source: postlfs/security/linux-pam.xml@ acdc8b01

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since acdc8b01 was 7e11b83c, checked in by Douglas R. Reno <renodr@…>, 4 years ago

Update to Linux-PAM-1.4.0
Update text on the libpwquality page to mention that pam_cracklib is now obsolete, and libpwquality is the intended replacement. See Ticket #13651
Move libpwquality.so.* to /lib

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@23270 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 19.1 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY linux-pam-download-http "https://github.com/linux-pam/linux-pam/releases/download/v&linux-pam-version;/Linux-PAM-&linux-pam-version;.tar.xz">
8 <!ENTITY linux-pam-download-ftp " ">
9 <!ENTITY linux-pam-md5sum "39fca0523bccec6af4b63b5322276c84">
10 <!ENTITY linux-pam-size "968 KB">
11 <!ENTITY linux-pam-buildsize "37 MB (with tests)">
12 <!ENTITY linux-pam-time "0.3 SBU (with tests)">
13
14 <!ENTITY linux-pam-docs-download "https://github.com/linux-pam/linux-pam/releases/download/v&linux-pam-version;/Linux-PAM-&linux-pam-docs-version;-docs.tar.xz">
15 <!ENTITY linux-pam-docs-md5sum "3440e619ff29074eb977a2ca6e34525a">
16 <!ENTITY linux-pam-docs-size "468 KB">
17 <!--
18 <!ENTITY debian-pam-docs "http://debian.securedservers.com/kernel/pub/linux/libs/pam">
19 -->
20]>
21
22<sect1 id="linux-pam" xreflabel="Linux-PAM-&linux-pam-version;">
23 <?dbhtml filename="linux-pam.html"?>
24
25 <sect1info>
26 <othername>$LastChangedBy$</othername>
27 <date>$Date$</date>
28 </sect1info>
29
30 <title>Linux-PAM-&linux-pam-version;</title>
31
32 <indexterm zone="linux-pam">
33 <primary sortas="a-Linux-PAM">Linux-PAM</primary>
34 </indexterm>
35
36 <sect2 role="package">
37 <title>Introduction to Linux PAM</title>
38
39 <para>
40 The <application>Linux PAM</application> package contains
41 Pluggable Authentication Modules used to enable the local
42 system administrator to choose how applications authenticate
43 users.
44 </para>
45
46 &lfs91_checked;
47
48 <bridgehead renderas="sect3">Package Information</bridgehead>
49 <itemizedlist spacing="compact">
50 <listitem>
51 <para>
52 Download (HTTP): <ulink url="&linux-pam-download-http;"/>
53 </para>
54 </listitem>
55 <listitem>
56 <para>
57 Download (FTP): <ulink url="&linux-pam-download-ftp;"/>
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download MD5 sum: &linux-pam-md5sum;
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Download size: &linux-pam-size;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Estimated disk space required: &linux-pam-buildsize;
73 </para>
74 </listitem>
75 <listitem>
76 <para>
77 Estimated build time: &linux-pam-time;
78 </para>
79 </listitem>
80 </itemizedlist>
81
82 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
83 <itemizedlist spacing="compact">
84 <title>Optional Documentation</title>
85 <listitem>
86 <para>
87 Download (HTTP): <ulink url="&linux-pam-docs-download;"/>
88 </para>
89 </listitem>
90 <listitem>
91 <para>
92 Download MD5 sum: &linux-pam-docs-md5sum;
93 </para>
94 </listitem>
95 <listitem>
96 <para>
97 Download size &linux-pam-docs-size;
98 </para>
99 </listitem>
100 </itemizedlist>
101
102 <bridgehead renderas="sect3">Linux PAM Dependencies</bridgehead>
103
104 <bridgehead renderas="sect4">Optional</bridgehead>
105 <para role="optional">
106 <xref linkend="db"/>,
107 <xref linkend="libnsl"/>,
108 <xref linkend="libpwquality"/>,
109 <xref linkend="libtirpc"/>,
110 <ulink url="https://github.com/linux-audit/audit-userspace">libaudit</ulink>, and
111 <ulink url="http://www.prelude-siem.org">Prelude</ulink>
112 </para>
113
114 <bridgehead renderas="sect4">Optional (To Rebuild the Documentation)</bridgehead>
115 <para role="optional">
116 <xref linkend="DocBook"/>,
117 <xref linkend="docbook-xsl"/>,
118 <xref linkend="fop"/>,
119 <xref linkend="libxslt"/> and either
120 <xref linkend="lynx"/> or
121 <ulink url="&w3m-url;">W3m</ulink>
122 </para>
123
124 <note>
125 <para role="required">
126 <xref role="runtime" linkend="shadow"/>
127 <phrase revision="systemd"> and <xref role="runtime" linkend="systemd"/>
128 need</phrase><phrase revision="sysv">needs</phrase> to be reinstalled
129 after installing and configuring <application>Linux PAM</application>.
