Apologies for the cross-post, the catalyst for the change was discussed on the RedHat list, but I figured the SourceForge one is the authoritative upstream list.<div> </div><div>Background:</div><div> Our netgroups look like:</div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;">login_<a href="http://samplehost.example.com" target="_blank" style="font-family: arial, sans-serif; color: rgb(0, 62, 168); ">samplehost.example.com</a> (-, apollock, )</blockquote> <div>Our access.conf looks like:</div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"> +:root:ALL +:@login_samplehost.example.com:ALL -:ALL:ALL</blockquote> <div>To be clear, we have per-host netgroups.As of the change made in <a href="http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_access/pam_access.c?view=diff&pathrev=Linux-PAM-1_0_90&r1=1.29&r2=1.30" target="_blank" style="font-family: arial, sans-serif; color: rgb(102, 77, 159); ">http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_access/pam_access.c?view=diff&pathrev=Linux-PAM-1_0_90&r1=1.29&r2=1.30</a> Significant line change (pam_access.c) (lines 512-516):</div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;">return (netgroup_match (pamh, tok + 1, (char *) 0, string, item->debug)); return (netgroup_match (pamh, tok + 1, item->hostname, string, item->debug)); </blockquote> <div>pam_access now wants the netgroup to look like</div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"> login_<a href="http://samplehost.example.com" target="_blank" style="font-family: arial, sans-serif; color: rgb(0, 62, 168); ">samplehost.example.com</a> (, apollock, )</blockquote> <div>or our use case fails.Apparently this change was made based on a user request - <a href="http://www.redhat.com/archives/pam-list/2008-April/msg00032.html" target="_blank" style="font-family: arial, sans-serif; color: rgb(102, 77, 159); ">http://www.redhat.com/archives/pam-list/2008-April/msg00032.html</a> because this user seemed to want to have a single netgroup for all hosts that arbitrated access, based on the user and host components of the netgroup triple. That said, trying to mix users and hosts is incorrect use of a netgroup. <a href="http://docs.sun.com/app/docs/doc/806-1387/6jam692ck?a=view" target="_blank" style="font-family: arial, sans-serif; color: rgb(102, 77, 159); ">http://docs.sun.com/app/docs/doc/806-1387/6jam692ck?a=view</a> states that admins (altair, hauri), (sirius,juanita,sales)is the equivalent of admins (altair,-), (sirius,-), (-,hauri), (-,juanita,sales)so it comes down to what you're querying a netgroup for, users or hosts. Trying to mix the two will give undesired results. <a href="http://docs.sun.com/app/docs/doc/816-5174/netgroup-4?l=en&a=view&q=netgroup" target="_blank" style="font-family: sans-serif; color: rgb(102, 77, 159); ">http://docs.sun.com/app/docs/doc/816-5174/netgroup-4?l=en&a=view&q=netgroup</a> says: </div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;">Because the "-" character will not match any specific username or hostname, it is commonly used as a placeholder that will match only wildcarded membership queries. So, for example: onlyhosts (host1,-,our.domain) (host2,-,our.domain) onlyusers (-,john,our.domain) (-,linda,our.domain) effectively define netgroups containing only hosts and only users, respectively. Any other string that is guaranteed not to be a legal username or hostname will also suffice for this purpose. Use of placeholders will improve search performance.</blockquote> <div> <a href="http://www.softpanorama.org/Net/Application_layer/NIS/nis_netgroups.shtml" target="_blank" style="font-family: Arial, Helvetica, FreeSans, Luxi-sans, 'Nimbus Sans L', sans-serif; color: rgb(51, 51, 51); ">http://www.softpanorama.org/Net/Application_layer/NIS/nis_netgroups.shtml</a> also says: Though netgroup pairs (or triples) group together hostnames, usernames and domainnames, nothing really reads them in that manner. They exist only in NIS maps. The file /etc/netgroup only exists in order to be your 'flat' source file. It is important to understand that there is no necessary relationship between the machine and user elements in an entry and such definitions usually should be split into two: one for users and one for servers. admins (-,john), (-,nick)It is possible to omit dash and use just leading comma. But if this netgroup were ever accidentally included in a list of hosts rather than users, the blank space would be interpreted as a wildcard meaning any host. For example, if someone used this netgroup in a -access list in the /etc/exports file, any host would have access to the exported directory. For this reason, if a netgroup is used strictly as a list of users, you should always put a dash in the host field, as in example above. The following netgroup will not do what you expect:bogus-group (machine1,user1), (machine2,user2) # not what you might think !!! You might think this means user1 at machine1 and user2 at machine2, but in actuality, it is a netgroup that defines either two users (user1 and user2) if used in place were configuration file expects users or two machines (machine1 and machine2) is uses when particular configuration file expects list of hosts. So I'm going to file a bug about this, but I wanted to provide the full background here for discussion also. regardsAndrew </div>