Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If /etc/nsswitch.conf has:

passwd:     files ldap

this line in it, and I do getent passwd will it first run down the /etc/passwd list and then go through every user in LDAP? That seems to be what's happens.

I tried it on a Red Hat server and it was scrolling thousands of lines when /etc/passwd is only 36 lines.

share|improve this question
What you describe seems to me perfectly normal. When you use LDAP, getent passwd will list all users (local + ldap) – Martin Vegter Dec 12 '13 at 18:13
Thanks, it's very possible that it is normal. I am fairly new to using LDAP with Linux. Previously I managed users using a configuration management utility. – Gregg Leventhal Dec 12 '13 at 19:16

Yes, if you just say getent passwd, it will list all of the users it can find in any of the databases listed in nsswitch.

share|improve this answer
only for the NSS providers that enable enumeration. For instance, with sss, you can disable enumeration for some domains. – Stéphane Chazelas Dec 12 '13 at 22:35

getent will return whatever the results are for whichever "database" you specify. It determines what backends to use when constructing this "database" based on the contents of /etc/nsswitch.conf.

getent lists its "databases" when you query its usage page, getent --help.

Supported databases:
ahosts ahostsv4 ahostsv6 aliases ethers group gshadow hosts initgroups
netgroup networks passwd protocols rpc services shadow

To my knowledge, there is no way to disable its behavior of providing all the results for the various backends that are configured in /etc/nsswitch.conf.

getent and /etc/nsswitch.conf are both part of the nss (Name Service Switch).

Excerpt from nss man page

Each call to a function which retrieves data from a system database like the password or group database is handled by the Name Service Switch implementation in the GNU C library. The various services provided are implemented by independent modules, each of which naturally varies widely from the other.

The default implementations coming with the GNU C library are by default conservative and do not use unsafe data. This might be very costly in some situations, especially when the databases are large. Some modules allow the system administrator to request taking shortcuts if these are known to be safe. It is then the system administrator's responsibility to ensure the assumption is correct.

There are other modules where the implementation changed over time. If an implementation used to sacrifice speed for memory consumption it might create problems if the preference is switched.


There are a variety of these, too many to cover here. But suffice to say, there are backends such as sssd (sss/LDAP), NIS, and NIS+ to name a few.

So depending on which your system has specified in your /etc/nsswitch.conf file, will influence what output getent shows when a given "database" is queried, such as getent passwd.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.