source: postlfs/security/linux-pam.xml@ 66c4901f

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 9.1 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 66c4901f was 66c4901f, checked in by Bruce Dubbs <bdubbs@…>, 4 years ago

Just tags

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@22697 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 17.7 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY linux-pam-download-http "https://github.com/linux-pam/linux-pam/releases/download/v&linux-pam-version;/Linux-PAM-&linux-pam-version;.tar.xz">
8 <!ENTITY linux-pam-download-ftp " ">
9 <!ENTITY linux-pam-md5sum "558ff53b0fc0563ca97f79e911822165">
10 <!ENTITY linux-pam-size "892 MB">
11 <!ENTITY linux-pam-buildsize "26 MB (with tests)">
12 <!ENTITY linux-pam-time "0.3 SBU (with tests)">
13
14 <!ENTITY linux-pam-docs-download "https://github.com/linux-pam/linux-pam/releases/download/v&linux-pam-version;/Linux-PAM-&linux-pam-docs-version;-docs.tar.xz">
15 <!ENTITY linux-pam-docs-md5sum "1885fae049acd1b699a5459d7c4a0130">
16 <!ENTITY linux-pam-docs-size "449 KB">
17 <!--
18 <!ENTITY debian-pam-docs "http://debian.securedservers.com/kernel/pub/linux/libs/pam">
19 -->
20]>
21
22<sect1 id="linux-pam" xreflabel="Linux-PAM-&linux-pam-version;">
23 <?dbhtml filename="linux-pam.html"?>
24
25 <sect1info>
26 <othername>$LastChangedBy$</othername>
27 <date>$Date$</date>
28 </sect1info>
29
30 <title>Linux-PAM-&linux-pam-version;</title>
31
32 <indexterm zone="linux-pam">
33 <primary sortas="a-Linux-PAM">Linux-PAM</primary>
34 </indexterm>
35
36 <sect2 role="package">
37 <title>Introduction to Linux PAM</title>
38
39 <para>
40 The <application>Linux PAM</application> package contains
41 Pluggable Authentication Modules used to enable the local
42 system administrator to choose how applications authenticate
43 users.
44 </para>
45
46 &lfs91_checked;
47
48 <bridgehead renderas="sect3">Package Information</bridgehead>
49 <itemizedlist spacing="compact">
50 <listitem>
51 <para>
52 Download (HTTP): <ulink url="&linux-pam-download-http;"/>
53 </para>
54 </listitem>
55 <listitem>
56 <para>
57 Download (FTP): <ulink url="&linux-pam-download-ftp;"/>
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download MD5 sum: &linux-pam-md5sum;
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Download size: &linux-pam-size;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Estimated disk space required: &linux-pam-buildsize;
73 </para>
74 </listitem>
75 <listitem>
76 <para>
77 Estimated build time: &linux-pam-time;
78 </para>
79 </listitem>
80 </itemizedlist>
81
82 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
83 <itemizedlist spacing="compact">
84 <title>Optional Documentation</title>
85 <listitem>
86 <para>
87 Download (HTTP): <ulink url="&linux-pam-docs-download;"/>
88 </para>
89 </listitem>
90 <listitem>
91 <para>
92 Download MD5 sum: &linux-pam-docs-md5sum;
93 </para>
94 </listitem>
95 <listitem>
96 <para>
97 Download size &linux-pam-docs-size;
98 </para>
99 </listitem>
100 </itemizedlist>
101
102 <bridgehead renderas="sect3">Linux PAM Dependencies</bridgehead>
103
104 <bridgehead renderas="sect4">Optional</bridgehead>
105 <para role="optional">
106 <xref linkend="db"/>,
107 <xref linkend="cracklib"/>,
108 <xref linkend="libtirpc"/> and
109 <ulink url="http://www.prelude-siem.org">Prelude</ulink>
110 </para>
111
112 <bridgehead renderas="sect4">Optional (To Rebuild the Documentation)</bridgehead>
113 <para role="optional">
114 <xref linkend="DocBook"/>,
115 <xref linkend="docbook-xsl"/>,
116 <xref linkend="fop"/>,
117 <xref linkend="libxslt"/> and either
118 <xref linkend="lynx"/> or
119 <ulink url="&w3m-url;">W3m</ulink>
120 </para>
121
122 <note>
123 <para role="required">
124 <xref role="runtime" linkend="shadow"/>
125 <phrase revision="systemd"> and <xref role="runtime" linkend="systemd"/>
126 need</phrase><phrase revision="sysv">needs</phrase> to be reinstalled
127 after installing and configuring <application>Linux PAM</application>.
