source: postlfs/security/linux-pam.xml@ 8770a48

systemd-13485
Last change on this file since 8770a48 was 8770a48, checked in by Douglas R. Reno <renodr@…>, 9 years ago

Update to doxygen-1.8.10
Update to OpenJDK-1.8.0.51
Update to check-0.10.0
Fix a build error in Valgrind using glibc-2.22
Update to GnuTLS-3.4.4.1
Update to acpid-2.0.25
Update to cURL-7.44.0
Update to libpng-1.6.18
Update to cmake-3.3.1
Update to harfbuzz-1.0.2
Update to libdrm-2.4.64
Update to Mesa-10.6.4 (will wait for 11.x release for next update)
Update to Linux-PAM-1.2.1
Update to xterm-319
Update to gdk-pixbuf-2.31.6
Update to vala-0.28.1
Update to LVM2-2.02.128
Update to openbox-3.6.1
Update to PIN-Entry-0.9.5
Update to GnuPG-2.1.7
Update to gcr-3.16.0
Fix URL for gsettings-desktop-schemas-3.16.1
Add some short descriptions by Denis.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/branches/systemd@16358 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 15.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY linux-pam-download-http "http://linux-pam.org/library/Linux-PAM-&linux-pam-version;.tar.bz2">
8 <!ENTITY linux-pam-download-ftp " ">
9 <!ENTITY linux-pam-md5sum "9dc53067556d2dd567808fd509529dd6">
10 <!ENTITY linux-pam-size "1.2 MB">
11 <!ENTITY linux-pam-buildsize "32 MB">
12 <!ENTITY linux-pam-time "0.4 SBU">
13
14 <!ENTITY linux-pam-docs-download "http://linux-pam.org/documentation/Linux-PAM-&linux-pam-version;-docs.tar.bz2">
15 <!ENTITY linux-pam-docs-md5sum "558378b8be9b8b5c987326f4529f2130">
16 <!ENTITY linux-pam-docs-size "480 KB">
17 <!ENTITY debian-pam-docs "http://debian.securedservers.com/kernel/pub/linux/libs/pam">
18]>
19
20<sect1 id="linux-pam" xreflabel="Linux-PAM-&linux-pam-version;">
21 <?dbhtml filename="linux-pam.html"?>
22
23 <sect1info>
24 <othername>$LastChangedBy$</othername>
25 <date>$Date$</date>
26 </sect1info>
27
28 <title>Linux-PAM-&linux-pam-version;</title>
29
30 <indexterm zone="linux-pam">
31 <primary sortas="a-Linux-PAM">Linux-PAM</primary>
32 </indexterm>
33
34 <sect2 role="package">
35 <title>Introduction to Linux PAM</title>
36
37 <para>
38 The <application>Linux PAM</application> package contains
39 Pluggable Authentication Modules used to enable the local
40 system administrator to choose how applications authenticate
41 users.
42 </para>
43
44 &lfs77_checked;
45
46 <bridgehead renderas="sect3">Package Information</bridgehead>
47 <itemizedlist spacing="compact">
48 <listitem>
49 <para>
50 Download (HTTP): <ulink url="&linux-pam-download-http;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download (FTP): <ulink url="&linux-pam-download-ftp;"/>
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download MD5 sum: &linux-pam-md5sum;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Download size: &linux-pam-size;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated disk space required: &linux-pam-buildsize;
71 </para>
72 </listitem>
73 <listitem>
74 <para>
75 Estimated build time: &linux-pam-time;
76 </para>
77 </listitem>
78 </itemizedlist>
79
80 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
81 <itemizedlist spacing="compact">
82 <title>Optional Documentation</title>
83 <listitem>
84 <para>
85 Download (HTTP): <ulink url="&linux-pam-docs-download;"/>
86 </para>
87 </listitem>
88 <listitem>
89 <para>
90 Download MD5 sum: &linux-pam-docs-md5sum;
91 </para>
92 </listitem>
93 <listitem>
94 <para>
95 Download size &linux-pam-docs-size;
96 </para>
97 </listitem>
98 </itemizedlist>
99
100 <bridgehead renderas="sect3">Linux PAM Dependencies</bridgehead>
101
102 <bridgehead renderas="sect4">Optional</bridgehead>
103 <para role="optional">
104 <xref linkend="db"/>,
105 <xref linkend="cracklib"/>,
106 <xref linkend="libtirpc"/> and
107 <ulink url="http://www.prelude-ids.org/">Prelude</ulink>
108 </para>
109
110 <bridgehead renderas="sect4">Optional (To Rebuild the Documentation)</bridgehead>
111 <para role="optional">
112 <xref linkend="DocBook"/>,
113 <xref linkend="docbook-xsl"/>,
114 <xref linkend="fop"/>,
115 <xref linkend="libxslt"/> and
116 <xref linkend="w3m"/>
117 </para>
118
119 <para condition="html" role="usernotes">User Notes:
120 <ulink url="&blfs-wiki;/linux-pam"/>
121 </para>
122 </sect2>
123
124 <sect2 role="installation">
125 <title>Installation of Linux PAM</title>
126
127 <para>
128 If you downloaded the documentation, unpack the tarball by issuing
129 the following command.
