source: postlfs/security/linux-pam.xml@ 78295629

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 78295629 was 23fc1d1, checked in by Douglas R. Reno <renodr@…>, 7 years ago

More tags!

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@18319 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 16.7 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY linux-pam-download-http "http://linux-pam.org/library/Linux-PAM-&linux-pam-version;.tar.bz2">
8 <!ENTITY linux-pam-download-ftp " ">
9 <!ENTITY linux-pam-md5sum "da4b2289b7cfb19583d54e9eaaef1c3a">
10 <!ENTITY linux-pam-size "1.3 MB">
11 <!ENTITY linux-pam-buildsize "28 MB (with tests)">
12 <!ENTITY linux-pam-time "0.5 SBU (with tests)">
13
14 <!ENTITY linux-pam-docs-download "http://linux-pam.org/documentation/Linux-PAM-&linux-pam-docs-version;-docs.tar.bz2">
15 <!ENTITY linux-pam-docs-md5sum "558378b8be9b8b5c987326f4529f2130">
16 <!ENTITY linux-pam-docs-size "480 KB">
17 <!ENTITY debian-pam-docs "http://debian.securedservers.com/kernel/pub/linux/libs/pam">
18]>
19
20<sect1 id="linux-pam" xreflabel="Linux-PAM-&linux-pam-version;">
21 <?dbhtml filename="linux-pam.html"?>
22
23 <sect1info>
24 <othername>$LastChangedBy$</othername>
25 <date>$Date$</date>
26 </sect1info>
27
28 <title>Linux-PAM-&linux-pam-version;</title>
29
30 <indexterm zone="linux-pam">
31 <primary sortas="a-Linux-PAM">Linux-PAM</primary>
32 </indexterm>
33
34 <sect2 role="package">
35 <title>Introduction to Linux PAM</title>
36
37 <para>
38 The <application>Linux PAM</application> package contains
39 Pluggable Authentication Modules used to enable the local
40 system administrator to choose how applications authenticate
41 users.
42 </para>
43
44 &lfs80_checked;
45
46 <bridgehead renderas="sect3">Package Information</bridgehead>
47 <itemizedlist spacing="compact">
48 <listitem>
49 <para>
50 Download (HTTP): <ulink url="&linux-pam-download-http;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download (FTP): <ulink url="&linux-pam-download-ftp;"/>
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download MD5 sum: &linux-pam-md5sum;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Download size: &linux-pam-size;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated disk space required: &linux-pam-buildsize;
71 </para>
72 </listitem>
73 <listitem>
74 <para>
75 Estimated build time: &linux-pam-time;
76 </para>
77 </listitem>
78 </itemizedlist>
79
80 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
81 <itemizedlist spacing="compact">
82 <title>Optional Documentation</title>
83 <listitem>
84 <para>
85 Download (HTTP): <ulink url="&linux-pam-docs-download;"/>
86 </para>
87 </listitem>
88 <listitem>
89 <para>
90 Download MD5 sum: &linux-pam-docs-md5sum;
91 </para>
92 </listitem>
93 <listitem>
94 <para>
95 Download size &linux-pam-docs-size;
96 </para>
97 </listitem>
98 </itemizedlist>
99
100 <bridgehead renderas="sect3">Linux PAM Dependencies</bridgehead>
101
102 <bridgehead renderas="sect4">Optional</bridgehead>
103 <para role="optional">
104 <xref linkend="db"/>,
105 <xref linkend="cracklib"/>,
106 <xref linkend="libtirpc"/> and
107 <ulink url="http://www.prelude-ids.org/">Prelude</ulink>
108 </para>
109
110 <bridgehead renderas="sect4">Optional (To Rebuild the Documentation)</bridgehead>
111 <para role="optional">
112 <xref linkend="DocBook"/>,
113 <xref linkend="docbook-xsl"/>,
114 <xref linkend="fop"/>,
115 <xref linkend="libxslt"/> and either
116 <xref linkend="w3m"/> or
117 <ulink url="http://elinks.or.cz/">elinks</ulink> (but with a link calling it
118 '<application>links</application>') and remove the docu switch.
119 </para>
120
121 <para condition="html" role="usernotes">User Notes:
122 <ulink url="&blfs-wiki;/linux-pam"/>
123 </para>
124 </sect2>
125
126 <sect2 role="installation">
127 <title>Installation of Linux PAM</title>
128
129 <para>
130 If you downloaded the documentation, unpack the tarball by issuing
131 the following command.