130 </para>
131 </note>
132
133 <para condition="html" role="usernotes">User Notes:
134 <ulink url="&blfs-wiki;/linux-pam"/>
135 </para>
136 </sect2>
137
138 <sect2 role="installation">
139 <title>Installation of Linux PAM</title>
140
141 <para>
142 If you downloaded the documentation, unpack the tarball by issuing
143 the following command.
144 </para>
145
146<screen><userinput>tar -xf ../Linux-PAM-&linux-pam-docs-version;-docs.tar.xz --strip-components=1</userinput></screen>
147
148 <para>
149 If you instead want to regenerate the documentation, fix the
150 <command>configure</command> script so that it detects lynx if installed:
151 </para>
152
153<screen><userinput>sed -e 's/dummy elinks/dummy lynx/' \
154 -e 's/-no-numbering -no-references/-force-html -nonumbers -stdin/' \
155 -i configure</userinput></screen>
156
157 <para>
158 Install <application>Linux PAM</application> by
159 running the following commands:
160 </para>
161
162<screen><userinput>./configure --prefix=/usr \
163 --sysconfdir=/etc \
164 --libdir=/usr/lib \
165 --enable-securedir=/lib/security \
166 --docdir=/usr/share/doc/Linux-PAM-&linux-pam-version; &amp;&amp;
167make</userinput></screen>
168
169 <para>
170 To test the results, a suitable <filename>/etc/pam.d/other</filename>
171 configuration file must exist.
172 </para>
173
174 <caution>
175 <title>Reinstallation or upgrade of Linux PAM</title>
176 <para>
177 If you have a system with Linux PAM installed and working, be careful
178 when modifying the files in
179 <filename class="directory">/etc/pam.d</filename>, since your system
180 may become totally unusable. If you want to run the tests, you do not
181 need to create another <filename>/etc/pam.d/other</filename> file. The
182 installed one can be used for that purpose.
183 </para>
184
185 <para>
186 You should also be aware that <command>make install</command>
187 overwrites the configuration files in
188 <filename class="directory">/etc/security</filename> as well as
189 <filename>/etc/environment</filename>. In case you
190 have modified those files, be sure to back them up.
191 </para>
192 </caution>
193
194 <para>
195 For a first installation, create the configuration file by issuing the
196 following commands as the <systemitem class="username">root</systemitem>
197 user:
198 </para>
199
200<screen role="root"><userinput>install -v -m755 -d /etc/pam.d &amp;&amp;
201
202cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
203<literal>auth required pam_deny.so
204account required pam_deny.so
205password required pam_deny.so
206session required pam_deny.so</literal>
207EOF</userinput></screen>
208
209 <para>
210 Now run the tests by issuing <command>make check</command>.
211 Ensure there are no errors produced by the tests before continuing the
212 installation. Note that the checks are quite long. It may be useful to
213 redirect the output to a log file in order to inspect it thoroughly.
