Netgroups

Netgroups are a mechanism used primarily in Unix-like systems to define sets of hosts and users for access control within a network. They originated with the Network Information Service (NIS) and were popular in Sun Microsystems' environments. A netgroup is a named collection that simplifies policy management by allowing administrators to grant or deny access to multiple systems or services through a single reference.

A netgroup is defined as a list of entries, each represented as a triple of (host, user, domain). Components may be omitted by leaving the field empty. Netgroups can be nested by including other netgroup names in the list, enabling hierarchical role or site definitions. Netgroup definitions are typically stored in the central maps provided by NIS and distributed to clients, or locally in /etc/netgroup.

Netgroups are used by several services to decide access. Common uses include controlling access to NFS exports, automount maps, and RPC-based services such as rlogin and rsh. They can also be referenced in TCP wrappers via hosts.allow and hosts.deny by using the @ prefix to denote a netgroup, for example sshd: @webservers.

Today netgroups remain part of legacy NIS deployments and some Unix-like systems for backward compatibility, though many organizations have migrated to directory services such as LDAP for centralized access control. Netgroups are a simple, lightweight mechanism but offer limited fine-grained authorization.