source: postlfs/security/shadow.xml@ 29f80ebc

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 29f80ebc was 29f80ebc, checked in by Randy McMurchy <randy@…>, 17 years ago

Removed extraneous spaces

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@6490 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 22.3 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY shadow-download-http "http://ftp.pld.org.pl/software/shadow/old/shadow-&shadow-version;.tar.bz2">
8 <!ENTITY shadow-download-ftp "ftp://ftp.pld.org.pl/software/shadow/old/shadow-&shadow-version;.tar.bz2">
9 <!ENTITY shadow-md5sum "a0452fa989f8ba45023cc5a08136568e">
10 <!ENTITY shadow-size "1.2 MB">
11 <!ENTITY shadow-buildsize "15.5 MB">
12 <!ENTITY shadow-time "0.3 SBU">
13]>
14
15<sect1 id="shadow" xreflabel="Shadow-&shadow-version;">
16 <?dbhtml filename="shadow.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Shadow-&shadow-version;</title>
24
25 <indexterm zone="shadow">
26 <primary sortas="a-Shadow">Shadow</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Shadow</title>
31
32 <para><application>Shadow</application> was indeed installed in LFS and
33 there is no reason to reinstall it unless you installed
34 <application>CrackLib</application> or
35 <application>Linux-PAM</application> after your LFS system was completed.
36 If you have installed <application>CrackLib</application> after LFS, then
37 reinstalling <application>Shadow</application> will enable strong password
38 support. If you have installed <application>Linux-PAM</application>,
39 reinstalling <application>Shadow</application> will allow programs such as
40 <command>login</command> and <command>su</command> to utilize PAM.</para>
41
42 <bridgehead renderas="sect3">Package Information</bridgehead>
43 <itemizedlist spacing="compact">
44 <listitem>
45 <para>Download (HTTP): <ulink url="&shadow-download-http;"/></para>
46 </listitem>
47 <listitem>
48 <para>Download (FTP): <ulink url="&shadow-download-ftp;"/></para>
49 </listitem>
50 <listitem>
51 <para>Download MD5 sum: &shadow-md5sum;</para>
52 </listitem>
53 <listitem>
54 <para>Download size: &shadow-size;</para>
55 </listitem>
56 <listitem>
57 <para>Estimated disk space required: &shadow-buildsize;</para>
58 </listitem>
59 <listitem>
60 <para>Estimated build time: &shadow-time;</para>
61 </listitem>
62 </itemizedlist>
63
64 <!--
65 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
66 <itemizedlist spacing='compact'>
67 <listitem>
68 <para>Required patch: <ulink
69 url="&patch-root;/shadow-&shadow-version;-configure_fix-1.patch"/></para>
70 </listitem>
71 </itemizedlist>
72 -->
73
74 <bridgehead renderas="sect3">Shadow Dependencies</bridgehead>
75
76 <bridgehead renderas="sect4">Required</bridgehead>
77 <para role="required"><xref linkend="linux-pam"/> and/or
78 <xref linkend="cracklib"/></para>
79
80 <para condition="html" role="usernotes">User Notes:
81 <ulink url="&blfs-wiki;/shadow"/></para>
82
83 </sect2>
84
85 <sect2 role="installation">
86 <title>Installation of Shadow</title>
87
88 <important>
89 <para>The installation shown below is for a situation where
90 <application>Linux-PAM</application> has been installed (with or
91 without a <application>CrackLib</application> installation) and
92 <application>Shadow</application> is being reinstalled to support the
93 <application>Linux-PAM</application> installation. If you are
94 reinstalling <application>Shadow</application> to provide strong
95 password support via the <application>CrackLib</application> library
96 and you have not installed <application>Linux-PAM</application>, ensure
97 you add the <parameter>--with-libcrack</parameter> parameter to the
98 <command>configure</command> script below.</para>
99 </important>
100
101 <para>Reinstall <application>Shadow</application> by running the following
102 commands:</para>
103
104<screen><userinput>./configure --libdir=/lib \
105 --enable-shared \
106 --without-selinux &amp;&amp;
107sed -i 's/groups$(EXEEXT) //' src/Makefile &amp;&amp;
108find man -name Makefile -exec sed -i '/groups/d' {} \; &amp;&amp;
109sed -i -e 's/ ko//' \
110 -e 's/ zh_CN zh_TW//' \
111 man/Makefile &amp;&amp;
112
113for i in de es fi fr id it pt_BR; do
114 convert-mans UTF-8 ISO-8859-1 man/${i}/*.?