214 </para>
215
216 <para>
217 Only in case of a first installation, remove the configuration file
218 created earlier by issuing the following command as the
219 <systemitem class="username">root</systemitem> user:
220 </para>
221
222<screen role="root"><userinput>rm -fv /etc/pam.d/other</userinput></screen>
223
224 <para>
225 Now, as the <systemitem class="username">root</systemitem>
226 user:
227 </para>
228
229<screen role="root"><userinput>make install &amp;&amp;
230chmod -v 4755 /sbin/unix_chkpwd &amp;&amp;
231
232for file in pam pam_misc pamc
233do
234 mv -v /usr/lib/lib${file}.so.* /lib &amp;&amp;
235 ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
236done</userinput></screen>
237
238 </sect2>
239
240 <sect2 role="commands">
241 <title>Command Explanations</title>
242
243 <para>
244 <parameter>--enable-securedir=/lib/security</parameter>:
245 This switch sets install location for the
246 <application>PAM</application> modules.
247 </para>
248
249 <para>
250 <option>--disable-regenerate-docu</option> : If the needed dependencies
251 (<xref linkend="DocBook"/>, <xref linkend="docbook-xsl"/>, <xref
252 linkend="libxslt"/>, and <xref linkend="lynx"/> or <ulink
253 url="&w3m-url;">W3m</ulink>) are installed, the manual pages, and the
254 html and text documentations are (re)generated and installed.
255 Furthermore, if <xref linkend="fop"/> is installed, the PDF
256 documentation is generated and installed. Use this switch if you do not
257 want to rebuild the documentation.
258 </para>
259
260 <para>
261 <command>chmod -v 4755 /sbin/unix_chkpwd</command>:
262 The <command>unix_chkpwd</command> helper program must be setuid
263 so that non-<systemitem class="username">root</systemitem>
264 processes can access the shadow file.
265 </para>
266
267 </sect2>
268
269 <sect2 role="configuration">
270 <title>Configuring Linux-PAM</title>
271
272 <sect3 id="pam-config">
273 <title>Config Files</title>
274
275 <para>
276 <filename>/etc/security/*</filename> and
277 <filename>/etc/pam.d/*</filename>
278 </para>
279
280 <indexterm zone="linux-pam pam-config">
281 <primary sortas="e-etc-security">/etc/security/*</primary>
282 </indexterm>
283
284 <indexterm zone="linux-pam pam-config">
285 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
286 </indexterm>
287
288 </sect3>
289
290 <sect3>
291 <title>Configuration Information</title>
292
293 <para>
294 Configuration information is placed in
295 <filename class="directory">/etc/pam.d/</filename>.
296 Below is an example file:
297 </para>
298
299<screen><literal># Begin /etc/pam.d/other
300
301auth required pam_unix.so nullok
302account required pam_unix.so
303session required pam_unix.so
304password required pam_unix.so nullok
305
306# End /etc/pam.d/other</literal></screen>
307
308 <para>
309 Now set up some generic files. As root:
310 </para>
311
312<screen role="root"><userinput>install -vdm755 /etc/pam.d &amp;&amp;
313cat &gt; /etc/pam.d/system-account &lt;&lt; "EOF" &amp;&amp;
314<literal># Begin /etc/pam.d/system-account
315
316account required pam_unix.so
317
318# End /etc/pam.d/system-account</literal>
319EOF
320
321cat &gt; /etc/pam.d/system-auth &lt;&lt; "EOF" &amp;&amp;
322<literal># Begin /etc/pam.d/system-auth
323
324auth required pam_unix.so
325
326# End /etc/pam.d/system-auth</literal>
327EOF
328
329cat &gt; /etc/pam.d/system-session &lt;&lt; "EOF"
330<literal># Begin /etc/pam.d/system-session
331
332session required pam_unix.so
333
334# End /etc/pam.d/system-session</literal>
335EOF
336cat &gt; /etc/pam.d/system-password &lt;&lt; "EOF"
337<literal># Begin /etc/pam.d/system-password
338
339# use sha512 hash for encryption, use shadow, and try to use any previously
340# defined authentication token (chosen password) set by any prior module
341password required pam_unix.so sha512 shadow try_first_pass
342
343# End /etc/pam.d/system-password</literal>
344EOF
345</userinput></screen>
346
347 <para>
348 If you wish to enable strong password support, install
349 <xref linkend="libpwquality"/>, and follow the
350 instructions in that page to configure the pam_pwquality
351 PAM module with strong password support.
352 </para>
353
354<!-- With the removal of the pam_cracklib module, we're supposed to be using
355 libpwquality. That already includes instructions in it's configuration
356 information page, so we'll use those instead.
