netgroup(4) File Formats netgroup(4)
NAME
netgroup - list of network groups
DESCRIPTION
A netgroup defines a network-wide group of hosts and users.
Netgroups may be used to restrict access to shared NFS
filesystems and for restricting remote login and shell
access.
Network groups are stored in one of the Network Information
Services, either NIS or NIS+, not in a local file.
This manual page describes the format for a file that may be
used to supply input to the makedbm(1M) or nisaddent(1M)
programs that are use to build the NIS map or NIS+ table,
respectively.
Each line of the file defines the name and membership of
network group. The line should have the format:
groupname member ...
The items on a line may be separated by a combination of one
or more spaces or tabs.
The groupname is the name of the group being defined. This
is followed by a list of members of the group. Each member
is either another group name, all of whose members are to be
included in the group being defined, or a triple of the
form:
(hostname,username,domainname)
In each triple, any of the three fields hostname, username,
and domainname, can be empty. An empty field signifies a
"wildcard" matching any value in that field. Thus:
everything (,,this.domain)
defines a group named "everything" for the domain
"this.domain" to which every host and user belongs.
The domainname field refers to the domain in which the tri-
ple is valid, not the domain containing the host or user.
Netgroups can be used to control NFS mount access (see
share_nfs(1M)) and to control remote login and shell access
(see hosts.equiv(4)). They can also be used to control
local login access (see passwd(4), shadow(4), and "compat"
in nsswitch.conf(4)).
When used for these purposes, a host is considered a member
of a netgroup if the netgroup contains any triple in which
the hostname field matches the name of the host requesting
access and the domainname field matches the domain of the
host controlling access.
Similarly, a user is considered a member of a netgroup if
the netgroup contains any triple in which the username field
matches the name of the user requesting access and the
domainname field matches the domain of the host controlling
access.
Note that when netgroups are used to control NFS mount
access, access is granted depending only on whether the
requesting host is a member of the netgroup. Remote login
and shell access can be controlled both on the basis of host
and user membership in separate netgroups.
FILES
/etc/netgroup used by /var/yp/Makefile on NIS masters
to build the NIS netgroup map
Note that the netgroup information must always be stored in
a network information service, either NIS or NIS+. The local
file is only used to construct the netgroup NIS maps or NIS+
table; it is never consulted directly.
SEE ALSO
nis+(1), makedbm(1M), nisaddent(1M), share_nfs(1M),
innetgr(3N), hosts.equiv(4), nsswitch.conf(4), passwd(4),
shadow(4)
NOTES
Applications may make general membership tests using the
innetgr() function (see innetgr(3N)).
Because the "-" character will not match any specific user-
name or hostname, it is commonly used as a placeholder that
will match only wildcarded membership queries. So, for exam-
ple:
onlyhosts (host1,-,our.domain) (host2,-,our.domain)
onlyusers (-,john,our.domain) (-,linda,our.domain)
effectively define netgroups containing only hosts and only
users, respectively. Any other string that is guaranteed
not to be a legal username or hostname will also suffice for
this purpose.
When a machine with multiple interfaces and multiple names
is defined as a member of a netgroup, one must list all of
the names (see hosts(4)). A manageable way to do this is to
define a netgroup containing all of the machine names. For
example, for a host "gateway" that has names "gateway-
subnet1" and "gateway-subnet2" one may define the netgroup:
gateway (gateway-subnet1,,our.domain) (gateway-subnet2,,our.domain)
and use this netgroup gateway whenever the host is to be
included in another netgroup.
SunOS 5.4 Last change: 8 Aug 1993