115done &amp;&amp;
116
117for i in cs hu pl; do
118 convert-mans UTF-8 ISO-8859-2 man/${i}/*.?
119done &amp;&amp;
120
121convert-mans UTF-8 EUC-JP man/ja/*.? &amp;&amp;
122convert-mans UTF-8 KOI8-R man/ru/*.? &amp;&amp;
123convert-mans UTF-8 ISO-8859-9 man/tr/*.? &amp;&amp;
124
125make</userinput></screen>
126
127 <para>This package does not come with a test suite.</para>
128
129 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
130
131<screen role="root"><userinput>make install &amp;&amp;
132mv -v /usr/bin/passwd /bin &amp;&amp;
133mv -v /lib/libshadow.*a /usr/lib &amp;&amp;
134rm -v /lib/libshadow.so &amp;&amp;
135ln -v -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
136
137 </sect2>
138
139 <sect2 role="commands">
140 <title>Command Explanations</title>
141
142 <!-- Removed the -with-libpam and -without-libcrack options from the
143 default as these are the defaults. Pam will automatically be picked
144 up if it is installed, and CrackLib won't be used unless specifically
145 requested via -with-libcrack
146 <para><parameter>-without-libcrack</parameter>: This switch tells
147 <application>Shadow</application> not to use
148 <filename class='libraryfile'>libcrack</filename>. This is desired as
149 <application>Linux-PAM</application> will provide
150 <filename class='libraryfile'>libcrack</filename> functionality.</para>
151 -->
152
153 <para><parameter>--without-selinux</parameter>: Support for selinux is
154 enabled by default, but selinux is not built in a base LFS system. The
155 <command>configure</command> script will fail if this option is not
156 used.</para>
157
158 <para><command>sed -i 's/groups$(EXEEXT) //' src/Makefile</command>: This
159 command is used to suppress the installation of the
160 <command>groups</command> program as the version from the
161 <application>Coreutils</application> package installed during LFS is
162 preferred.</para>
163
164 <para><command>find man -name Makefile -exec ... {} \;</command>: This
165 command is used to suppress the installation of the
166 <command>groups</command> man pages so the existing ones installed from
167 the <application>Coreutils</application> package are not replaced.</para>
168
169 <para><command>sed -i -e '...' -e '...' man/Makefile</command>: This
170 command disables the installation of Chinese and Korean manual pages, since
171 <application>Man-DB</application> cannot format them properly.</para>
172
173 <para><command>convert-mans ...</command>: These commands are used to
174 convert some of the man pages so that <application>Man-DB</application>
175 will display them in the expected encodings.</para>
176
177 <para><command>mv -v /usr/bin/passwd /bin</command>: The
178 <command>passwd</command> program may be needed during times when the
179 <filename class='directory'>/usr</filename> filesystem is not mounted so
180 it is moved into the root partition.</para>
181
182 <para><command>mv -v ...; rm -v ...; ln -v ...</command>: These commands
183 are used to move the <filename class='libraryfile'>libshadow</filename>
184 library to the root partition to support the moving of the
185 <command>passwd</command> program earlier.</para>
186
187 </sect2>
188
189 <sect2 role="configuration">
190 <title>Configuring Linux-PAM to Work with Shadow</title>
191
192 <note>
193 <para>The rest of this page is devoted to configuring
194 <application>Shadow</application> to work properly with
195 <application>Linux-PAM</application>. If you do not have
196 <application>Linux-PAM</application> installed, and you reinstalled
197 <application>Shadow</application> to support strong passwords via
198 the <application>CrackLib</application> library, no further configuration
199 is required.</para>
200 </note>
201
202 <sect3 id="pam.d">
203 <title>Config Files</title>
204
205 <para><filename>/etc/pam.d/*</filename> or alternatively
206 <filename>/etc/pam.conf, /etc/login.defs and
207 /etc/security/*</filename></para>
208
209 <indexterm zone="shadow pam.d">
210 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
211 </indexterm>
212
213 <indexterm zone="shadow pam.d">
214 <primary sortas="e-etc-pam.conf">/etc/pam.conf</primary>
215 </indexterm>
216
217 <indexterm zone="shadow pam.d">
218 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
219 </indexterm>
220
221 <indexterm zone="shadow pam.d">
222 <primary sortas="e-etc-security">/etc/security/*</primary>