132 </para>
133
134<screen><userinput>tar -xf ../Linux-PAM-&linux-pam-docs-version;-docs.tar.bz2 --strip-components=1</userinput></screen>
135
136 <para>
137 Install <application>Linux PAM</application> by
138 running the following commands:
139 </para>
140
141<screen><userinput>./configure --prefix=/usr \
142 --sysconfdir=/etc \
143 --libdir=/usr/lib \
144 --disable-regenerate-docu \
145 --enable-securedir=/lib/security \
146 --docdir=/usr/share/doc/Linux-PAM-&linux-pam-version; &amp;&amp;
147make</userinput></screen>
148
149 <para>
150 To test the results, a suitable <filename>/etc/pam.d/other</filename>
151 configuration file must exist.
152 </para>
153
154 <caution>
155 <title>Reinstallation or upgrade of Linux PAM</title>
156 <para>
157 If you have a system with Linux PAM installed and working, be careful
158 when modifying the files in
159 <filename class="directory">/etc/pam.d</filename>, since your system
160 may become totally unusable. If you want to run the tests, you do not
161 need to create another <filename>/etc/pam.d/other</filename> file. The
162 installed one can be used for that purpose.
163 </para>
164
165 <para>
166 You should also be aware that <command>make install</command>
167 overwrites the configuration files in
168 <filename class="directory">/etc/security</filename> as well as
169 <filename>/etc/environment</filename>. In case you
170 have modified those files, be sure to back them up.
171 </para>
172 </caution>
173
174 <para>
175 For a first installation, create the configuration file by issuing the
176 following commands as the <systemitem class="username">root</systemitem>
177 user:
178 </para>
179
180<screen role="root"><userinput>install -v -m755 -d /etc/pam.d &amp;&amp;
181
182cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
183auth required pam_deny.so
184account required pam_deny.so
185password required pam_deny.so
186session required pam_deny.so
187EOF</userinput></screen>
188
189 <para>
190 Now run the tests by issuing <command>make check</command>.
191 Ensure there are no errors produced by the tests before continuing the
192 installation. Note that the checks are quite long. It may be useful to
193 redirect the output to a log file in order to inspect it thoroughly.
194 </para>
195
196 <para>
197 Only in case of a first installation, remove the configuration file
198 created earlier by issuing the following command as the
199 <systemitem class="username">root</systemitem> user:
200 </para>
201
202<screen role="root"><userinput>rm -fv /etc/pam.d/*</userinput></screen>
203
204 <para>
205 Now, as the <systemitem class="username">root</systemitem>
206 user:
207 </para>
208
209<screen role="root"><userinput>make install &amp;&amp;
210chmod -v 4755 /sbin/unix_chkpwd &amp;&amp;
211
212for file in pam pam_misc pamc
213do
214 mv -v /usr/lib/lib${file}.so.* /lib &amp;&amp;
215 ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
216done</userinput></screen>
217
218 </sect2>
219
220 <sect2 role="commands">
221 <title>Command Explanations</title>
222
223 <para>
224 <parameter>--enable-securedir=/lib/security</parameter>:
225 This switch sets install location for the
226 <application>PAM</application> modules.
227 </para>
228
229 <para>
230 <parameter>--disable-regenerate-docu</parameter> : This switch prevents
231 this version of the package trying to build its documentation, and failing,
232 if the required dependencies <emphasis>except</emphasis>
233 <xref linkend="w3m"/> are present, but <xref linkend="Links"/> is present.
234 Remove this switch if you have installed w3m (or elinks, with a link so it
235 can be invoked as 'links').
236 </para>
237
238 <para>
239 <command>chmod -v 4755 /sbin/unix_chkpwd</command>:
240 The <command>unix_chkpwd</command> helper program must be setuid
241 so that non-<systemitem class="username">root</systemitem>
242 processes can access the shadow file.
