[CentOS] why would ls, while or ci use NIS?

Wed Jun 21 19:21:54 UTC 2017
Jonathan Billings <billings at negate.org>

On Wed, Jun 21, 2017 at 08:34:43AM -1000, Dave Burns wrote:
> This looks like NIS (DNS?) error output, but what could be invoking
> anything that uses NIS or DNS in that command? ls, ci, and while don't need
> it unless they are applied to some NFS mounted file, but this is executed
> as root with a *local* home directory on *local* files, no need for YP. The
> only hypotheses I can think of are "my copies of bash or ci have been
> compromised" or "I am stupid".

Do you have any 'nis' entries in /etc/nsswitch.conf for passwd or
group?  It might be using NIS to try to look up user/group information
on files that have uid/gid numbers that aren't in the local
passwd/group files.

Jonathan Billings <billings at negate.org>