source: postlfs/security/shadow.xml@ 31f3a57

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 31f3a57 was 31f3a57, checked in by Randy McMurchy <randy@…>, 19 years ago

Updated to Shadow-4.0.11.1

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@4931 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 15.9 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY shadow-download-http "http://ftp.pld.org.pl/software/shadow/shadow-&shadow-version;.tar.bz2">
8 <!ENTITY shadow-download-ftp "ftp://ftp.pld.org.pl/software/shadow/shadow-&shadow-version;.tar.bz2">
9 <!ENTITY shadow-md5sum "e60b7b16128b9e00576073389a0ff1e6">
10 <!ENTITY shadow-size "1.1 MB">
11 <!ENTITY shadow-buildsize "13.6 MB">
12 <!ENTITY shadow-time "0.3 SBU">
13]>
14
15<sect1 id="shadow" xreflabel="Shadow-&shadow-version;">
16 <?dbhtml filename="shadow.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Shadow-&shadow-version;</title>
24
25 <indexterm zone="shadow">
26 <primary sortas="a-Shadow">Shadow</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Shadow</title>
31
32 <para><application>Shadow</application> was indeed installed in LFS and
33 there is no reason to reinstall it unless you installed
34 <application>Linux-PAM</application>. If you did, this will allow programs
35 like <command>login</command> and <command>su</command> to utilize PAM.</para>
36
37 <bridgehead renderas="sect3">Package Information</bridgehead>
38 <itemizedlist spacing="compact">
39 <listitem>
40 <para>Download (HTTP): <ulink url="&shadow-download-http;"/></para>
41 </listitem>
42 <listitem>
43 <para>Download (FTP): <ulink url="&shadow-download-ftp;"/></para>
44 </listitem>
45 <listitem>
46 <para>Download MD5 sum: &shadow-md5sum;</para>
47 </listitem>
48 <listitem>
49 <para>Download size: &shadow-size;</para>
50 </listitem>
51 <listitem>
52 <para>Estimated disk space required: &shadow-buildsize;</para>
53 </listitem>
54 <listitem>
55 <para>Estimated build time: &shadow-time;</para>
56 </listitem>
57 </itemizedlist>
58
59<!--
60 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
61 <itemizedlist spacing='compact'>
62 <listitem>
63 <para>Patch to fix several invalid warning messages when used with
64 <application>Linux_PAM</application>: <ulink
65 url="&patch-root;/shadow-&shadow-version;-Linux_PAM_fixes-1.patch"/></para>
66 </listitem>
67 </itemizedlist>
68-->
69
70 <bridgehead renderas="sect3">Shadow Dependencies</bridgehead>
71
72 <bridgehead renderas="sect4">Required</bridgehead>
73 <para><xref linkend="Linux_PAM"/></para>
74
75 </sect2>
76
77 <sect2 role="installation">
78 <title>Installation of Shadow</title>
79
80 <para>Reinstall <application>Shadow</application> by running the following
81 commands:</para>
82
83<!--
84<screen><userinput>patch -Np1 -i ../shadow-&shadow-version;-Linux_PAM_fixes-1.patch &amp;&amp;
85<-->
86
87<screen><userinput>./configure --libdir=/lib --enable-shared --enable-shadowgrp \
88 --with-libpam --without-libcrack &amp;&amp;
89sed -i 's/groups$(EXEEXT) //' src/Makefile &amp;&amp;
90sed -i '/groups/d' man/Makefile &amp;&amp;
91make</userinput></screen>
92
93 <para>This package does not come with a test suite.</para>
94
95 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
96
97<screen role="root"><userinput>make install &amp;&amp;
98mv -v /usr/bin/passwd /bin &amp;&amp;
99mv -v /lib/libshadow.*a /usr/lib &amp;&amp;
100rm -v /lib/libshadow.so &amp;&amp;
101ln -v -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
102
103 </sect2>
104
105 <sect2 role="commands">
106 <title>Command Explanations</title>
107
108 <para><parameter>--without-libcrack</parameter>: This switch tells
109 <application>Shadow</application> not to use
110 <filename class='libraryfile'>libcrack</filename>. This is desired as
111 <application>Linux-PAM</application> already contains
112 <filename class='libraryfile'>libcrack</filename>.</para>
