source: postlfs/security/linux-pam.xml@ 1eac9eb

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 9.0 9.1 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 1eac9eb was 1eac9eb, checked in by Pierre Labastie <pieere@…>, 5 years ago

Archive w3m and allow linux-pam doc to be built with lynx

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@21481 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 17.2 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY linux-pam-download-http "http://linux-pam.org/library/Linux-PAM-&linux-pam-version;.tar.bz2">
8 <!ENTITY linux-pam-download-ftp " ">
9 <!ENTITY linux-pam-md5sum "da4b2289b7cfb19583d54e9eaaef1c3a">
10 <!ENTITY linux-pam-size "1.3 MB">
11 <!ENTITY linux-pam-buildsize "28 MB (with tests)">
12 <!ENTITY linux-pam-time "0.5 SBU (with tests)">
13
14 <!ENTITY linux-pam-docs-download "http://linux-pam.org/documentation/Linux-PAM-&linux-pam-docs-version;-docs.tar.bz2">
15 <!ENTITY linux-pam-docs-md5sum "558378b8be9b8b5c987326f4529f2130">
16 <!ENTITY linux-pam-docs-size "480 KB">
17 <!ENTITY debian-pam-docs "http://debian.securedservers.com/kernel/pub/linux/libs/pam">
18]>
19
20<sect1 id="linux-pam" xreflabel="Linux-PAM-&linux-pam-version;">
21 <?dbhtml filename="linux-pam.html"?>
22
23 <sect1info>
24 <othername>$LastChangedBy$</othername>
25 <date>$Date$</date>
26 </sect1info>
27
28 <title>Linux-PAM-&linux-pam-version;</title>
29
30 <indexterm zone="linux-pam">
31 <primary sortas="a-Linux-PAM">Linux-PAM</primary>
32 </indexterm>
33
34 <sect2 role="package">
35 <title>Introduction to Linux PAM</title>
36
37 <para>
38 The <application>Linux PAM</application> package contains
39 Pluggable Authentication Modules used to enable the local
40 system administrator to choose how applications authenticate
41 users.
42 </para>
43
44 &lfs84_checked;
45
46 <bridgehead renderas="sect3">Package Information</bridgehead>
47 <itemizedlist spacing="compact">
48 <listitem>
49 <para>
50 Download (HTTP): <ulink url="&linux-pam-download-http;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download (FTP): <ulink url="&linux-pam-download-ftp;"/>
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download MD5 sum: &linux-pam-md5sum;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Download size: &linux-pam-size;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated disk space required: &linux-pam-buildsize;
71 </para>
72 </listitem>
73 <listitem>
74 <para>
75 Estimated build time: &linux-pam-time;
76 </para>
77 </listitem>
78 </itemizedlist>
79
80 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
81 <itemizedlist spacing="compact">
82 <title>Optional Documentation</title>
83 <listitem>
84 <para>
85 Download (HTTP): <ulink url="&linux-pam-docs-download;"/>
86 </para>
87 </listitem>
88 <listitem>
89 <para>
90 Download MD5 sum: &linux-pam-docs-md5sum;
91 </para>
92 </listitem>
93 <listitem>
94 <para>
95 Download size &linux-pam-docs-size;
96 </para>
97 </listitem>
98 </itemizedlist>
99
100 <bridgehead renderas="sect3">Linux PAM Dependencies</bridgehead>
101
102 <bridgehead renderas="sect4">Optional</bridgehead>
103 <para role="optional">
104 <xref linkend="db"/>,
105 <xref linkend="cracklib"/>,
106 <xref linkend="libtirpc"/> and
107 <ulink url="http://www.prelude-siem.org">Prelude</ulink>
108 </para>
109
110 <bridgehead renderas="sect4">Optional (To Rebuild the Documentation)</bridgehead>
111 <para role="optional">
112 <xref linkend="DocBook"/>,
113 <xref linkend="docbook-xsl"/>,
114 <xref linkend="fop"/>,
115 <xref linkend="libxslt"/> and either
116 <xref linkend="lynx"/> or
117 <ulink url="&w3m-url;">W3m</ulink>
118 </para>
119
120 <para condition="html" role="usernotes">User Notes:
121 <ulink url="&blfs-wiki;/linux-pam"/>
122 </para>
123 </sect2>
124
125 <sect2 role="installation">
126 <title>Installation of Linux PAM</title>
127
128 <para>
129 If you downloaded the documentation, unpack the tarball by issuing
130 the following command.
