A netgroup defines a network-wide group of hosts and users. Use a netgroup to restrict access to shared NFS filesystems and to restrict remote login and shell access.
Network groups are stored in one of the Network Information Services, either NIS or NIS+, not in a local file.
This manual page describes the format for a file that may be used to supply input to the makedbm(1M) or nisaddent(1M) programs that are use to build the NIS map or NIS+ table, respectively.
Each line of the file defines the name and membership of a network group. The line should have the format: The items on a line may be separated by a combination of one or more spaces or tabs.
The groupname is the name of the group being defined. This is followed by a list of members of the group. Each member is either another group name, all of whose members are to be included in the group being defined, or a triple of the form:
|
(hostname,username,domainname)
|
In each triple, any of the three fields hostname, username, and domainname, can be empty. An empty field signifies a wildcard that matches any value in that field. Thus:
|
everything (,,this.domain)
|
defines a group named "everything" for the domain "this.domain" to which every host and user belongs.
The domainname field refers to the domain in which the triple is valid, not the domain containing the host or user. In fact, applications using netgroup generally do not check the the domainname. Therefore, using is equivalent to You can also use netgroups to control NFS mount access (see share_nfs(1M)) and to control remote login and
shell access (see hosts.equiv(4)). You can also use them to control local login access (see passwd(4), shadow(4), and compat in nsswitch.conf(4)).
When used for these purposes, a host is considered a member of a netgroup if the netgroup contains any triple in which the hostname field matches the name of the host requesting access and the domainname field matches the
domain of the host controlling access.
Similarly, a user is considered a member of a netgroup if the netgroup contains any triple in which the username field matches the name of the user requesting access and the domainname
field matches the domain of the host controlling access.
Note that when netgroups are used to control NFS mount access, access is granted depending only on whether the requesting host is a member of the netgroup. Remote login and shell access can be controlled both on the basis of host and user membership in separate netgroups.
|