Re: svn commit: r224659 - head/etc



Ed,

First off, thanks for taking a look at this. I've always been
uncomfortable with our default nsswitch.conf file because most users do
not use nis, and although everything works with our (previous) default
it produces errors in the logs that are very non-obvious.

That said, I think the approach you have here needs some tweaking. You
only posted it to -current yesterday, and I hadn't even gotten past
thinking "Ok, that's a good direction to start looking" before it was
committed already. :) I know deadlines are tight prior to the release,
but I don't think they are _that_ tight.

I have 2 suggestions. The first is that if we go this way that we tweak
the sed statements to comment out the _compat entries rather than
deleting them. This will accomplish the same thing but be slightly less
confusing for users who eventually want to implement nis. This can be
accomplished like this:

-e 's/.*_compat:/# &/' -e 's/compat$/files/'

The other issue is that due to the way that mergemaster works by default
users who have existing /etc/nsswitch.conf files (which should be pretty
close to 100%) won't see this change because it doesn't affect the
$FreeBSD$ tag. If we decide to keep things this way then I would suggest
adding a comment to that file so that it will get picked up.

However, I would much rather see us actually change the default file.
Users who are going to enable nis will already know that this file needs
to be tweaked, and by using more sensible defaults we'll be more
relevant to the majority of our userbase. So I propose the attached
(along with reverting your change obviously).


hth,

Doug


On 08/05/2011 10:33, Ed Schouten wrote:
Author: ed
Date: Fri Aug 5 17:33:12 2011
New Revision: 224659
URL: http://svn.freebsd.org/changeset/base/224659

Log:
Remove NIS entries from /etc/nsswitch.conf for WITHOUT_NIS.

We already modify various configuration files in /etc based on build
configuration. This is not done for nsswitch.conf right now when setting
WITHOUT_NIS. This breaks various utilities, including crond, that depend
on working databases.

Approved by: re (kib)
MFC after: 1 month

Modified:
head/etc/Makefile

Modified: head/etc/Makefile
==============================================================================
--- head/etc/Makefile Fri Aug 5 17:15:46 2011 (r224658)
+++ head/etc/Makefile Fri Aug 5 17:33:12 2011 (r224659)
@@ -256,6 +256,10 @@ distribution:
${DESTDIR}/boot/device.hints
.endif
.endif
+.if ${MK_NIS} == "no"
+ sed -i "" -e '/_compat:/d' -e 's/compat/files/' \
+ ${DESTDIR}/etc/nsswitch.conf
+.endif

distrib-dirs:
mtree -eU ${MTREE_FOLLOWS_SYMLINKS} -f ${.CURDIR}/mtree/BSD.root.dist -p ${DESTDIR}/




--

Nothin' ever doesn't change, but nothin' changes much.
-- OK Go

Breadth of IT experience, and depth of knowledge in the DNS.
Yours for the right price. :) http://SupersetSolutions.com/

#
# $FreeBSD: head/etc/nsswitch.conf 158266 2006-05-03 15:14:47Z ume $
#
# To enable NIS the commented entries should replace their uncommented
# equivalents. See nsswitch.conf(5) for more information.
#
group: files
#group_compat: nis
#group: compat

passwd: files
#passwd_compat: nis
#passwd: compat

services: files
#services_compat: nis
#services: compat

hosts: files dns
networks: files
shells: files
protocols: files
rpc: files
_______________________________________________
freebsd-current@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Security Configuration Settings?
    ... First I will answer your question about `compat' issue, ... can find other things related to Sun Solaris security. ... and + (include everything, except excluded users, from NIS passwd.byname). ...
    (Focus-SUN)
  • Re: Security Configuration Settings?
    ... > The compat setting allows you to add an extra pseudo database called ... > them up in LDAP. ... Of course, if you're using NIS, put nis as the keyword. ... > Subject: Security Configuration Settings? ...
    (Focus-SUN)
  • Re: Supplementary groups on LDAP cannot work with RELENG_8 +nss_ldap
    ... passwd: compat ... passwd_compat: ldap ... shells: files ... services_compat: nis ...
    (freebsd-stable)
  • Re: Security Configuration Settings?
    ... The compat setting allows you to add an extra pseudo database called ... them up in LDAP. ... Of course, if you're using NIS, put nis as the keyword. ... Subject: Security Configuration Settings? ...
    (Focus-SUN)
  • Problems w/NIS Clients in Compat Mode
    ... I'm using OpenAFS for authentication and using NIS to push out the password maps. ... I'm using NIS compat mode, using netgroups to specify user account access to each machine. ... The problem with this is that they expire, causing the system to ask to change it (I don't want any local passwords). ... I'm specifically using NIS because it won't expire passwords; this is being controlled on the OpenAFS server side. ...
    (comp.os.linux.misc)