131 </para>
132
133<screen><userinput>tar -xf ../Linux-PAM-&linux-pam-docs-version;-docs.tar.bz2 --strip-components=1</userinput></screen>
134
135 <para>
136 If you instead want to regenerate the documentation, fix the
137 <command>configure</command> script so that it detects lynx if installed:
138 </para>
139
140<screen><userinput>sed -e 's/dummy links/dummy lynx/' \
141 -e 's/-no-numbering -no-references/-force-html -nonumbers -stdin/' \
142 -i configure</userinput></screen>
143
144 <para>
145 Install <application>Linux PAM</application> by
146 running the following commands:
147 </para>
148
149<screen><userinput>./configure --prefix=/usr \
150 --sysconfdir=/etc \
151 --libdir=/usr/lib \
152 --enable-securedir=/lib/security \
153 --docdir=/usr/share/doc/Linux-PAM-&linux-pam-version; &amp;&amp;
154make</userinput></screen>
155
156 <para>
157 To test the results, a suitable <filename>/etc/pam.d/other</filename>
158 configuration file must exist.
159 </para>
160
161 <caution>
162 <title>Reinstallation or upgrade of Linux PAM</title>
163 <para>
164 If you have a system with Linux PAM installed and working, be careful
165 when modifying the files in
166 <filename class="directory">/etc/pam.d</filename>, since your system
167 may become totally unusable. If you want to run the tests, you do not
168 need to create another <filename>/etc/pam.d/other</filename> file. The
169 installed one can be used for that purpose.
170 </para>
171
172 <para>
173 You should also be aware that <command>make install</command>
174 overwrites the configuration files in
175 <filename class="directory">/etc/security</filename> as well as
176 <filename>/etc/environment</filename>. In case you
177 have modified those files, be sure to back them up.
178 </para>
179 </caution>
180
181 <para>
182 For a first installation, create the configuration file by issuing the
183 following commands as the <systemitem class="username">root</systemitem>
184 user:
185 </para>
186
187<screen role="root"><userinput>install -v -m755 -d /etc/pam.d &amp;&amp;
188
189cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
190auth required pam_deny.so
191account required pam_deny.so
192password required pam_deny.so
193session required pam_deny.so
194EOF</userinput></screen>
195
196 <para>
197 Now run the tests by issuing <command>make check</command>.
198 Ensure there are no errors produced by the tests before continuing the
199 installation. Note that the checks are quite long. It may be useful to
200 redirect the output to a log file in order to inspect it thoroughly.
201 </para>
202
203 <para>
204 Only in case of a first installation, remove the configuration file
205 created earlier by issuing the following command as the
206 <systemitem class="username">root</systemitem> user:
207 </para>
208
209<screen role="root"><userinput>rm -fv /etc/pam.d/*</userinput></screen>
210
211 <para>
212 Now, as the <systemitem class="username">root</systemitem>
213 user:
214 </para>
215
216<screen role="root"><userinput>make install &amp;&amp;
217chmod -v 4755 /sbin/unix_chkpwd &amp;&amp;
218
219for file in pam pam_misc pamc
220do
221 mv -v /usr/lib/lib${file}.so.* /lib &amp;&amp;
222 ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
223done</userinput></screen>
224
225 </sect2>
226
227 <sect2 role="commands">
228 <title>Command Explanations</title>
229
230 <para>
231 <parameter>--enable-securedir=/lib/security</parameter>:
232 This switch sets install location for the
233 <application>PAM</application> modules.
234 </para>
235
236 <para>
237 <option>--disable-regenerate-docu</option> : If the needed dependencies
238 (<xref linkend="DocBook"/>, <xref linkend="docbook-xsl"/>, <xref
239 linkend="libxslt"/>, and <xref linkend="lynx"/> or <ulink
240 url="&w3m-url;">W3m</ulink>) are installed, the manual pages, and the
241 html and text documentations are (re)generated and installed.
242 Furthermore, if <xref linkend="fop"/> is installed, the PDF
243 documentation is generated and installed. Use this switch if you do not
244 want to rebuild the documentation.
245 </para>
246
247 <para>
248 <command>chmod -v 4755 /sbin/unix_chkpwd</command>:
249 The <command>unix_chkpwd</command> helper program must be setuid
250 so that non-<systemitem class="username">root</systemitem>
251 processes can access the shadow file.
