getent.ldap(1)

📦
version 0.9.13 · 4 versions
, in arch rolling, debian trixie, nixos 26.05, nixpkgs unstable, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ getent.ldap — the manual page, bestie edition ✨

okay so welcome to getent.ldap(1), the user command that's about to be your new fav 💖 this is a section 1 manual page and it's literally all about pulling info out of LDAP. buckle up 🎀

🌸 NAME 🌸

getent.ldap — query information from LDAP

🦋 SYNOPSIS 🦋

getent.ldap [options] [DATABASE] [KEY...]

💅 DESCRIPTION 💅

So getent.ldap is the girl who looks up or enumerates information from LDAP. and here's the thing that makes her different from getent(1) — she completely bypasses all the lookups you configured in /etc/nsswitch.conf and goes straight to the nslcd(8) daemon. no middleman, no nsswitch, just vibes and direct queries ✨

She does try her best to match the behaviour and output of getent and the format of the corresponding flat files, but ngl there are a number of differences. If multiple entries are found in LDAP that match a specific query, multiple values are printed (like ethernet addresses that have multiple names, services that support multiple protocols, etc.). Also some databases have extra options, which we get into below 👇

👑 OPTIONS 👑

The options that may be specified to the getent.ldap command are:

  • -h, --help — display short help and exit. short and sweet, love that for her 🫶
  • -V, --version — output version information and exit.

🌈 DATABASES 🌈

The DATABASE argument may be any of the supported databases below:

  • aliases — lists or queries email aliases. If KEY is given it searches for the alias by name, otherwise it returns all aliases from LDAP.
  • ethers — lists or queries ethernet addresses. If KEY matches the format of an ethernet address a search by address is performed, otherwise a search by name is performed, or all entries are returned if KEY is omitted. Unlike getent, getent.ldapd does support enumerating all ethernet addresses 👀
  • group — lists or queries groups. If KEY is numeric, it searches for the group by group id.
  • group.bymember — the KEY is a user name and groups are returned for which this user is a member. The format is similar to the group output but the group members are left out for performance reasons. efficient queen ⚡
  • hosts — list or search host names and addresses by either host name, IPv4 or IPv6 address. This returns both IPv4 and IPv6 addresses (if available). both?? she said yes to both 💖
  • hostsv4 — similar to hosts but any supplied IPv6 addresses are treated as host names and only IPv4 addresses are returned.
  • hostsv6 — similar to hosts but KEY is treated as an IPv6 address or a host name and only IPv6 addresses are returned.
  • netgroup — list or query netgroups and netgroup triples (host, user, domain) that are a member of the netgroup. Unlike getent, getent.ldapd does support enumerating all ethernet addresses.
  • netgroup.norec — similar to netgroup except that no subsequent lookups are done to expand netgroups which are member of the supplied netgroup, and the output may contain both other netgroup names and netgroup triples. no recursion, no drama 🙈
  • networks — list or query network names and addresses. KEY may be a network name or address. This map can return both IPv4 and IPv6 network addresses.
  • networksv4 — only return IPv4 network addresses.
  • networksv6 — only return IPv6 network addresses.
  • passwd — enumerate or search the user account database. KEY may be a user name or numeric user id, or be omitted to list all users.
  • protocols — enumerate the internet protocols database.
  • rpc — list or search user readable names that map to RPC program numbers. Searching by KEY can be done on name or rpc program number.
  • services — list or search the mapping between names for internet services and their corresponding port numbers and protocol types. The KEY can be either a service name or number, followed by an optional slash and protocol name to restrict the search to only entries for the specified protocol.
  • shadow — enumerate or search extended user account information. > note that shadow information is likely only exposed to the root user and by default nslcd does not expose password hashes, even to root. 🔒 like, even root doesn't get the hashes by default, that's the whole point bestie.

🧚 SEE ALSO 🧚

getent(1), nslcd(8) — go read those too, iykyk 📚

💜 AUTHOR 💜

This manual was written by Arthur de Jong <arthur@arthurdejong.org>. iconic behaviour, thank you for your service 🫡

💀 BUGS 💀

Currently, getent.ldapd does not correctly set an exit code. It should return the same kind of exit codes as getent does (e.g. for missing entries). so like, the exit code situation is a little unhinged rn, noted and flagged 😭

and that's the whole page babes ✨ this was Version 0.9.13, from Feb 2025 — getent.ldap(1), out. slay, periodt, go query some LDAP 💅🎀

📦 where this page comes from