If /etc/nsswitch.conf has:

passwd:     files ldap

this line in it, and I do getent passwd will it first run down the /etc/passwd list and then go through every user in LDAP? That seems to be what's happens.

I tried it on a Red Hat server and it was scrolling thousands of lines when /etc/passwd is only 36 lines.

  • 3
    What you describe seems to me perfectly normal. When you use LDAP, getent passwd will list all users (local + ldap) – Martin Vegter Dec 12 '13 at 18:13
  • Thanks, it's very possible that it is normal. I am fairly new to using LDAP with Linux. Previously I managed users using a configuration management utility. – Gregg Leventhal Dec 12 '13 at 19:16

Yes, if you just say getent passwd, it will list all of the users it can find in any of the databases listed in nsswitch.

  • 1
    only for the NSS providers that enable enumeration. For instance, with sss, you can disable enumeration for some domains. – Stéphane Chazelas Dec 12 '13 at 22:35

getent will return whatever the results are for whichever "database" you specify. It determines what backends to use when constructing this "database" based on the contents of /etc/nsswitch.conf.

getent lists its "databases" when you query its usage page, getent --help.

Supported databases:
ahosts ahostsv4 ahostsv6 aliases ethers group gshadow hosts initgroups
netgroup networks passwd protocols rpc services shadow

To my knowledge, there is no way to disable its behavior of providing all the results for the various backends that are configured in /etc/nsswitch.conf.

getent and /etc/nsswitch.conf are both part of the nss (Name Service Switch).

Excerpt from nss man page

Each call to a function which retrieves data from a system database like the password or group database is handled by the Name Service Switch implementation in the GNU C library. The various services provided are implemented by independent modules, each of which naturally varies widely from the other.

The default implementations coming with the GNU C library are by default conservative and do not use unsafe data. This might be very costly in some situations, especially when the databases are large. Some modules allow the system administrator to request taking shortcuts if these are known to be safe. It is then the system administrator's responsibility to ensure the assumption is correct.

There are other modules where the implementation changed over time. If an implementation used to sacrifice speed for memory consumption it might create problems if the preference is switched.


There are a variety of these, too many to cover here. But suffice to say, there are backends such as sssd (sss/LDAP), NIS, and NIS+ to name a few.

So depending on which your system has specified in your /etc/nsswitch.conf file, will influence what output getent shows when a given "database" is queried, such as getent passwd.


  • The sssd howto link is dead. – GhostLyrics Aug 23 '17 at 13:10
  • @GhostLyrics - changed link – slm Aug 23 '17 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.