252 </para>
253
254 </sect2>
255
256 <sect2 role="configuration">
257 <title>Configuring Linux-PAM</title>
258
259 <sect3 id="pam-config">
260 <title>Config Files</title>
261
262 <para>
263 <filename>/etc/security/*</filename> and
264 <filename>/etc/pam.d/*</filename>
265 </para>
266
267 <indexterm zone="linux-pam pam-config">
268 <primary sortas="e-etc-security">/etc/security/*</primary>
269 </indexterm>
270
271 <indexterm zone="linux-pam pam-config">
272 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
273 </indexterm>
274
275 </sect3>
276
277 <sect3>
278 <title>Configuration Information</title>
279
280 <para>
281 Configuration information is placed in
282 <filename class="directory">/etc/pam.d/</filename>.
283 Below is an example file:
284 </para>
285
286<screen><literal># Begin /etc/pam.d/other
287
288auth required pam_unix.so nullok
289account required pam_unix.so
290session required pam_unix.so
291password required pam_unix.so nullok
292
293# End /etc/pam.d/other</literal></screen>
294
295 <para>Now set up some generic files. As root:</para>
296
297<screen role="root"><userinput>install -vdm755 /etc/pam.d &amp;&amp;
298cat &gt; /etc/pam.d/system-account &lt;&lt; "EOF" &amp;&amp;
299<literal># Begin /etc/pam.d/system-account
300
301account required pam_unix.so
302
303# End /etc/pam.d/system-account</literal>
304EOF
305
306cat &gt; /etc/pam.d/system-auth &lt;&lt; "EOF" &amp;&amp;
307<literal># Begin /etc/pam.d/system-auth
308
309auth required pam_unix.so
310
311# End /etc/pam.d/system-auth</literal>
312EOF
313
314cat &gt; /etc/pam.d/system-session &lt;&lt; "EOF"
315<literal># Begin /etc/pam.d/system-session
316
317session required pam_unix.so
318
319# End /etc/pam.d/system-session</literal>
320EOF</userinput></screen>
321
322 <para>The remaining generic file depends on whether <xref linkend="cracklib"/>
323 is installed. If it is installed, use:</para>
324
325<screen role="root"><userinput>cat &gt; /etc/pam.d/system-password &lt;&lt; "EOF"
326<literal># Begin /etc/pam.d/system-password
327
328# check new passwords for strength (man pam_cracklib)
329password required pam_cracklib.so authtok_type=UNIX retry=1 difok=5 \
330 minlen=9 dcredit=1 ucredit=1 \
331 lcredit=1 ocredit=1 minclass=0 \
332 maxrepeat=0 maxsequence=0 \
333 maxclassrepeat=0 \
334 dictpath=/lib/cracklib/pw_dict
335# use sha512 hash for encryption, use shadow, and use the
336# authentication token (chosen password) set by pam_cracklib
337# above (or any previous modules)
338password required pam_unix.so sha512 shadow use_authtok
339
340# End /etc/pam.d/system-password</literal>
341EOF</userinput></screen>
342
343 <note>
344 <para>
345 In its default configuration, pam_cracklib will
346 allow multiple case passwords as short as 6 characters, even with
347 the <parameter>minlen</parameter> value set to 11. You should review
348 the pam_cracklib(8) man page and determine if these default values
349 are acceptable for the security of your system.
350 </para>
351 </note>
352
353 <para>If <xref linkend="cracklib"/> is <emphasis>NOT</emphasis> installed,
354 use:</para>
355
356<screen role="root"><userinput>cat &gt; /etc/pam.d/system-password &lt;&lt; "EOF"
357<literal># Begin /etc/pam.d/system-password
358
359# use sha512 hash for encryption, use shadow, and try to use any previously
360# defined authentication token (chosen password) set by any prior module
361password required pam_unix.so sha512 shadow try_first_pass
362
363# End /etc/pam.d/system-password</literal>
364EOF</userinput></screen>
365
366 <para>Now add a restrictive <filename>/etc/pam.d/other</filename>
367 configuration file. With this file, programs that are PAM aware will not
368 run unless a configuration file specifically for that application is
369 created.</para>
370
371<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
372<literal># Begin /etc/pam.d/other
373
374auth required pam_warn.so
375auth required pam_deny.so
376account required pam_warn.so
377account required pam_deny.so
378password required pam_warn.so
379password required pam_deny.so
380session required pam_warn.so
381session required pam_deny.so
382
383# End /etc/pam.d/other</literal>
384EOF</userinput></screen>
385
386 <para>
387 The <application>PAM</application> man page (<command>man
388 pam</command>) provides a good starting point for descriptions
389 of fields and allowable entries. The <ulink
390 url="http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_SAG.html">Linux-PAM
391 System Administrators' Guide</ulink> is recommended for additional
392 information.