357
358 Linux-PAM must be installed prior to libpwquality so that PAM support
359 is built in, and the PAM module is built.
360-->
361<!--
362 <para>
363 The remaining generic file depends on whether <xref
364 linkend="cracklib"/> is installed. If it is installed, use:
365 </para>
366
367<screen role="root"><userinput>cat &gt; /etc/pam.d/system-password &lt;&lt; "EOF"
368<literal># Begin /etc/pam.d/system-password
369
370# check new passwords for strength (man pam_cracklib)
371password required pam_cracklib.so authtok_type=UNIX retry=1 difok=5 \
372 minlen=9 dcredit=1 ucredit=1 \
373 lcredit=1 ocredit=1 minclass=0 \
374 maxrepeat=0 maxsequence=0 \
375 maxclassrepeat=0 \
376 dictpath=/lib/cracklib/pw_dict
377# use sha512 hash for encryption, use shadow, and use the
378# authentication token (chosen password) set by pam_cracklib
379# above (or any previous modules)
380password required pam_unix.so sha512 shadow use_authtok
381
382# End /etc/pam.d/system-password</literal>
383EOF</userinput></screen>
384
385 <note>
386 <para>
387 In its default configuration, pam_cracklib will
388 allow multiple case passwords as short as 6 characters, even with
389 the <parameter>minlen</parameter> value set to 11. You should review
390 the pam_cracklib(8) man page and determine if these default values
391 are acceptable for the security of your system.
392 </para>
393 </note>
394
395 <para>
396 If <xref linkend="cracklib"/> is <emphasis>NOT</emphasis> installed,
397 use:
398 </para>
399
400<screen role="nodump"><userinput>cat &gt; /etc/pam.d/system-password &lt;&lt; "EOF"
401<literal># Begin /etc/pam.d/system-password
402
403# use sha512 hash for encryption, use shadow, and try to use any previously
404# defined authentication token (chosen password) set by any prior module
405password required pam_unix.so sha512 shadow try_first_pass
406
407# End /etc/pam.d/system-password</literal>
408EOF</userinput></screen>
409-->
410 <para>
411 Now add a restrictive <filename>/etc/pam.d/other</filename>
412 configuration file. With this file, programs that are PAM aware will
413 not run unless a configuration file specifically for that application
414 is created.
415 </para>
416
417<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
418<literal># Begin /etc/pam.d/other
419
420auth required pam_warn.so
421auth required pam_deny.so
422account required pam_warn.so
423account required pam_deny.so
424password required pam_warn.so
425password required pam_deny.so
426session required pam_warn.so
427session required pam_deny.so
428
429# End /etc/pam.d/other</literal>
430EOF</userinput></screen>
431
432 <para>
433 The <application>PAM</application> man page (<command>man
434 pam</command>) provides a good starting point for descriptions
435 of fields and allowable entries. The
436 <ulink url="http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_SAG.html">
437 Linux-PAM System Administrators' Guide
438 </ulink> is recommended for additional information.
