source: postlfs/security/linux-pam.xml@ 0be2ac2f

kde5-14686 systemd-13485
Last change on this file since 0be2ac2f was 6283ab1, checked in by Krejzi <krejzi@…>, 10 years ago

Let the testing begin.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/branches/systemd@13987 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 12.6 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY linux-pam-download-http "http://linux-pam.org/library/Linux-PAM-&linux-pam-version;.tar.bz2">
8 <!ENTITY linux-pam-download-ftp " ">
9 <!ENTITY linux-pam-md5sum "35b6091af95981b1b2cd60d813b5e4ee">
10 <!ENTITY linux-pam-size "1.1 MB">
11 <!ENTITY linux-pam-buildsize "22 MB">
12 <!ENTITY linux-pam-time "0.3 SBU">
13
14 <!ENTITY linux-pam-docs-download "http://linux-pam.org/documentation/Linux-PAM-&linux-pam-version;-docs.tar.bz2">
15 <!ENTITY linux-pam-docs-md5sum "730895d1c6e1c706dc5ffe2419f9b3f5">
16 <!ENTITY linux-pam-docs-size "148 KB">
17 <!ENTITY debian-pam-docs "http://debian.securedservers.com/kernel/pub/linux/libs/pam">
18]>
19
20<sect1 id="linux-pam" xreflabel="Linux-PAM-&linux-pam-version;">
21 <?dbhtml filename="linux-pam.html"?>
22
23 <sect1info>
24 <othername>$LastChangedBy$</othername>
25 <date>$Date$</date>
26 </sect1info>
27
28 <title>Linux-PAM-&linux-pam-version;</title>
29
30 <indexterm zone="linux-pam">
31 <primary sortas="a-Linux-PAM">Linux-PAM</primary>
32 </indexterm>
33
34 <sect2 role="package">
35 <title>Introduction to Linux PAM</title>
36
37 <para>
38 The <application>Linux PAM</application> package contains
39 Pluggable Authentication Modules used to enable the local
40 system administrator to choose how applications authenticate
41 users.
42 </para>
43
44 &lfs76_checked;
45
46 <bridgehead renderas="sect3">Package Information</bridgehead>
47 <itemizedlist spacing="compact">
48 <listitem>
49 <para>
50 Download (HTTP): <ulink url="&linux-pam-download-http;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download (FTP): <ulink url="&linux-pam-download-ftp;"/>
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download MD5 sum: &linux-pam-md5sum;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Download size: &linux-pam-size;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated disk space required: &linux-pam-buildsize;
71 </para>
72 </listitem>
73 <listitem>
74 <para>
75 Estimated build time: &linux-pam-time;
76 </para>
77 </listitem>
78 </itemizedlist>
79
80 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
81 <itemizedlist spacing="compact">
82 <title>Optional Documentation</title>
83 <listitem>
84 <para>
85 Download (HTTP): <ulink url="&linux-pam-docs-download;"/>
86 </para>
87 </listitem>
88 <listitem>
89 <para>
90 Download MD5 sum: &linux-pam-docs-md5sum;
91 </para>
92 </listitem>
93 <listitem>
94 <para>
95 Download size &linux-pam-docs-size;
96 </para>
97 </listitem>
98 </itemizedlist>
99
100 <bridgehead renderas="sect3">Linux PAM Dependencies</bridgehead>
101
102 <bridgehead renderas="sect4">Optional</bridgehead>
103 <para role="optional">
104 <xref linkend="db"/>,
105 <xref linkend="cracklib"/>,
106 <xref linkend="libtirpc"/> and
107 <ulink url="http://www.prelude-ids.org/">Prelude</ulink>
108 </para>
109
110 <bridgehead renderas="sect4">Optional (To Rebuild the Documentation)</bridgehead>
111 <para role="optional">
112 <xref linkend="DocBook"/>,
113 <xref linkend="docbook-xsl"/>,
114 <xref linkend="fop"/>,
115 <xref linkend="libxslt"/> and
116 <xref linkend="w3m"/>
117 </para>
118
119 <para condition="html" role="usernotes">User Notes:
120 <ulink url="&blfs-wiki;/linux-pam"/>
121 </para>
122 </sect2>
123
124 <sect2 role="installation">
125 <title>Installation of Linux PAM</title>
126
127 <para>
128 If you downloaded the documentation, unpack the tarball by issuing
129 the following command.
