netgroup "gateway" whenever the host is to be included in
 155        another netgroup.
 156 
 157 
 158 
 159                                February 25, 2017                   NETGROUP(4)