130 </para>
131
132<screen><userinput>tar -xf ../Linux-PAM-&linux-pam-version;-docs.tar.bz2 --strip-components=1</userinput></screen>
133
134 <para>
135 Install <application>Linux PAM</application> by
136 running the following commands:
137 </para>
138
139<screen><userinput>./configure --prefix=/usr \
140 --sysconfdir=/etc \
141 --libdir=/usr/lib \
142 --enable-securedir=/lib/security \
143 --docdir=/usr/share/doc/Linux-PAM-&linux-pam-version; &amp;&amp;
144make</userinput></screen>
145
146 <para>
147 To test the results, a suitable <filename>/etc/pam.d/other</filename>
148 configuration file must exist.
149 </para>
150
151 <caution>
152 <title>Reinstallation or upgrade of Linux PAM</title>
153 <para>
154 If you have a system with Linux PAM installed and working, be careful
155 when modifying the files in
156 <filename class="directory">/etc/pam.d</filename>, since your system
157 may become totally unusable. If you want to run the tests, you do not
158 need to create another <filename>/etc/pam.d/other</filename> file. The
159 installed one can be used for that purpose.
160 </para>
161
162 <para>
163 You should also be aware that <command>make install</command>
164 overwrites the configuration files in
165 <filename class="directory">/etc/security</filename> as well as
166 <filename>/etc/environment</filename>. In case you
167 have modified those files, be sure to back them up.
168 </para>
169 </caution>
170
171 <para>
172 For a first installation, create the configuration file by issuing the
173 following commands as the <systemitem class="username">root</systemitem>
174 user:
175 </para>
176
177<screen role="root"><userinput>install -v -dm755 /etc/pam.d &amp;&amp;
178
179cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
180<literal>auth required pam_deny.so
181account required pam_deny.so
182password required pam_deny.so
183session required pam_deny.so</literal>
184EOF</userinput></screen>
185
186 <para>
187 Now run the tests by issuing <command>make check</command>.
188 Ensure there are no errors produced by the tests before continuing the
189 installation.
190 </para>
191
192 <para>
193 Only in case of a first installation, remove the configuration file
194 created earlier by issuing the following command as the
195 <systemitem class="username">root</systemitem> user:
196 </para>
197
198<screen role="root"><userinput>rm -rfv /etc/pam.d</userinput></screen>
199
200 <para>
201 Now, as the <systemitem class="username">root</systemitem>
202 user:
203 </para>
204
205<screen role="root"><userinput>make install &amp;&amp;
206chmod -v 4755 /sbin/unix_chkpwd &amp;&amp;
207
208for file in pam pam_misc pamc
209do
210 mv -v /usr/lib/lib${file}.so.* /lib &amp;&amp;
211 ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
212done</userinput></screen>
213
214 </sect2>
215
216 <sect2 role="commands">
217 <title>Command Explanations</title>
218
219 <para>
220 <parameter>--enable-securedir=/lib/security</parameter>:
221 This switch sets install location for the
222 <application>PAM</application> modules.
223 </para>
224
225 <para>
226 <command>chmod -v 4755 /sbin/unix_chkpwd</command>:
227 The <command>unix_chkpwd</command> helper program must be setuid
228 so that non-<systemitem class="username">root</systemitem>
229 processes can access the shadow file.