393 </para>
394
395 <para>
396 Refer to <ulink url="&debian-pam-docs;/modules.html"/> for a list
397 of various third-party modules available.
398 </para>
399
400 <important>
401 <para>
402 You should now reinstall the <xref linkend="shadow"/>
403 <phrase revision="sysv">package.</phrase>
404 <phrase revision="systemd"> and <xref linkend="systemd"/>
405 packages.</phrase>
406 </para>
407 </important>
408
409 </sect3>
410
411 </sect2>
412
413 <sect2 role="content">
414 <title>Contents</title>
415
416 <segmentedlist>
417 <segtitle>Installed Program</segtitle>
418 <segtitle>Installed Libraries</segtitle>
419 <segtitle>Installed Directories</segtitle>
420
421 <seglistitem>
422 <seg>
423 mkhomedir_helper, pam_tally, pam_tally2,
424 pam_timestamp_check, unix_chkpwd and
425 unix_update
426 </seg>
427 <seg>
428 libpam.so, libpamc.so and libpam_misc.so
429 </seg>
430 <seg>
431 /etc/security,
432 /lib/security,
433 /usr/include/security and
434 /usr/share/doc/Linux-PAM-&linux-pam-version;
435 </seg>
436 </seglistitem>
437 </segmentedlist>
438
439 <variablelist>
440 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
441 <?dbfo list-presentation="list"?>
442 <?dbhtml list-presentation="table"?>
443
444 <varlistentry id="mkhomedir_helper">
445 <term><command>mkhomedir_helper</command></term>
446 <listitem>
447 <para>
448 is a helper binary that creates home directories.
449 </para>
450 <indexterm zone="linux-pam mkhomedir_helper">
451 <primary sortas="b-mkhomedir_helper">mkhomedir_helper</primary>
452 </indexterm>
453 </listitem>
454 </varlistentry>
455
456 <varlistentry id="pam_tally">
457 <term><command>pam_tally</command></term>
458 <listitem>
459 <para>
460 is used to interrogate and manipulate the login counter file.
461 </para>
462 <indexterm zone="linux-pam pam_tally">
463 <primary sortas="b-pam_tally">pam_tally</primary>
464 </indexterm>
465 </listitem>
466 </varlistentry>
467
468 <varlistentry id="pam_tally2">
469 <term><command>pam_tally2</command></term>
470 <listitem>
471 <para>
472 is used to interrogate and manipulate the login counter file, but
473 does not have some limitations that <command>pam_tally</command>
474 does.
475 </para>
476 <indexterm zone="linux-pam pam_tally2">
477 <primary sortas="b-pam_tally2">pam_tally2</primary>
478 </indexterm>
479 </listitem>
480 </varlistentry>
481
482 <varlistentry id="pam_timestamp_check">
483 <term><command>pam_timestamp_check</command></term>
484 <listitem>
485 <para>
486 is used to check if the default timestamp is valid
487 </para>
488 <indexterm zone="linux-pam pam_timestamp_check">
489 <primary sortas="b-pam_timestamp_check">pam_timestamp_check</primary>
490 </indexterm>
491 </listitem>
492 </varlistentry>
493
494 <varlistentry id="unix_chkpwd">
495 <term><command>unix_chkpwd</command></term>
496 <listitem>
497 <para>
498 is a helper binary that verifies the password of the current user.
499 </para>
500 <indexterm zone="linux-pam unix_chkpwd">
501 <primary sortas="b-unix_chkpwd">unix_chkpwd</primary>
502 </indexterm>
503 </listitem>
504 </varlistentry>
505
506 <varlistentry id="unix_update">
507 <term><command>unix_update</command></term>
508 <listitem>
509 <para>
510 is a helper binary that updates the password of a given user.
511 </para>
512 <indexterm zone="linux-pam unix_update">
513 <primary sortas="b-unix_update">unix_update</primary>
514 </indexterm>
515 </listitem>
516 </varlistentry>
517
518 <varlistentry id="libpam">
519 <term><filename class="libraryfile">libpam.so</filename></term>
520 <listitem>
521 <para>
522 provides the interfaces between applications and the
523 PAM modules.
524 </para>
525 <indexterm zone="linux-pam libpam">
526 <primary sortas="c-libpam">libpam.so</primary>
527 </indexterm>
528 </listitem>
529 </varlistentry>
530
531 </variablelist>
532
533 </sect2>
534
535</sect1>
Note: See TracBrowser for help on using the repository browser.