223 </indexterm>
224
225 </sect3>
226
227 <sect3>
228 <title>Configuration Information</title>
229
230 <para>Configuring your system to use <application>Linux-PAM</application>
231 can be a complex task. The information below will provide a basic setup
232 so that <application>Shadow</application>'s login and password
233 functionality will work effectively with
234 <application>Linux-PAM</application>. Review the information and links on
235 the <xref linkend="linux-pam"/> page for further configuration
236 information. For information specific to integrating
237 <application>Shadow</application>, <application>Linux-PAM</application>
238 and <application>CrackLib</application>, you can visit the following
239 links:</para>
240
241 <itemizedlist spacing="compact">
242 <listitem>
243 <para><ulink
244 url="http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam-6.html#ss6.3"/></para>
245 </listitem>
246 <listitem>
247 <para><ulink
248 url="http://www.deer-run.com/~hal/sysadmin/pam_cracklib.html"/></para>
249 </listitem>
250 </itemizedlist>
251
252 <sect4 id="pam-login-defs">
253 <title>Configuring /etc/login.defs</title>
254
255 <para>The <command>login</command> program currently performs many
256 functions which <application>Linux-PAM</application> modules should
257 now handle. The following <command>sed</command> command will comment
258 out the appropriate lines in <filename>/etc/login.defs</filename>, and
259 stop <command>login</command> from performing these functions (a backup
260 file named <filename>/etc/login.defs.orig</filename> is also created
261 to preserve the original file's contents). Issue the following commands
262 as the <systemitem class="username">root</systemitem> user:</para>
263
264 <indexterm zone="shadow pam-login-defs">
265 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
266 </indexterm>
267
268<screen role="root"><userinput>install -v -m644 /etc/login.defs /etc/login.defs.orig &amp;&amp;
269for FUNCTION in LASTLOG_ENAB MAIL_CHECK_ENAB \
270 PORTTIME_CHECKS_ENAB CONSOLE \
271 MOTD_FILE NOLOGINS_FILE PASS_MIN_LEN \
272 SU_WHEEL_ONLY MD5_CRYPT_ENAB \
273 CONSOLE_GROUPS ENVIRON_FILE \
274 ULIMIT ENV_TZ ENV_HZ ENV_SUPATH \
275 ENV_PATH QMAIL_DIR MAIL_DIR MAIL_FILE \
276 CHFN_AUTH FAILLOG_ENAB QUOTAS_ENAB FTMP_FILE \
277 OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
278 PASS_CHANGE_TRIES PASS_ALWAYS_WARN
279do
280 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
281done</userinput></screen>
282
283 <!-- Moved the commenting of these four parameters into the section
284 above. If PAM is installed, it complains if these are not commented
285 regardless if CrackLib is installed.
286
287 <para>If you have <application>CrackLib</application> installed,
288 also comment out four more lines using the following command as the
289 <systemitem class="username">root</systemitem> user:</para>
290
291<screen role="root"><userinput>for FUNCTION in OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
292 PASS_CHANGE_TRIES PASS_ALWAYS_WARN
293do
294 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
295done</userinput></screen>
296
297 -->
298
299 </sect4>
300
301 <sect4>
302 <title>Configuring the /etc/pam.d/ Files</title>
303
304 <para>As mentioned previously in the
305 <application>Linux-PAM</application> instructions,
306 <application>Linux-PAM</application> has two supported methods for
307 configuration. The commands below assume that you've chosen to use
308 a directory based configuration, where each program has its own
309 configuration file. You can optionally use a single
310 <filename>/etc/pam.conf</filename> configuration file by using the
311 text from the files below, and supplying the program name as an
312 additional first field for each line.</para>
313
314 <para>As the <systemitem class="username">root</systemitem> user,
315 create the <filename class="directory">/etc/pam.d</filename>
316 directory with the following command:</para>
317
318 <screen role="root"><userinput>install -v -d -m755 /etc/pam.d</userinput></screen>
319
320 <para>While still the <systemitem class="username">root</systemitem>
321 user, add the following <application>Linux-PAM</application>
322 configuration files to the
323 <filename class="directory">/etc/pam.d/</filename> directory (or
324 add the contents to the <filename>/etc/pam.conf</filename> file) with
325 the following commands:</para>