113
114 <para><parameter>--enable-shadowgrp</parameter>: This version of
115 <application>Shadow</application> defaults to not enabling
116 its group functionality, which causes <command>grpconv</command> to
117 fail.</para>
118
119 <para><command>sed -i ...</command>: These commands are used to suppress
120 the installation of the <command>groups</command> program as the version
121 from the <application>Coreutils</application> package installed during
122 LFS is preferred.</para>
123
124 </sect2>
125
126 <sect2 role="configuration">
127 <title>Configuring Linux-PAM to Work with Shadow</title>
128
129 <sect3 id="pam.d">
130 <title>Config Files</title>
131
132 <para><filename>/etc/pam.d/*</filename> or alternatively
133 <filename>/etc/pam.conf, /etc/login.defs and
134 /etc/security/*</filename></para>
135
136 <indexterm zone="shadow pam.d">
137 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
138 </indexterm>
139
140 <indexterm zone="shadow pam.d">
141 <primary sortas="e-etc-pam.conf">/etc/pam.conf</primary>
142 </indexterm>
143
144 <indexterm zone="shadow pam.d">
145 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
146 </indexterm>
147
148 <indexterm zone="shadow pam.d">
149 <primary sortas="e-etc-security">/etc/security/*</primary>
150 </indexterm>
151
152 </sect3>
153
154 <sect3>
155 <title>Configuration Information</title>
156
157 <sect4 id="pam-login-defs">
158 <title>Configuring /etc/login.defs</title>
159
160 <para>The <command>login</command> program currently performs many
161 functions which <application>Linux-PAM</application> modules should
162 now handle. The following <command>sed</command> command will comment
163 out the appropriate lines in <filename>/etc/login.defs</filename>, and
164 stop <command>login</command> from performing these functions (a backup
165 file named <filename>/etc/login.defs.orig</filename> is also created
166 to preserve the original file's contents):</para>
167
168 <indexterm zone="shadow pam-login-defs">
169 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
170 </indexterm>
171
172<screen role="root"><userinput>install -v -m644 /etc/login.defs /etc/login.defs.orig &amp;&amp;
173for FUNCTION in LASTLOG_ENAB MAIL_CHECK_ENAB \
174 PORTTIME_CHECKS_ENAB CONSOLE \
175 MOTD_FILE NOLOGINS_FILE PASS_MIN_LEN \
176 SU_WHEEL_ONLY MD5_CRYPT_ENAB \
177 CONSOLE_GROUPS ENVIRON_FILE \
178 ULIMIT ENV_TZ ENV_HZ ENV_SUPATH \
179 ENV_PATH QMAIL_DIR MAIL_DIR MAIL_FILE \
180 CHFN_AUTH FAILLOG_ENAB QUOTAS_ENAB FTMP_FILE
181do
182 sed -i -e "s/^$FUNCTION/# &amp;/" /etc/login.defs
183done</userinput></screen>
184
185 <para>If you have <application>CrackLib</application> installed,
186 also comment out four more lines using the following command:</para>
187
188<screen role="root"><userinput>for FUNCTION in OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
189 PASS_CHANGE_TRIES PASS_ALWAYS_WARN
190do
191 sed -i -e "s/^$FUNCTION/# &amp;/" /etc/login.defs
192done</userinput></screen>
193
194 </sect4>
195
196 <sect4>
197 <title>Configuring the /etc/pam.d/ Files</title>
198
199 <para>Add the following <application>Linux-PAM</application> configuration
200 files to <filename class="directory">/etc/pam.d/</filename> (or add them
201 to <filename>/etc/pam.conf</filename> with the additional field for
202 the program).</para>
203
204 </sect4>
205
206 <sect4>
207 <title>'login' (with CrackLib)</title>
208
209<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
210<literal># Begin /etc/pam.d/login
211
212auth requisite pam_securetty.so
213auth requisite pam_nologin.so
214auth required pam_unix.so
215account required pam_access.so
216account required pam_unix.so
217session required pam_env.so
218session required pam_motd.so
219session required pam_limits.so
220session optional pam_mail.so dir=/var/mail standard
221session optional pam_lastlog.so