128 </para>
129 </note>
130
131 <para condition="html" role="usernotes">User Notes:
132 <ulink url="&blfs-wiki;/linux-pam"/>
133 </para>
134 </sect2>
135
136 <sect2 role="installation">
137 <title>Installation of Linux PAM</title>
138
139 <para>
140 If you downloaded the documentation, unpack the tarball by issuing
141 the following command.
142 </para>
143
144<screen><userinput>tar -xf ../Linux-PAM-&linux-pam-docs-version;-docs.tar.xz --strip-components=1</userinput></screen>
145
146 <para>
147 If you instead want to regenerate the documentation, fix the
148 <command>configure</command> script so that it detects lynx if installed:
149 </para>
150
151<screen><userinput>sed -e 's/dummy links/dummy lynx/' \
152 -e 's/-no-numbering -no-references/-force-html -nonumbers -stdin/' \
153 -i configure</userinput></screen>
154
155 <para>
156 Install <application>Linux PAM</application> by
157 running the following commands:
158 </para>
159
160<screen><userinput>./configure --prefix=/usr \
161 --sysconfdir=/etc \
162 --libdir=/usr/lib \
163 --enable-securedir=/lib/security \
164 --docdir=/usr/share/doc/Linux-PAM-&linux-pam-version; &amp;&amp;
165make</userinput></screen>
166
167 <para>
168 To test the results, a suitable <filename>/etc/pam.d/other</filename>
169 configuration file must exist.
170 </para>
171
172 <caution>
173 <title>Reinstallation or upgrade of Linux PAM</title>
174 <para>
175 If you have a system with Linux PAM installed and working, be careful
176 when modifying the files in
177 <filename class="directory">/etc/pam.d</filename>, since your system
178 may become totally unusable. If you want to run the tests, you do not
179 need to create another <filename>/etc/pam.d/other</filename> file. The
180 installed one can be used for that purpose.
181 </para>
182
183 <para>
184 You should also be aware that <command>make install</command>
185 overwrites the configuration files in
186 <filename class="directory">/etc/security</filename> as well as
187 <filename>/etc/environment</filename>. In case you
188 have modified those files, be sure to back them up.
189 </para>
190 </caution>
191
192 <para>
193 For a first installation, create the configuration file by issuing the
194 following commands as the <systemitem class="username">root</systemitem>
195 user:
196 </para>
197
198<screen role="root"><userinput>install -v -m755 -d /etc/pam.d &amp;&amp;
199
200cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
201<literal>auth required pam_deny.so
202account required pam_deny.so
203password required pam_deny.so
204session required pam_deny.so</literal>
205EOF</userinput></screen>
206
207 <para>
208 Now run the tests by issuing <command>make check</command>.
209 Ensure there are no errors produced by the tests before continuing the
210 installation. Note that the checks are quite long. It may be useful to
211 redirect the output to a log file in order to inspect it thoroughly.
212 </para>
213
214 <para>
215 Only in case of a first installation, remove the configuration file
216 created earlier by issuing the following command as the
217 <systemitem class="username">root</systemitem> user:
218 </para>
219
220<screen role="root"><userinput>rm -fv /etc/pam.d/*</userinput></screen>
221
222 <para>
223 Now, as the <systemitem class="username">root</systemitem>
224 user:
225 </para>
226
227<screen role="root"><userinput>make install &amp;&amp;
228chmod -v 4755 /sbin/unix_chkpwd &amp;&amp;
229
230for file in pam pam_misc pamc
231do
232 mv -v /usr/lib/lib${file}.so.* /lib &amp;&amp;
233 ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
234done</userinput></screen>
235
236 </sect2>
237
238 <sect2 role="commands">
239 <title>Command Explanations</title>
240
241 <para>
242 <parameter>--enable-securedir=/lib/security</parameter>:
243 This switch sets install location for the
244 <application>PAM</application> modules.
245 </para>
246
247 <para>
248 <option>--disable-regenerate-docu</option> : If the needed dependencies
249 (<xref linkend="DocBook"/>, <xref linkend="docbook-xsl"/>, <xref
250 linkend="libxslt"/>, and <xref linkend="lynx"/> or <ulink
251 url="&w3m-url;">W3m</ulink>) are installed, the manual pages, and the
252 html and text documentations are (re)generated and installed.
253 Furthermore, if <xref linkend="fop"/> is installed, the PDF
254 documentation is generated and installed. Use this switch if you do not
255 want to rebuild the documentation.
256 </para>
257
258 <para>
259 <command>chmod -v 4755 /sbin/unix_chkpwd</command>:
260 The <command>unix_chkpwd</command> helper program must be setuid
261 so that non-<systemitem class="username">root</systemitem>
262 processes can access the shadow file.