326
327 </sect4>
328
329 <sect4>
330 <title>'login' (with CrackLib)</title>
331
332<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
333<literal># Begin /etc/pam.d/login
334
335auth requisite pam_securetty.so
336auth requisite pam_nologin.so
337auth required pam_unix.so
338account required pam_access.so
339account required pam_unix.so
340session required pam_env.so
341session required pam_motd.so
342session required pam_limits.so
343session optional pam_mail.so dir=/var/mail standard
344session optional pam_lastlog.so
345session required pam_unix.so
346password required pam_cracklib.so retry=3 difok=8 minlen=5 \
347 dcredit=3 ocredit=3 \
348 ucredit=2 lcredit=2
349password required pam_unix.so md5 shadow use_authtok
350
351# End /etc/pam.d/login</literal>
352EOF</userinput></screen>
353
354 </sect4>
355
356 <sect4>
357 <title>'login' (without CrackLib)</title>
358
359<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
360<literal># Begin /etc/pam.d/login
361
362auth requisite pam_securetty.so
363auth requisite pam_nologin.so
364auth required pam_env.so
365auth required pam_unix.so
366account required pam_access.so
367account required pam_unix.so
368session required pam_motd.so
369session required pam_limits.so
370session optional pam_mail.so dir=/var/mail standard
371session optional pam_lastlog.so
372session required pam_unix.so
373password required pam_unix.so md5 shadow
374
375# End /etc/pam.d/login</literal>
376EOF</userinput></screen>
377
378 </sect4>
379
380 <sect4>
381 <title>'passwd' (with CrackLib)</title>
382
383<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
384<literal># Begin /etc/pam.d/passwd
385
386password required pam_cracklib.so retry=3 difok=8 minlen=5 \
387 dcredit=3 ocredit=3 \
388 ucredit=2 lcredit=2
389password required pam_unix.so md5 shadow use_authtok
390
391# End /etc/pam.d/passwd</literal>
392EOF</userinput></screen>
393
394 </sect4>
395
396 <sect4>
397 <title>'passwd' (without CrackLib)</title>
398
399<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
400<literal># Begin /etc/pam.d/passwd
401
402password required pam_unix.so md5 shadow
403
404# End /etc/pam.d/passwd</literal>
405EOF</userinput></screen>
406
407 </sect4>
408
409 <sect4>
410 <title>'su'</title>
411
412<screen role="root"><userinput>cat &gt; /etc/pam.d/su &lt;&lt; "EOF"
413<literal># Begin /etc/pam.d/su
414
415auth sufficient pam_rootok.so
416auth required pam_unix.so
417account required pam_unix.so
418session optional pam_mail.so dir=/var/mail standard
419session required pam_env.so
420session required pam_unix.so
421
422# End /etc/pam.d/su</literal>
423EOF</userinput></screen>
424
425 </sect4>
426
427 <sect4>
428 <title>'chage'</title>
429
430<screen role="root"><userinput>cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"
431<literal># Begin /etc/pam.d/chage
432
433auth sufficient pam_rootok.so
434auth required pam_unix.so
435account required pam_unix.so
436session required pam_unix.so
437password required pam_permit.so
438
439# End /etc/pam.d/chage</literal>
440EOF</userinput></screen>
441
442 </sect4>
443
444 <sect4>
445 <title>'chpasswd', 'newusers', 'groupadd', 'groupdel',
446 'groupmod', 'useradd', 'userdel', and 'usermod'</title>
447
448<screen role="root"><userinput>for PROGRAM in chpasswd newusers groupadd groupdel \
449 groupmod useradd userdel usermod
450do
451 install -v -m644 /etc/pam.d/chage /etc/pam.d/$PROGRAM
452 sed -i "s/chage/$PROGRAM/" /etc/pam.d/$PROGRAM
453done</userinput></screen>
454
455 <warning>
456 <para>At this point, you should do a simple test to see if
457 <application>Shadow</application> is working as expected. Open
458 another terminal and log in as a user, then <command>su</command> to
459 <systemitem class="username">root</systemitem>. If you do not see any
460 errors, then all is well and you should proceed with the rest of the
461 configuration. If you did receive errors, stop now and double check
462 the above configuration files manually. You can also run the test
463 suite from the <application>Linux-PAM</application> package to assist
464 you in determining the problem. If you cannot find and
465 fix the error, you should recompile <application>Shadow</application>
466 replacing <option>--with-libpam</option> with
467 <option>--without-libpam</option> in the above instructions (also move
468 the <filename>/etc/login.defs.orig</filename> backup file to
