Netgroup

Netgroup is a data construct used in UNIX and UNIX-like systems to define collections of hosts, users, and domains for purposes of access control, authentication, and administration. Netgroups are commonly associated with the Network Information Service (NIS, also known as YP) and its successor NIS+. They can be defined locally in a file such as /etc/netgroup or stored in centralized maps provided by NIS/NIS+, and they can be queried by system libraries and services to determine membership.

A netgroup entry consists of a name and a list of members. Each member is either a triplet of the form (host, user, domain) or a reference to another netgroup, prefixed with an @ to enable nesting. Empty fields in a triplet can denote any value, allowing flexible definitions. Example definitions might look like:

engineering (web1.example.com, alice, example.com) (web2.example.com, bob, example.com) @internal-dev

internal-dev (db1.example.org, carol, example.org) (db2.example.org, dave, example.org)

Netgroups are used to simplify access control across multiple hosts and services. They enable services such as remote login, file sharing, NFS exports, and automount maps to authorize access based on group membership rather than enumerating individual hosts or users. The membership is typically resolved by library routines such as getnetgrent or innetgr, which query the relevant netgroup maps.

In practice, netgroups support scalable administration in environments that rely on NIS or NIS+-based naming and authentication. They are less commonly used in modern deployments that favor centralized directory services (e.g., LDAP) or Kerberos-based authentication, but they remain a foundational mechanism in many legacy or mixed environments.