263 </para>
264
265 </sect2>
266
267 <sect2 role="configuration">
268 <title>Configuring Linux-PAM</title>
269
270 <sect3 id="pam-config">
271 <title>Config Files</title>
272
273 <para>
274 <filename>/etc/security/*</filename> and
275 <filename>/etc/pam.d/*</filename>
276 </para>
277
278 <indexterm zone="linux-pam pam-config">
279 <primary sortas="e-etc-security">/etc/security/*</primary>
280 </indexterm>
281
282 <indexterm zone="linux-pam pam-config">
283 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
284 </indexterm>
285
286 </sect3>
287
288 <sect3>
289 <title>Configuration Information</title>
290
291 <para>
292 Configuration information is placed in
293 <filename class="directory">/etc/pam.d/</filename>.
294 Below is an example file:
295 </para>
296
297<screen><literal># Begin /etc/pam.d/other
298
299auth required pam_unix.so nullok
300account required pam_unix.so
301session required pam_unix.so
302password required pam_unix.so nullok
303
304# End /etc/pam.d/other</literal></screen>
305
306 <para>Now set up some generic files. As root:</para>
307
308<screen role="root"><userinput>install -vdm755 /etc/pam.d &amp;&amp;
309cat &gt; /etc/pam.d/system-account &lt;&lt; "EOF" &amp;&amp;
310<literal># Begin /etc/pam.d/system-account
311
312account required pam_unix.so
313
314# End /etc/pam.d/system-account</literal>
315EOF
316
317cat &gt; /etc/pam.d/system-auth &lt;&lt; "EOF" &amp;&amp;
318<literal># Begin /etc/pam.d/system-auth
319
320auth required pam_unix.so
321
322# End /etc/pam.d/system-auth</literal>
323EOF
324
325cat &gt; /etc/pam.d/system-session &lt;&lt; "EOF"
326<literal># Begin /etc/pam.d/system-session
327
328session required pam_unix.so
329
330# End /etc/pam.d/system-session</literal>
331EOF</userinput></screen>
332
333 <para>The remaining generic file depends on whether <xref linkend="cracklib"/>
334 is installed. If it is installed, use:</para>
335
336<screen role="root"><userinput>cat &gt; /etc/pam.d/system-password &lt;&lt; "EOF"
337<literal># Begin /etc/pam.d/system-password
338
339# check new passwords for strength (man pam_cracklib)
340password required pam_cracklib.so authtok_type=UNIX retry=1 difok=5 \
341 minlen=9 dcredit=1 ucredit=1 \
342 lcredit=1 ocredit=1 minclass=0 \
343 maxrepeat=0 maxsequence=0 \
344 maxclassrepeat=0 \
345 dictpath=/lib/cracklib/pw_dict
346# use sha512 hash for encryption, use shadow, and use the
347# authentication token (chosen password) set by pam_cracklib
348# above (or any previous modules)
349password required pam_unix.so sha512 shadow use_authtok
350
351# End /etc/pam.d/system-password</literal>
352EOF</userinput></screen>
353
354 <note>
355 <para>
356 In its default configuration, pam_cracklib will
357 allow multiple case passwords as short as 6 characters, even with
358 the <parameter>minlen</parameter> value set to 11. You should review
359 the pam_cracklib(8) man page and determine if these default values
360 are acceptable for the security of your system.
361 </para>
362 </note>
363
364 <para>If <xref linkend="cracklib"/> is <emphasis>NOT</emphasis> installed,
365 use:</para>
366
367<screen role="nodump"><userinput>cat &gt; /etc/pam.d/system-password &lt;&lt; "EOF"
368<literal># Begin /etc/pam.d/system-password
369
370# use sha512 hash for encryption, use shadow, and try to use any previously
371# defined authentication token (chosen password) set by any prior module
372password required pam_unix.so sha512 shadow try_first_pass
373
374# End /etc/pam.d/system-password</literal>
375EOF</userinput></screen>
376
377 <para>Now add a restrictive <filename>/etc/pam.d/other</filename>
378 configuration file. With this file, programs that are PAM aware will not
379 run unless a configuration file specifically for that application is
380 created.</para>
381
382<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
383<literal># Begin /etc/pam.d/other
384
385auth required pam_warn.so
386auth required pam_deny.so
387account required pam_warn.so
388account required pam_deny.so
389password required pam_warn.so
390password required pam_deny.so
391session required pam_warn.so
392session required pam_deny.so
393
394# End /etc/pam.d/other</literal>
395EOF</userinput></screen>
396
397 <para>
398 The <application>PAM</application> man page (<command>man
399 pam</command>) provides a good starting point for descriptions
400 of fields and allowable entries. The <ulink
401 url="http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_SAG.html">Linux-PAM
402 System Administrators' Guide</ulink> is recommended for additional
403 information.