222session required pam_unix.so
223password required pam_cracklib.so retry=3 difok=8 minlen=5 \
224 dcredit=3 ocredit=3 \
225 ucredit=2 lcredit=2
226password required pam_unix.so md5 shadow use_authtok
227
228# End /etc/pam.d/login</literal>
229EOF</userinput></screen>
230
231 </sect4>
232
233 <sect4>
234 <title>'login' (without CrackLib)</title>
235
236<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
237<literal># Begin /etc/pam.d/login
238
239auth requisite pam_securetty.so
240auth requisite pam_nologin.so
241auth required pam_env.so
242auth required pam_unix.so
243account required pam_access.so
244account required pam_unix.so
245session required pam_motd.so
246session required pam_limits.so
247session optional pam_mail.so dir=/var/mail standard
248session optional pam_lastlog.so
249session required pam_unix.so
250password required pam_unix.so md5 shadow
251
252# End /etc/pam.d/login</literal>
253EOF</userinput></screen>
254
255 </sect4>
256
257 <sect4>
258 <title>'passwd' (with CrackLib)</title>
259
260<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
261<literal># Begin /etc/pam.d/passwd
262
263password required pam_cracklib.so retry=3 difok=8 minlen=5 \
264 dcredit=3 ocredit=3 \
265 ucredit=2 lcredit=2
266password required pam_unix.so md5 shadow use_authtok
267
268# End /etc/pam.d/passwd</literal>
269EOF</userinput></screen>
270
271 </sect4>
272
273 <sect4>
274 <title>'passwd' (without CrackLib)</title>
275
276<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
277<literal># Begin /etc/pam.d/passwd
278
279password required pam_unix.so md5 shadow
280
281# End /etc/pam.d/passwd</literal>
282EOF</userinput></screen>
283
284 </sect4>
285
286 <sect4>
287 <title>'su'</title>
288
289<screen role="root"><userinput>cat &gt; /etc/pam.d/su &lt;&lt; "EOF"
290<literal># Begin /etc/pam.d/su
291
292auth sufficient pam_rootok.so
293auth required pam_unix.so
294account required pam_unix.so
295session optional pam_mail.so dir=/var/mail standard
296session required pam_env.so
297session required pam_unix.so
298
299# End /etc/pam.d/su</literal>
300EOF</userinput></screen>
301
302 </sect4>
303
304 <sect4>
305 <title>'chage'</title>
306
307<screen role="root"><userinput>cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"
308<literal># Begin /etc/pam.d/chage
309
310auth sufficient pam_rootok.so
311auth required pam_unix.so
312account required pam_unix.so
313session required pam_unix.so
314password required pam_permit.so
315
316# End /etc/pam.d/chage</literal>
317EOF</userinput></screen>
318
319 </sect4>
320
321 <sect4>
322 <title>'chpasswd', 'newusers', 'groupadd', 'groupdel',
323 'groupmod', 'useradd', 'userdel', and 'usermod'</title>
324
325<screen role="root"><userinput>for PROGRAM in chpasswd newusers groupadd groupdel \
326 groupmod useradd userdel usermod
327do
328 install -v -m644 /etc/pam.d/chage /etc/pam.d/$PROGRAM
329 sed -i -e "s/chage/$PROGRAM/" /etc/pam.d/$PROGRAM
330done</userinput></screen>
331
332 <warning>
333 <para>At this point, you should do a simple test to see if
334 <application>Shadow</application> is working as expected. Open
335 another terminal and log in as a user, then <command>su</command> to
336 <systemitem class="username">root</systemitem>. If you do not see any
337 errors, then all is well and you should proceed with the rest of the
338 configuration. If you did receive errors, stop now and double check
339 the above configuration files manually. If you cannot find and
340 fix the error, you should recompile <application>Shadow</application>
341 replacing <option>--with-libpam</option> with
342 <option>--without-libpam</option> in the above instructions (also move
343 the <filename>/etc/login.defs.orig</filename> backup file to
344 <filename>/etc/login.defs</filename>). If you
345 fail to do this and the errors remain, you will be unable to log into
