nss(5)

💖 nss — the tea on your Name Service Switch config file 💖

okay bestie, so this is nss(5), a File Formats Manual page, and it's literally the manual for the Name Service Switch configuration file. yes it's a config file manual. yes it's iconic. let's get into it ✨

---

🫶 NAME 🫶

nss — the Name Service Switch configuration file, aka the girl who decides where your system looks stuff up.

---

🌸 DESCRIPTION 🌸

so every single time some function goes "hey, give me data from a system database" — like the password database or the group database — that whole thing gets handled by the Name Service Switch implementation inside the GNU C library. and the various services it provides? each one is implemented by its own independent module, and ngl these modules vary wildly from each other. no two are the same vibe. 💅

the default implementations that come with the GNU C library are, by default, conservative and do not use unsafe data. which sounds great and safe and cozy until you realize it can be very costly in some situations, especially when the databases are huge 😭 like, big big. so some modules let the system administrator request taking shortcuts — but only if those shortcuts are known to be safe. and here's the thing: once you do that, it is entirely the system administrator's responsibility to make sure the assumption is actually correct. no takebacks, bestie. 🫣

then there are other modules where the implementation changed over time. so if an implementation used to sacrifice speed for memory consumption, switching that preference around might create problems. it's giving "the vibes changed and now nothing works." 💀

now, the /etc/default/nss file contains a number of variable assignments. each variable controls the behavior of one or more NSS modules. white spaces get ignored, and any line beginning with '#' is treated as a comment (so go off, annotate your config, we support it 📝).

the variables currently recognized are:

• NETID_AUTHORITATIVE = TRUE|FALSE — if you set this to TRUE, the NIS backend for the initgroups(3) function will accept the info from the netid.byname NIS map as authoritative. this can speed up the function significantly if the group.byname map is large. the content of the netid.byname map is used as is — so the system administrator has to make sure it's correctly generated. you're on your own for that one, queen 👑
• SERVICES_AUTHORITATIVE = TRUE|FALSE — if you set this to TRUE, the NIS backend for the getservbyname(3) and getservbyname_r(3) functions will assume that the services.byservicename NIS map exists and is authoritative — particularly that it contains both keys with /proto and without /proto, for both primary service names and service aliases. again: the system administrator has to make sure it's correctly generated. no pressure or anything 🎀
• SETENT_BATCH_READ = TRUE|FALSE — if you set this to TRUE, the NIS backend for the setpwent(3) and setgrent(3) functions will read the entire database at once and then hand out the requests one by one from memory with every corresponding getpwent(3) or getgrent(3) call respectively. otherwise, every single getpwent(3) or getgrent(3) call might result in a network communication with the server just to get the next entry 😮‍💨 one at a time. over the network. yeah.

---

🎀 FILES 🎀

• /etc/default/nss

---

✨ EXAMPLES ✨

the default configuration corresponds to the following configuration file:

NETID_AUTHORITATIVE=FALSE
SERVICES_AUTHORITATIVE=FALSE
SETENT_BATCH_READ=FALSE

like. all three off. the safest, most unbothered, minding-her-business config. we stan a conservative queen 🧚

---

👑 SEE ALSO 👑

• nsswitch.conf(5)

---

fr fr, if you're touching /etc/default/nss, remember: shortcuts are only safe when you know they're safe. the manpage said it, not me 🫶

---

and that's the whole thing, bestie! this was nss(5) from Linux man-pages 6.20, dated 2026-02-08. go forth and configure responsibly 💖🌈⭐