243 </para>
244
245 </sect2>
246
247 <sect2 role="configuration">
248 <title>Configuring Linux-PAM</title>
249
250 <sect3 id="pam-config">
251 <title>Config Files</title>
252
253 <para>
254 <filename>/etc/security/*</filename> and
255 <filename>/etc/pam.d/*</filename>
256 </para>
257
258 <indexterm zone="linux-pam pam-config">
259 <primary sortas="e-etc-security">/etc/security/*</primary>
260 </indexterm>
261
262 <indexterm zone="linux-pam pam-config">
263 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
264 </indexterm>
265
266 </sect3>
267
268 <sect3>
269 <title>Configuration Information</title>
270
271 <para>
272 Configuration information is placed in
273 <filename class="directory">/etc/pam.d/</filename>.
274 Below is an example file:
275 </para>
276
277<screen><literal># Begin /etc/pam.d/other
278
279auth required pam_unix.so nullok
280account required pam_unix.so
281session required pam_unix.so
282password required pam_unix.so nullok
283
284# End /etc/pam.d/other</literal></screen>
285
286 <para>Now set up some generic files. As root:</para>
287
288<screen role="root"><userinput>cat &gt; /etc/pam.d/system-account &lt;&lt; "EOF"
289<literal># Begin /etc/pam.d/system-account
290
291account required pam_unix.so
292
293# End /etc/pam.d/system-account</literal>
294EOF
295
296cat &gt; /etc/pam.d/system-auth &lt;&lt; "EOF"
297<literal># Begin /etc/pam.d/system-auth
298
299auth required pam_unix.so
300
301# End /etc/pam.d/system-auth</literal>
302EOF
303
304cat &gt; /etc/pam.d/system-session &lt;&lt; "EOF"
305<literal># Begin /etc/pam.d/system-session
306
307session required pam_unix.so
308
309# End /etc/pam.d/system-session</literal>
310EOF</userinput></screen>
311
312 <para>The remaining generic file depends on whether <xref linkend="cracklib"/>
313 is installed. If it is installed, use:</para>
314
315<screen role="root"><userinput>cat &gt; /etc/pam.d/system-password &lt;&lt; "EOF"
316<literal># Begin /etc/pam.d/system-password
317
318# check new passwords for strength (man pam_cracklib)
319password required pam_cracklib.so type=Linux retry=3 difok=5 \
320 difignore=23 minlen=9 dcredit=1 \
321 ucredit=1 lcredit=1 ocredit=1 \
322 dictpath=/lib/cracklib/pw_dict
323# use sha512 hash for encryption, use shadow, and use the
324# authentication token (chosen password) set by pam_cracklib
325# above (or any previous modules)
326password required pam_unix.so sha512 shadow use_authtok
327
328# End /etc/pam.d/system-password</literal>
329EOF</userinput></screen>
330
331 <note>
332 <para>
333 In its default configuration, pam_cracklib will
334 allow multiple case passwords as short as 6 characters, even with
335 the <parameter>minlen</parameter> value set to 11. You should review
336 the pam_cracklib(8) man page and determine if these default values
337 are acceptable for the security of your system.
338 </para>
339 </note>
340
341 <para>If <xref linkend="cracklib"/> is <emphasis>NOT</emphasis> installed,
342 use:</para>
343
344<screen role="root"><userinput>cat &gt; /etc/pam.d/system-password &lt;&lt; "EOF"
345<literal># Begin /etc/pam.d/system-password
346
347# use sha512 hash for encryption, use shadow, and try to use any previously
348# defined authentication token (chosen password) set by any prior module
349password required pam_unix.so sha512 shadow try_first_pass
350
351# End /etc/pam.d/system-password</literal>
352EOF</userinput></screen>
353
354 <para>Now add a restrictive <filename>/etc/pam.d/other</filename>
355 configuration file. With this file, programs that are PAM aware will not
356 run unless a configuration file specifically for that application is
357 created.</para>
358
359<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
360<literal># Begin /etc/pam.d/other
361
362auth required pam_warn.so
363auth required pam_deny.so
364account required pam_warn.so
365account required pam_deny.so
366password required pam_warn.so
367password required pam_deny.so
368session required pam_warn.so
369session required pam_deny.so
370
371# End /etc/pam.d/other</literal>
372EOF</userinput></screen>
373
374 <para>
375 The <application>PAM</application> man page (<command>man
376 pam</command>) provides a good starting point for descriptions
377 of fields and allowable entries. The <ulink
378 url="http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_SAG.html">Linux-PAM
379 System Administrators' Guide</ulink> is recommended for additional
380 information.
381 </para>
382
383 <para>
384 Refer to <ulink url="&debian-pam-docs;/modules.html"/> for a list
385 of various third-party modules available.