346 your system.</para>
347 </warning>
348
349 </sect4>
350
351 <sect4>
352 <title>Other</title>
353
354 <para>Currently, <filename>/etc/pam.d/other</filename> is configured
355 to allow anyone with an account on the machine to use PAM-aware
356 programs without a configuration file for that program. After testing
357 <application>Linux-PAM</application> for proper configuration, install
358 a more restrictive <filename>other</filename> file so that
359 program-specific configuration files are required:</para>
360
361<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
362<literal># Begin /etc/pam.d/other
363
364auth required pam_deny.so
365auth required pam_warn.so
366account required pam_deny.so
367session required pam_deny.so
368password required pam_deny.so
369password required pam_warn.so
370
371# End /etc/pam.d/other</literal>
372EOF</userinput></screen>
373
374 </sect4>
375
376 <sect4 id="pam-access">
377 <title>Configuring Login Access</title>
378
379 <para>Instead of using the <filename>/etc/login.access</filename>
380 file for controlling access to the system,
381 <application>Linux-PAM</application> uses the
382 <filename class='libraryfile'>pam_access.so</filename> module along
383 with the <filename>/etc/security/access.conf</filename> file. Rename
384 the <filename>/etc/login.access</filename> file using the following
385 command:</para>
386
387 <indexterm zone="shadow pam-access">
388 <primary sortas="e-etc-security-access.conf">/etc/security/access.conf</primary>
389 </indexterm>
390
391<screen role="root"><userinput>if [ -f /etc/login.access ]; then
392 mv -v /etc/login.access /etc/login.access.NOUSE
393fi</userinput></screen>
394
395 </sect4>
396
397 <sect4 id="pam-limits">
398 <title>Configuring Resource Limits</title>
399
400 <para>Instead of using the <filename>/etc/limits</filename> file
401 for limiting usage of system resources,
402 <application>Linux-PAM</application> uses the
403 <filename class='libraryfile'>pam_limits.so</filename> module along
404 with the <filename>/etc/security/limits.conf</filename> file. Rename
405 the <filename>/etc/limits</filename> file using the following
406 command:</para>
407
408 <indexterm zone="shadow pam-limits">
409 <primary sortas="e-etc-security-limits.conf">/etc/security/limits.conf</primary>
410 </indexterm>
411
412<screen role="root"><userinput>if [ -f /etc/limits ]; then
413 mv -v /etc/limits /etc/limits.NOUSE
414fi</userinput></screen>
415
416 </sect4>
417
418
419 <sect4 id="pam-env">
420 <title>Configuring Default Environment</title>
421
422 <para>During previous configuration, several items were removed from
423 <filename>/etc/login.defs</filename>. Some of these items are now
424 controlled by the <filename class='libraryfile'>pam_env.so</filename>
425 module and the <filename>/etc/security/pam_env.conf</filename>
426 configuration file. In particular, the default path has been
427 changed. To recover your default path, execute the following
428 commands:</para>
429
430<screen><userinput><command>ENV_PATH=`grep '^ENV_PATH' /etc/login.defs.orig | \
431 awk '{ print $2 }' | sed 's/PATH=//'` &amp;&amp;
432echo 'PATH DEFAULT='`echo "${ENV_PATH}"`' OVERRIDE=${PATH}' \
433 >> /etc/security/pam_env.conf &amp;&amp;
434unset ENV_PATH</command></userinput></screen>
435
436 <note><para>ENV_SUPATH is no longer supported. You must create
437 a valid <filename>/root/.bashrc</filename> file to provide a
438 modified path for the super-user.</para></note>
439
440 </sect4>
441
442 </sect3>
443
444 </sect2>
445
446 <sect2 role="content">
447 <title>Contents</title>
448
449 <para>A list of the installed files, along with their short descriptions
450 can be found at
451 <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.</para>
452
453 </sect2>
454
455</sect1>
Note: See TracBrowser for help on using the repository browser.