130 </para>
131
132<screen><userinput>tar -xf ../Linux-PAM-&linux-pam-version;-docs.tar.bz2 --strip-components=1</userinput></screen>
133
134 <para>
135 Install <application>Linux PAM</application> by
136 running the following commands:
137 </para>
138
139<screen><userinput>./configure --prefix=/usr \
140 --sysconfdir=/etc \
141 --libdir=/usr/lib \
142 --enable-securedir=/lib/security \
143 --docdir=/usr/share/doc/Linux-PAM-&linux-pam-version; &amp;&amp;
144make</userinput></screen>
145
146 <para>
147 To test the results, a suitable <filename>/etc/pam.d/other</filename>
148 configuration file must exist.
149 </para>
150
151 <caution>
152 <title>Reinstallation or upgrade of Linux PAM</title>
153 <para>
154 If you have a system with Linux PAM installed and working, be careful
155 when modifying the files in
156 <filename class="directory">/etc/pam.d</filename>, since your system
157 may become totally unusable. If you want to run the tests, you do not
158 need to create another <filename>/etc/pam.d/other</filename> file. The
159 installed one can be used for that purpose.
160 </para>
161
162 <para>
163 You should also be aware that <command>make install</command>
164 overwrites the configuration files in
165 <filename class="directory">/etc/security</filename> as well as
166 <filename>/etc/environment</filename>. In case you
167 have modified those files, be sure to backup them.
168 </para>
169 </caution>
170
171 <para>
172 For a first installation, create the configuration file by issuing the
173 following commands as the <systemitem class="username">root</systemitem>
174 user:
175 </para>
176
177<screen role="root"><userinput>install -v -m755 -d /etc/pam.d &amp;&amp;
178
179cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
180auth required pam_deny.so
181account required pam_deny.so
182password required pam_deny.so
183session required pam_deny.so
184EOF</userinput></screen>
185
186 <para>
187 Now run the tests by issuing <command>make check</command>.
188 Ensure there are no errors produced by the tests before continuing the
189 installation.
190 </para>
191
192 <para>
193 Only in case of a first installation, remove the configuration file
194 created earlier by issuing the following command as the
195 <systemitem class="username">root</systemitem> user:
196 </para>
197
198<screen role="root"><userinput>rm -rfv /etc/pam.d</userinput></screen>
199
200 <para>
201 Now, as the <systemitem class="username">root</systemitem>
202 user:
203 </para>
204
205<screen role="root"><userinput>make install &amp;&amp;
206chmod -v 4755 /sbin/unix_chkpwd &amp;&amp;
207
208for file in pam pam_misc pamc
209do
210 mv -v /usr/lib/lib${file}.so.* /lib &amp;&amp;
211 ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
212done</userinput></screen>
213
214 </sect2>
215
216 <sect2 role="commands">
217 <title>Command Explanations</title>
218
219 <para>
220 <parameter>--enable-securedir=/lib/security</parameter>:
221 This switch sets install location for the
222 <application>PAM</application> modules.
223 </para>
224
225 <para>
226 <command>chmod -v 4755 /sbin/unix_chkpwd</command>:
227 The <command>unix_chkpwd</command> helper program must be setuid
228 so that non-<systemitem class="username">root</systemitem>
229 processes can access the shadow file.
230 </para>
231
232 </sect2>
233
234 <sect2 role="configuration">
235 <title>Configuring Linux-PAM</title>
236
237 <sect3 id="pam-config">
238 <title>Config Files</title>
239
240 <para>
241 <filename>/etc/security/*</filename> and
242 <filename>/etc/pam.d/*</filename>
243 </para>
244
245 <indexterm zone="linux-pam pam-config">
246 <primary sortas="e-etc-security">/etc/security/*</primary>
247 </indexterm>
248
249 <indexterm zone="linux-pam pam-config">
250 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
251 </indexterm>
252
253 </sect3>
254
255 <sect3>
256 <title>Configuration Information</title>
257
258 <para>
259 Configuration information is placed in
260 <filename class="directory">/etc/pam.d/</filename>.
261 Below is an example file:
262 </para>
263
264<screen><literal># Begin /etc/pam.d/other
265
266auth required pam_unix.so nullok
267account required pam_unix.so
268session required pam_unix.so
269password required pam_unix.so nullok
270
271# End /etc/pam.d/other</literal></screen>
272
273 <para>
274 The <application>PAM</application> man page (<command>man
275 pam</command>) provides a good starting point for descriptions
276 of fields and allowable entries. The <ulink
277 url="http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_SAG.html">Linux-PAM
278 System Administrators' Guide</ulink> is recommended for additional
279 information.