386 </para>
387
388 <important>
389 <para>
390 You should now reinstall the <xref linkend="shadow"/>
391 <phrase revision="sysv">package.</phrase>
392 <phrase revision="systemd"> and <xref linkend="systemd"/>
393 packages.</phrase>
394 </para>
395 </important>
396
397 </sect3>
398
399 </sect2>
400
401 <sect2 role="content">
402 <title>Contents</title>
403
404 <segmentedlist>
405 <segtitle>Installed Program</segtitle>
406 <segtitle>Installed Libraries</segtitle>
407 <segtitle>Installed Directories</segtitle>
408
409 <seglistitem>
410 <seg>
411 mkhomedir_helper, pam_tally, pam_tally2,
412 pam_timestamp_check, unix_chkpwd and
413 unix_update
414 </seg>
415 <seg>
416 libpam.so, libpamc.so and libpam_misc.so
417 </seg>
418 <seg>
419 /etc/security,
420 /lib/security,
421 /usr/include/security and
422 /usr/share/doc/Linux-PAM-&linux-pam-version;
423 </seg>
424 </seglistitem>
425 </segmentedlist>
426
427 <variablelist>
428 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
429 <?dbfo list-presentation="list"?>
430 <?dbhtml list-presentation="table"?>
431
432 <varlistentry id="mkhomedir_helper">
433 <term><command>mkhomedir_helper</command></term>
434 <listitem>
435 <para>
436 is a helper binary that creates home directories.
437 </para>
438 <indexterm zone="linux-pam mkhomedir_helper">
439 <primary sortas="b-mkhomedir_helper">mkhomedir_helper</primary>
440 </indexterm>
441 </listitem>
442 </varlistentry>
443
444 <varlistentry id="pam_tally">
445 <term><command>pam_tally</command></term>
446 <listitem>
447 <para>
448 is used to interrogate and manipulate the login counter file.
449 </para>
450 <indexterm zone="linux-pam pam_tally">
451 <primary sortas="b-pam_tally">pam_tally</primary>
452 </indexterm>
453 </listitem>
454 </varlistentry>
455
456 <varlistentry id="pam_tally2">
457 <term><command>pam_tally2</command></term>
458 <listitem>
459 <para>
460 is used to interrogate and manipulate the login counter file, but
461 does not have some limitations that <command>pam_tally</command>
462 does.
463 </para>
464 <indexterm zone="linux-pam pam_tally2">
465 <primary sortas="b-pam_tally2">pam_tally2</primary>
466 </indexterm>
467 </listitem>
468 </varlistentry>
469
470 <varlistentry id="pam_timestamp_check">
471 <term><command>pam_timestamp_check</command></term>
472 <listitem>
473 <para>
474 is used to check if the default timestamp is valid
475 </para>
476 <indexterm zone="linux-pam pam_timestamp_check">
477 <primary sortas="b-pam_timestamp_check">pam_timestamp_check</primary>
478 </indexterm>
479 </listitem>
480 </varlistentry>
481
482 <varlistentry id="unix_chkpwd">
483 <term><command>unix_chkpwd</command></term>
484 <listitem>
485 <para>
486 is a helper binary that verifies the password of the current user.
487 </para>
488 <indexterm zone="linux-pam unix_chkpwd">
489 <primary sortas="b-unix_chkpwd">unix_chkpwd</primary>
490 </indexterm>
491 </listitem>
492 </varlistentry>
493
494 <varlistentry id="unix_update">
495 <term><command>unix_update</command></term>
496 <listitem>
497 <para>
498 is a helper binary that updates the password of a given user.
499 </para>
500 <indexterm zone="linux-pam unix_update">
501 <primary sortas="b-unix_update">unix_update</primary>
502 </indexterm>
503 </listitem>
504 </varlistentry>
505
506 <varlistentry id="libpam">
507 <term><filename class="libraryfile">libpam.so</filename></term>
508 <listitem>
509 <para>
510 provides the interfaces between applications and the
511 PAM modules.
512 </para>
513 <indexterm zone="linux-pam libpam">
514 <primary sortas="c-libpam">libpam.so</primary>
515 </indexterm>
516 </listitem>
517 </varlistentry>
518
519 </variablelist>
520
521 </sect2>
522
523</sect1>
Note: See TracBrowser for help on using the repository browser.