nsswitch.conf or +::::::::: ?

[Stephen Allen]

The FreeBSD handbook says, in "25.4.4.3.1 Setting Up a NIS Client" to 
remove all user accounts from /etc/master.passwd and stick +::::::::: 
into it instead.

Just to clarify... the NIS server uses /var/yp/master.passwd, and 
changes to /etc/master.passwd are just for the client to import all the 
NIS accounts?

man nsswitch.conf implies that you don't need all the +::::::::: stuff. 
It says that method is historical, and goes on to say:

    "An alternative source for the information accessed via `+/-'
     can be used by specifying ``passwd_compat: source''.  ``source''
     in this case can be `dns', `nis', or any other source except
     for `files' and `compat'."

So, my /etc/nsswitch.conf, which currently looks like this (I've not 
changed it)...

    group: compat
    group_compat: nis
    hosts: files dns
    networks: files
    passwd: compat
    passwd_compat: nis
    shells: files

...means I don't need all the +::::::::: stuff?

Something's not right, because I've not used the +::::::::: stuff and 
none of my NIS users can log into the FreeBSD box, the error is: "PAM: 
authentication error for illegal user ..."

Can anyone shed any light on this?

Thanks,
Steve :)