469 <filename>/etc/login.defs</filename>). If you
470 fail to do this and the errors remain, you will be unable to log into
471 your system.</para>
472 </warning>
473
474 </sect4>
475
476 <sect4>
477 <title>Other</title>
478
479 <para>Currently, <filename>/etc/pam.d/other</filename> is configured
480 to allow anyone with an account on the machine to use PAM-aware
481 programs without a configuration file for that program. After testing
482 <application>Linux-PAM</application> for proper configuration, install
483 a more restrictive <filename>other</filename> file so that
484 program-specific configuration files are required:</para>
485
486<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
487<literal># Begin /etc/pam.d/other
488
489auth required pam_deny.so
490auth required pam_warn.so
491account required pam_deny.so
492session required pam_deny.so
493password required pam_deny.so
494password required pam_warn.so
495
496# End /etc/pam.d/other</literal>
497EOF</userinput></screen>
498
499 <para>If you preserved the source tree from the
500 <application>Linux-PAM</application> package (or you feel like unpacking
501 that tarball, then running <command>configure</command> and
502 <command>make</command>), now would be a good time to run the test
503 suite from this package. This test suite will use the configuration you
504 just finished during the tests. All the tests should pass.</para>
505
506 </sect4>
507
508 <sect4 id="pam-access">
509 <title>Configuring Login Access</title>
510
511 <para>Instead of using the <filename>/etc/login.access</filename>
512 file for controlling access to the system,
513 <application>Linux-PAM</application> uses the
514 <filename class='libraryfile'>pam_access.so</filename> module along
515 with the <filename>/etc/security/access.conf</filename> file. Rename
516 the <filename>/etc/login.access</filename> file using the following
517 command:</para>
518
519 <indexterm zone="shadow pam-access">
520 <primary sortas="e-etc-security-access.conf">/etc/security/access.conf</primary>
521 </indexterm>
522
523<screen role="root"><userinput>if [ -f /etc/login.access ]; then
524 mv -v /etc/login.access /etc/login.access.NOUSE
525fi</userinput></screen>
526
527 </sect4>
528
529 <sect4 id="pam-limits">
530 <title>Configuring Resource Limits</title>
531
532 <para>Instead of using the <filename>/etc/limits</filename> file
533 for limiting usage of system resources,
534 <application>Linux-PAM</application> uses the
535 <filename class='libraryfile'>pam_limits.so</filename> module along
536 with the <filename>/etc/security/limits.conf</filename> file. Rename
537 the <filename>/etc/limits</filename> file using the following
538 command:</para>
539
540 <indexterm zone="shadow pam-limits">
541 <primary sortas="e-etc-security-limits.conf">/etc/security/limits.conf</primary>
542 </indexterm>
543
544<screen role="root"><userinput>if [ -f /etc/limits ]; then
545 mv -v /etc/limits /etc/limits.NOUSE
546fi</userinput></screen>
547
548 </sect4>
549
550 <sect4 id="pam-env">
551 <title>Configuring Default Environment</title>
552
553 <para>During previous configuration, several items were removed from
554 <filename>/etc/login.defs</filename>. Some of these items are now
555 controlled by the <filename class='libraryfile'>pam_env.so</filename>
556 module and the <filename>/etc/security/pam_env.conf</filename>
557 configuration file. In particular, the default path has been
558 changed. To recover your default path, execute the following
559 commands:</para>
560
561<screen role="root"><userinput>ENV_PATH=`grep '^ENV_PATH' /etc/login.defs.orig | \
562 awk '{ print $2 }' | sed 's/PATH=//'` &amp;&amp;
563echo 'PATH DEFAULT='`echo "${ENV_PATH}"`\
564' OVERRIDE=${PATH}' \
565 >> /etc/security/pam_env.conf &amp;&amp;
566unset ENV_PATH</userinput></screen>
567
568 <note>
569 <para>ENV_SUPATH is no longer supported. You must create
570 a valid <filename>/root/.bashrc</filename> file to provide a
571 modified path for the super-user.</para>
572 </note>
573
574 </sect4>
575
576 </sect3>
577
578 </sect2>
579
580 <sect2 role="content">
581 <title>Contents</title>
582
583 <para>A list of the installed files, along with their short descriptions
584 can be found at
585 <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.</para>
586
587 </sect2>
588
589</sect1>
Note: See TracBrowser for help on using the repository browser.