---
name: "getent.ldap"
section: "1"
platform: "linux"
package: "nss-pam-ldapd"
version: "0.9.13-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/getent.ldap"
---

# getent.ldap(1)

query information from LDAP

## NAME

getent.ldap - query information from LDAP

## SYNOPSIS

FC**getent.ldap**F\[0\]  \[*options*\] \[*DATABASE*\] \[*KEY...*\]

## DESCRIPTION

The **getent.ldap** command can be used to lookup or enumerate information from LDAP. Unlike the [**getent**(1)](/getent/1.md) command, this command completely bypasses the lookups configured in FC*/etc/nsswitch.conf*F\[0\] and queries the [**nslcd**(8)](/nslcd/8.md) daemon directly.

**getent.ldap** tries to match the behaviour and output of **getent** and the format in the corresponding flat files as much as possible, however there are a number of differences. If multiple entries are found in LDAP that match a specific query, multiple values are printed (e.g. ethernet addresses that have multiple names, services that support multiple protocols, etc.). Also, some databases have extra options as described below.

## OPTIONS

The options that may be specified to the **getent.ldap** command are:

- FC**-h**F\[0\], FC**--help**F\[0\]

  Display short help and exit.

- FC**-V, --version**F\[0\]

  Output version information and exit.

## DATABASES

The *DATABASE* argument may be any of the supported databases below:

- FC**aliases**F\[0\]

  Lists or queries email aliases. If *KEY* is given it searches for the alias by name, otherwise it returns all aliases from LDAP.

- FC**ethers**F\[0\]

  Lists or queries ethernet addresses. If *KEY* matches the format of an ethernet address a search by address is performed, otherwise a search by name is performed or all entries are returned if *KEY* is omitted. Unlike **getent**, **getent.ldapd** does support enumerating all ethernet addresses.

- FC**group**F\[0\]

  Lists or queries groups. If *KEY* is numeric, it searches for the group by group id.

- FC**group.bymember**F\[0\]

  The *KEY* is a user name and groups are returned for which this user is a member. The format is similar to the FC**group**F\[0\] output but the group members are left out for performance reasons.

- FC**hosts**F\[0\]

  List or search host names and addresses by either host name, IPv4 or IPv6 address. This returns both IPv4 and IPv6 addresses (if available).

- FC**hostsv4**F\[0\]

  Similar to FC**hosts**F\[0\] but any supplied IPv6 addresses are treated as host names and only IPv4 addresses are returned.

- FC**hostsv6**F\[0\]

  Similar to FC**hosts**F\[0\] but *KEY* is treated as an IPv6 address or a host name and only IPv6 addresses are returned.

- FC**netgroup**F\[0\]

  List or query netgroups and netgroup triples (host, user, domain) that are a member of the netgroup. Unlike **getent**, **getent.ldapd** does support enumerating all ethernet addresses.

- FC**netgroup.norec**F\[0\]

  Similar to FC**netgroup**F\[0\] except that no subsequent lookups are done to expand netgroups which are member of the supplied netgroup and the output may contain both other netgroup names and netgroup triples.

- FC**networks**F\[0\]

  List or query network names and addresses. *KEY* may be a network name or address. This map can return both IPv4 and IPv6 network addresses.

- FC**networksv4**F\[0\]

  Only return IPv4 network addresses.

- FC**networksv6**F\[0\]

  Only return IPv6 network addresses.

- FC**passwd**F\[0\]

  Enumerate or search the user account database. *KEY* may be a user name or numeric user id or be omitted to list all users.

- FC**protocols**F\[0\]

  Enumerate the internet protocols database.

- FC**rpc**F\[0\]

  List or search user readable names that map to RPC program numbers. Searching by *KEY* can be done on name or rpc program number.

- FC**services**F\[0\]

  List or search the mapping between names for internet services and their corresponding port numbers and protocol types. The *KEY* can be either a service name or number, followed by an optional slash and protocol name to restrict the search to only entries for the specified protocol.

- FC**shadow**F\[0\]

  Enumerate or search extended user account information. Note that shadow information is likely only exposed to the root user and by default **nslcd** does not expose password hashes, even to root.

## SEE ALSO

[**getent**(1)](/getent/1.md), [**nslcd**(8)](/nslcd/8.md)

## AUTHOR

This manual was written by Arthur de Jong \<arthur@arthurdejong.org\>.

## BUGS

Currently, **getent.ldapd** does not correctly set an exit code. It should return the same kind of exit codes as **getent** does (e.g. for missing entries).