|
The NSS is a feature that is present in many UNIX operating systems. It allows system
information such as hostnames, mail aliases, and user information
to be resolved from different sources. For example, a standalone
UNIX workstation may resolve system information from a series of
flat files stored on the local file system. A networked workstation
may first attempt to resolve system information from local files,
and then consult an NIS database for user information or a DNS server
for hostname information.
The NSS application programming interface allows Winbind
to present itself as a source of system information when
resolving UNIX usernames and groups. Winbind uses this interface
and information obtained from a Windows NT server using MSRPC
calls to provide a new source of account enumeration. Using standard
UNIX library calls, you can enumerate the users and groups on
a UNIX machine running Winbind and see all users and groups in
an NT domain plus any trusted domain as though they were local
users and groups.
The primary control file for NSS is /etc/nsswitch.conf.
When a UNIX application makes a request to do a lookup,
the C library looks in /etc/nsswitch.conf
for a line that matches the service type being requested; for
example, the “passwd” service type is used when user or group names
are looked up. This config line specifies which implementations
of that service should be tried and in what order. If the passwd
config line is:
passwd: files example
then the C library will first load a module called
/lib/libnss_files.so followed by
the module /lib/libnss_example.so. The
C library will dynamically load each of these modules in turn
and call resolver functions within the modules to try to resolve
the request. Once the request is resolved, the C library returns the
result to the application.
This NSS interface provides an easy way for Winbind
to hook into the operating system. All that needs to be done
is to put libnss_winbind.so in /lib/
then add “winbind” into /etc/nsswitch.conf at
the appropriate place. The C library will then call Winbind to
resolve user and group names.
|