280 </para>
281
282 <para>
283 Refer to <ulink url="&debian-pam-docs;/modules.html"/> for a list
284 of various third-party modules available.
285 </para>
286
287 <important>
288 <para>
289 You should now reinstall the <xref linkend="shadow"/>
290 package.
291 </para>
292 </important>
293
294 </sect3>
295
296 </sect2>
297
298 <sect2 role="content">
299 <title>Contents</title>
300
301 <segmentedlist>
302 <segtitle>Installed Program</segtitle>
303 <segtitle>Installed Libraries</segtitle>
304 <segtitle>Installed Directories</segtitle>
305
306 <seglistitem>
307 <seg>
308 mkhomedir_helper, pam_tally, pam_tally2,
309 pam_timestamp_check, unix_chkpwd and
310 unix_update
311 </seg>
312 <seg>
313 libpam.so, libpamc.so and libpam_misc.so
314 </seg>
315 <seg>
316 /etc/security,
317 /lib/security,
318 /usr/include/security and
319 /usr/share/doc/Linux-PAM-&linux-pam-version;
320 </seg>
321 </seglistitem>
322 </segmentedlist>
323
324 <variablelist>
325 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
326 <?dbfo list-presentation="list"?>
327 <?dbhtml list-presentation="table"?>
328
329 <varlistentry id="mkhomedir_helper">
330 <term><command>mkhomedir_helper</command></term>
331 <listitem>
332 <para>
333 is a helper binary that creates home directories.
334 </para>
335 <indexterm zone="linux-pam mkhomedir_helper">
336 <primary sortas="b-mkhomedir_helper">mkhomedir_helper</primary>
337 </indexterm>
338 </listitem>
339 </varlistentry>
340
341 <varlistentry id="pam_tally">
342 <term><command>pam_tally</command></term>
343 <listitem>
344 <para>
345 is used to interrogate and manipulate the login counter file.
346 </para>
347 <indexterm zone="linux-pam pam_tally">
348 <primary sortas="b-pam_tally">pam_tally</primary>
349 </indexterm>
350 </listitem>
351 </varlistentry>
352
353 <varlistentry id="pam_tally2">
354 <term><command>pam_tally2</command></term>
355 <listitem>
356 <para>
357 is used to interrogate and manipulate the login counter file, but
358 does not have some limitations that <command>pam_tally</command>
359 does.
360 </para>
361 <indexterm zone="linux-pam pam_tally2">
362 <primary sortas="b-pam_tally2">pam_tally2</primary>
363 </indexterm>
364 </listitem>
365 </varlistentry>
366
367 <varlistentry id="pam_timestamp_check">
368 <term><command>pam_timestamp_check</command></term>
369 <listitem>
370 <para>
371 is used to check if the default timestamp is valid
372 </para>
373 <indexterm zone="linux-pam pam_timestamp_check">
374 <primary sortas="b-pam_timestamp_check">pam_timestamp_check</primary>
375 </indexterm>
376 </listitem>
377 </varlistentry>
378
379 <varlistentry id="unix_chkpwd">
380 <term><command>unix_chkpwd</command></term>
381 <listitem>
382 <para>
383 is a helper binary that verifies the password of the current user.
384 </para>
385 <indexterm zone="linux-pam unix_chkpwd">
386 <primary sortas="b-unix_chkpwd">unix_chkpwd</primary>
387 </indexterm>
388 </listitem>
389 </varlistentry>
390
391 <varlistentry id="unix_update">
392 <term><command>unix_update</command></term>
393 <listitem>
394 <para>
395 is a helper binary that updates the password of a given user.
396 </para>
397 <indexterm zone="linux-pam unix_update">
398 <primary sortas="b-unix_update">unix_update</primary>
399 </indexterm>
400 </listitem>
401 </varlistentry>
402
403 <varlistentry id="libpam">
404 <term><filename class="libraryfile">libpam.so</filename></term>
405 <listitem>
406 <para>
407 provides the interfaces between applications and the
408 PAM modules.
409 </para>
410 <indexterm zone="linux-pam libpam">
411 <primary sortas="c-libpam">libpam.so</primary>
412 </indexterm>
413 </listitem>
414 </varlistentry>
415
416 </variablelist>
417
418 </sect2>
419
420</sect1>
Note: See TracBrowser for help on using the repository browser.