A note about NIS

passwd: files nis
group: files nis

This instructs the system to first look in /etc/passwd
or /etc/group for an entry and then fallback and query
NIS for the entry. This configuration does not look for
nor enforce +/- behavior.

If you want to use the +/- semantics you will need to
configure passwd and group as follows:


passwd: compat
group: compat

This instructs the system to enforce the +/- semantics.