230 </para>
231
232 </sect2>
233
234 <sect2 role="configuration">
235 <title>Configuring Linux-PAM</title>
236
237 <sect3 id="pam-config">
238 <title>Config Files</title>
239
240 <para>
241 <filename>/etc/security/*</filename> and
242 <filename>/etc/pam.d/*</filename>
243 </para>
244
245 <indexterm zone="linux-pam pam-config">
246 <primary sortas="e-etc-security">/etc/security/*</primary>
247 </indexterm>
248
249 <indexterm zone="linux-pam pam-config">
250 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
251 </indexterm>
252
253 </sect3>
254
255 <sect3>
256 <title>Configuration Information</title>
257
258 <para>
259 Configuration information is placed in
260 <filename class="directory">/etc/pam.d/</filename>.
261 Below is an example file:
262 </para>
263
264<screen><literal># Begin /etc/pam.d/other
265
266auth required pam_unix.so nullok
267account required pam_unix.so
268session required pam_unix.so
269password required pam_unix.so nullok
270
271# End /etc/pam.d/other</literal></screen>
272
273 <para>Now set up some generic files. As root:</para>
274
275<screen role="root"><userinput>install -v -dm755 /etc/pam.d
276
277cat &gt; /etc/pam.d/system-account &lt;&lt; "EOF"
278<literal># Begin /etc/pam.d/system-account
279
280account required pam_unix.so
281
282# End /etc/pam.d/system-account</literal>
283EOF
284
285cat &gt; /etc/pam.d/system-auth &lt;&lt; "EOF"
286<literal># Begin /etc/pam.d/system-auth
287
288auth required pam_unix.so
289
290# End /etc/pam.d/system-auth</literal>
291EOF
292
293cat &gt; /etc/pam.d/system-session &lt;&lt; "EOF"
294<literal># Begin /etc/pam.d/system-session
295
296session required pam_unix.so
297
298# End /etc/pam.d/system-session</literal>
299EOF</userinput></screen>
300
301 <para>The remaining generic file depends on whether <xref linkend="cracklib"/>
302 is installed. If it is installed, issue:</para>
303
304<screen role="root"><userinput>cat &gt; /etc/pam.d/system-password &lt;&lt; "EOF"
305<literal># Begin /etc/pam.d/system-password
306
307# check new passwords for strength (man pam_cracklib)
308password required pam_cracklib.so type=Linux retry=3 difok=5 \
309 difignore=23 minlen=9 dcredit=1 \
310 ucredit=1 lcredit=1 ocredit=1 \
311 dictpath=/lib/cracklib/pw_dict
312# use sha512 hash for encryption, use shadow, and use the
313# authentication token (chosen password) set by pam_cracklib
314# above (or any previous modules)
315password required pam_unix.so sha512 shadow use_authtok
316
317# End /etc/pam.d/system-password</literal>
318EOF</userinput></screen>
319
320 <note>
321 <para>
322 In its default configuration, pam_cracklib will
323 allow multiple case passwords as short as 6 characters, even with
324 the <parameter>minlen</parameter> value set to 11. You should review
325 the pam_cracklib(8) man page and determine if these default values
326 are acceptable for the security of your system.
327 </para>
328 </note>
329
330 <para>If <xref linkend="cracklib"/> is <emphasis>NOT</emphasis> installed,
331 issue:</para>
332
333<screen role="root"><userinput>cat &gt; /etc/pam.d/system-password &lt;&lt; "EOF"
334<literal># Begin /etc/pam.d/system-password
335
336# use sha512 hash for encryption, use shadow, and try to use any previously
337# defined authentication token (chosen password) set by any prior module
338password required pam_unix.so sha512 shadow try_first_pass
339
340# End /etc/pam.d/system-password</literal>
341EOF</userinput></screen>
342
343 <para>Now add a restrictive <filename>/etc/pam.d/other</filename>
344 configuration file. With this file, PAM aware services can't be
345 used unless a configuration file specifically for that service is
346 created.</para>
347
348<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
349<literal># Begin /etc/pam.d/other
350
351auth required pam_warn.so
352auth required pam_deny.so
353account required pam_warn.so
354account required pam_deny.so
355password required pam_warn.so
356password required pam_deny.so
357session required pam_warn.so
358session required pam_deny.so
359
360# End /etc/pam.d/other</literal>
361EOF</userinput></screen>
362
363 <para>
364 The <application>PAM</application> man page (<command>man
365 pam</command>) provides a good starting point for descriptions
366 of fields and allowable entries. The <ulink
367 url="http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_SAG.html">Linux-PAM
368 System Administrators' Guide</ulink> is recommended for additional
369 information.