404 </para>
405<!-- No longer there
406 <para>
407 Refer to <ulink url="&debian-pam-docs;/modules.html"/> for a list
408 of various third-party modules available.
409 </para>
410-->
411 <important>
412 <para>
413 You should now reinstall the <xref linkend="shadow"/>
414 <phrase revision="sysv">package.</phrase>
415 <phrase revision="systemd"> and <xref linkend="systemd"/>
416 packages.</phrase>
417 </para>
418 </important>
419
420 </sect3>
421
422 </sect2>
423
424 <sect2 role="content">
425 <title>Contents</title>
426
427 <segmentedlist>
428 <segtitle>Installed Program</segtitle>
429 <segtitle>Installed Libraries</segtitle>
430 <segtitle>Installed Directories</segtitle>
431
432 <seglistitem>
433 <seg>
434 mkhomedir_helper, pam_tally, pam_tally2,
435 pam_timestamp_check, unix_chkpwd and
436 unix_update
437 </seg>
438 <seg>
439 libpam.so, libpamc.so and libpam_misc.so
440 </seg>
441 <seg>
442 /etc/security,
443 /lib/security,
444 /usr/include/security and
445 /usr/share/doc/Linux-PAM-&linux-pam-version;
446 </seg>
447 </seglistitem>
448 </segmentedlist>
449
450 <variablelist>
451 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
452 <?dbfo list-presentation="list"?>
453 <?dbhtml list-presentation="table"?>
454
455 <varlistentry id="mkhomedir_helper">
456 <term><command>mkhomedir_helper</command></term>
457 <listitem>
458 <para>
459 is a helper binary that creates home directories.
460 </para>
461 <indexterm zone="linux-pam mkhomedir_helper">
462 <primary sortas="b-mkhomedir_helper">mkhomedir_helper</primary>
463 </indexterm>
464 </listitem>
465 </varlistentry>
466
467 <varlistentry id="pam_tally">
468 <term><command>pam_tally</command></term>
469 <listitem>
470 <para>
471 is used to interrogate and manipulate the login counter file.
472 </para>
473 <indexterm zone="linux-pam pam_tally">
474 <primary sortas="b-pam_tally">pam_tally</primary>
475 </indexterm>
476 </listitem>
477 </varlistentry>
478
479 <varlistentry id="pam_tally2">
480 <term><command>pam_tally2</command></term>
481 <listitem>
482 <para>
483 is used to interrogate and manipulate the login counter file, but
484 does not have some limitations that <command>pam_tally</command>
485 does.
486 </para>
487 <indexterm zone="linux-pam pam_tally2">
488 <primary sortas="b-pam_tally2">pam_tally2</primary>
489 </indexterm>
490 </listitem>
491 </varlistentry>
492
493 <varlistentry id="pam_timestamp_check">
494 <term><command>pam_timestamp_check</command></term>
495 <listitem>
496 <para>
497 is used to check if the default timestamp is valid
498 </para>
499 <indexterm zone="linux-pam pam_timestamp_check">
500 <primary sortas="b-pam_timestamp_check">pam_timestamp_check</primary>
501 </indexterm>
502 </listitem>
503 </varlistentry>
504
505 <varlistentry id="unix_chkpwd">
506 <term><command>unix_chkpwd</command></term>
507 <listitem>
508 <para>
509 is a helper binary that verifies the password of the current user.
510 </para>
511 <indexterm zone="linux-pam unix_chkpwd">
512 <primary sortas="b-unix_chkpwd">unix_chkpwd</primary>
513 </indexterm>
514 </listitem>
515 </varlistentry>
516
517 <varlistentry id="unix_update">
518 <term><command>unix_update</command></term>
519 <listitem>
520 <para>
521 is a helper binary that updates the password of a given user.
522 </para>
523 <indexterm zone="linux-pam unix_update">
524 <primary sortas="b-unix_update">unix_update</primary>
525 </indexterm>
526 </listitem>
527 </varlistentry>
528
529 <varlistentry id="libpam">
530 <term><filename class="libraryfile">libpam.so</filename></term>
531 <listitem>
532 <para>
533 provides the interfaces between applications and the
534 PAM modules.
535 </para>
536 <indexterm zone="linux-pam libpam">
537 <primary sortas="c-libpam">libpam.so</primary>
538 </indexterm>
539 </listitem>
540 </varlistentry>
541
542 </variablelist>
543
544 </sect2>
545
546</sect1>
Note: See TracBrowser for help on using the repository browser.