439 </para>
440
441 <important>
442 <para>
443 You should now reinstall the <xref linkend="shadow"/>
444 <phrase revision="sysv">package.</phrase>
445 <phrase revision="systemd"> and <xref linkend="systemd"/>
446 packages.</phrase>
447 </para>
448 </important>
449
450 </sect3>
451
452 </sect2>
453
454 <sect2 role="content">
455 <title>Contents</title>
456
457 <segmentedlist>
458 <segtitle>Installed Program</segtitle>
459 <segtitle>Installed Libraries</segtitle>
460 <segtitle>Installed Directories</segtitle>
461
462 <seglistitem>
463 <seg>
464 faillock, mkhomedir_helper,
465 pam_timestamp_check, unix_chkpwd and
466 unix_update
467 </seg>
468 <seg>
469 libpam.so, libpamc.so and libpam_misc.so
470 </seg>
471 <seg>
472 /etc/security,
473 /lib/security,
474 /usr/include/security and
475 /usr/share/doc/Linux-PAM-&linux-pam-version;
476 </seg>
477 </seglistitem>
478 </segmentedlist>
479
480 <variablelist>
481 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
482 <?dbfo list-presentation="list"?>
483 <?dbhtml list-presentation="table"?>
484
485 <varlistentry id="faillock">
486 <term><command>faillock</command></term>
487 <listitem>
488 <para>
489 displays and modifies the authentication failure record files.
490 </para>
491 <indexterm zone="linux-pam faillock">
492 <primary sortas="b-faillock">faillock</primary>
493 </indexterm>
494 </listitem>
495 </varlistentry>
496
497 <varlistentry id="mkhomedir_helper">
498 <term><command>mkhomedir_helper</command></term>
499 <listitem>
500 <para>
501 is a helper binary that creates home directories.
502 </para>
503 <indexterm zone="linux-pam mkhomedir_helper">
504 <primary sortas="b-mkhomedir_helper">mkhomedir_helper</primary>
505 </indexterm>
506 </listitem>
507 </varlistentry>
508
509<!-- Removed with the removal of the pam_tally{,2} module
510 <varlistentry id="pam_tally">
511 <term><command>pam_tally</command></term>
512 <listitem>
513 <para>
514 is used to interrogate and manipulate the login counter file.
515 </para>
516 <indexterm zone="linux-pam pam_tally">
517 <primary sortas="b-pam_tally">pam_tally</primary>
518 </indexterm>
519 </listitem>
520 </varlistentry>
521
522 <varlistentry id="pam_tally2">
523 <term><command>pam_tally2</command></term>
524 <listitem>
525 <para>
526 is used to interrogate and manipulate the login counter file, but
527 does not have some limitations that <command>pam_tally</command>
528 does.
529 </para>
530 <indexterm zone="linux-pam pam_tally2">
531 <primary sortas="b-pam_tally2">pam_tally2</primary>
532 </indexterm>
533 </listitem>
534 </varlistentry>
535-->
536
537 <varlistentry id="pam_timestamp_check">
538 <term><command>pam_timestamp_check</command></term>
539 <listitem>
540 <para>
541 is used to check if the default timestamp is valid
542 </para>
543 <indexterm zone="linux-pam pam_timestamp_check">
544 <primary sortas="b-pam_timestamp_check">pam_timestamp_check</primary>
545 </indexterm>
546 </listitem>
547 </varlistentry>
548
549 <varlistentry id="unix_chkpwd">
550 <term><command>unix_chkpwd</command></term>
551 <listitem>
552 <para>
553 is a helper binary that verifies the password of the current user.
554 </para>
555 <indexterm zone="linux-pam unix_chkpwd">
556 <primary sortas="b-unix_chkpwd">unix_chkpwd</primary>
557 </indexterm>
558 </listitem>
559 </varlistentry>
560
561 <varlistentry id="unix_update">
562 <term><command>unix_update</command></term>
563 <listitem>
564 <para>
565 is a helper binary that updates the password of a given user.
566 </para>
567 <indexterm zone="linux-pam unix_update">
568 <primary sortas="b-unix_update">unix_update</primary>
569 </indexterm>
570 </listitem>
571 </varlistentry>
572
573 <varlistentry id="libpam">
574 <term><filename class="libraryfile">libpam.so</filename></term>
575 <listitem>
576 <para>
577 provides the interfaces between applications and the
578 PAM modules.
579 </para>
580 <indexterm zone="linux-pam libpam">
581 <primary sortas="c-libpam">libpam.so</primary>
582 </indexterm>
583 </listitem>
584 </varlistentry>
585
586 </variablelist>
587
588 </sect2>
589
590</sect1>
Note: See TracBrowser for help on using the repository browser.