370 </para>
371
372 <para>
373 Refer to <ulink url="&debian-pam-docs;/modules.html"/> for a list
374 of various third-party modules available.
375 </para>
376
377 <important>
378 <para>
379 You should now reinstall the <xref linkend="shadow"/>
380 package.
381 </para>
382 </important>
383
384 </sect3>
385
386 </sect2>
387
388 <sect2 role="content">
389 <title>Contents</title>
390
391 <segmentedlist>
392 <segtitle>Installed Program</segtitle>
393 <segtitle>Installed Libraries</segtitle>
394 <segtitle>Installed Directories</segtitle>
395
396 <seglistitem>
397 <seg>
398 mkhomedir_helper, pam_tally, pam_tally2,
399 pam_timestamp_check, unix_chkpwd and
400 unix_update
401 </seg>
402 <seg>
403 libpam.so, libpamc.so and libpam_misc.so
404 </seg>
405 <seg>
406 /etc/security,
407 /lib/security,
408 /usr/include/security and
409 /usr/share/doc/Linux-PAM-&linux-pam-version;
410 </seg>
411 </seglistitem>
412 </segmentedlist>
413
414 <variablelist>
415 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
416 <?dbfo list-presentation="list"?>
417 <?dbhtml list-presentation="table"?>
418
419 <varlistentry id="mkhomedir_helper">
420 <term><command>mkhomedir_helper</command></term>
421 <listitem>
422 <para>
423 is a helper binary that creates home directories.
424 </para>
425 <indexterm zone="linux-pam mkhomedir_helper">
426 <primary sortas="b-mkhomedir_helper">mkhomedir_helper</primary>
427 </indexterm>
428 </listitem>
429 </varlistentry>
430
431 <varlistentry id="pam_tally">
432 <term><command>pam_tally</command></term>
433 <listitem>
434 <para>
435 is used to interrogate and manipulate the login counter file.
436 </para>
437 <indexterm zone="linux-pam pam_tally">
438 <primary sortas="b-pam_tally">pam_tally</primary>
439 </indexterm>
440 </listitem>
441 </varlistentry>
442
443 <varlistentry id="pam_tally2">
444 <term><command>pam_tally2</command></term>
445 <listitem>
446 <para>
447 is used to interrogate and manipulate the login counter file, but
448 does not have some limitations that <command>pam_tally</command>
449 does.
450 </para>
451 <indexterm zone="linux-pam pam_tally2">
452 <primary sortas="b-pam_tally2">pam_tally2</primary>
453 </indexterm>
454 </listitem>
455 </varlistentry>
456
457 <varlistentry id="pam_timestamp_check">
458 <term><command>pam_timestamp_check</command></term>
459 <listitem>
460 <para>
461 is used to check if the default timestamp is valid
462 </para>
463 <indexterm zone="linux-pam pam_timestamp_check">
464 <primary sortas="b-pam_timestamp_check">pam_timestamp_check</primary>
465 </indexterm>
466 </listitem>
467 </varlistentry>
468
469 <varlistentry id="unix_chkpwd">
470 <term><command>unix_chkpwd</command></term>
471 <listitem>
472 <para>
473 is a helper binary that verifies the password of the current user.
474 </para>
475 <indexterm zone="linux-pam unix_chkpwd">
476 <primary sortas="b-unix_chkpwd">unix_chkpwd</primary>
477 </indexterm>
478 </listitem>
479 </varlistentry>
480
481 <varlistentry id="unix_update">
482 <term><command>unix_update</command></term>
483 <listitem>
484 <para>
485 is a helper binary that updates the password of a given user.
486 </para>
487 <indexterm zone="linux-pam unix_update">
488 <primary sortas="b-unix_update">unix_update</primary>
489 </indexterm>
490 </listitem>
491 </varlistentry>
492
493 <varlistentry id="libpam">
494 <term><filename class="libraryfile">libpam.so</filename></term>
495 <listitem>
496 <para>
497 provides the interfaces between applications and the
498 PAM modules.
499 </para>
500 <indexterm zone="linux-pam libpam">
501 <primary sortas="c-libpam">libpam.so</primary>
502 </indexterm>
503 </listitem>
504 </varlistentry>
505
506 </variablelist>
507
508 </sect2>
509
510</sect1>
Note: See TracBrowser for help on using the repository browser.