source: postlfs/security/shadow.xml@ 4d3f1239

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 4d3f1239 was 4d3f1239, checked in by Bruce Dubbs <bdubbs@…>, 18 years ago

Fix typo in find/sed command

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@5441 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 16.1 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY shadow-download-http "http://ftp.pld.org.pl/software/shadow/shadow-&shadow-version;.tar.bz2">
8 <!ENTITY shadow-download-ftp "ftp://ftp.pld.org.pl/software/shadow/shadow-&shadow-version;.tar.bz2">
9 <!ENTITY shadow-md5sum "5c6a105d89afb0900922260e9c5650cc">
10 <!ENTITY shadow-size "1.0 MB">
11 <!ENTITY shadow-buildsize "13.6 MB">
12 <!ENTITY shadow-time "0.3 SBU">
13]>
14
15<sect1 id="shadow" xreflabel="Shadow-&shadow-version;">
16 <?dbhtml filename="shadow.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 <keywordset>
22 <keyword role="package">shadow-&shadow-version;.tar</keyword>
23 <keyword role="ftpdir">shadow</keyword>
24 </keywordset>
25 </sect1info>
26
27 <title>Shadow-&shadow-version;</title>
28
29 <indexterm zone="shadow">
30 <primary sortas="a-Shadow">Shadow</primary>
31 </indexterm>
32
33 <sect2 role="package">
34 <title>Introduction to Shadow</title>
35
36 <para><application>Shadow</application> was indeed installed in LFS and
37 there is no reason to reinstall it unless you installed
38 <application>Linux-PAM</application>. If you did install
39 <application>Linux-PAM</application>, reinstalling
40 <application>Shadow</application> will allow programs such as
41 <command>login</command> and <command>su</command> to utilize PAM.</para>
42
43 <bridgehead renderas="sect3">Package Information</bridgehead>
44 <itemizedlist spacing="compact">
45 <listitem>
46 <para>Download (HTTP): <ulink url="&shadow-download-http;"/></para>
47 </listitem>
48 <listitem>
49 <para>Download (FTP): <ulink url="&shadow-download-ftp;"/></para>
50 </listitem>
51 <listitem>
52 <para>Download MD5 sum: &shadow-md5sum;</para>
53 </listitem>
54 <listitem>
55 <para>Download size: &shadow-size;</para>
56 </listitem>
57 <listitem>
58 <para>Estimated disk space required: &shadow-buildsize;</para>
59 </listitem>
60 <listitem>
61 <para>Estimated build time: &shadow-time;</para>
62 </listitem>
63 </itemizedlist>
64
65 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
66 <itemizedlist spacing='compact'>
67 <listitem>
68 <para>Required patch: <ulink
69 url="&patch-root;/shadow-&shadow-version;-configure_fix-1.patch"/></para>
70 </listitem>
71 </itemizedlist>
72
73 <bridgehead renderas="sect3">Shadow Dependencies</bridgehead>
74
75 <bridgehead renderas="sect4">Required</bridgehead>
76 <para role="required"><xref linkend="linux-pam"/></para>
77
78 </sect2>
79
80 <sect2 role="installation">
81 <title>Installation of Shadow</title>
82
83 <para>Reinstall <application>Shadow</application> by running the following
84 commands:</para>
85
86<screen><userinput>patch -Np1 -i ../shadow-&shadow-version;-configure_fix-1.patch &amp;&amp;
87./configure --libdir=/lib --enable-shared \
88 --with-libpam --without-libcrack &amp;&amp;
89sed -i 's/groups$(EXEEXT) //' src/Makefile &amp;&amp;
90find man -name Makefile -exec sed -i '/groups/d' {} \; &amp;&amp;
91make</userinput></screen>
92
93 <para>This package does not come with a test suite.</para>
94
95 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
96
97<screen role="root"><userinput>make install &amp;&amp;
98mv -v /usr/bin/passwd /bin &amp;&amp;
99mv -v /lib/libshadow.*a /usr/lib &amp;&amp;
100rm -v /lib/libshadow.so &amp;&amp;
101ln -v -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
102
103 </sect2>
104
105 <sect2 role="commands">
106 <title>Command Explanations</title>
107
108 <para><parameter>--without-libcrack</parameter>: This switch tells
109 <application>Shadow</application> not to use
110 <filename class='libraryfile'>libcrack</filename>. This is desired as
111 <application>Linux-PAM</application> will provide
112 <filename class='libraryfile'>libcrack</filename> functionality.</para>
113
114 <para><command>sed -i ...</command>: These commands are used to suppress
115 the installation of the <command>groups</command> program and man pages
116 as the version from the <application>Coreutils</application> package
117 installed during LFS is preferred.</para>
118
119 </sect2>
120
121 <sect2 role="configuration">
122 <title>Configuring Linux-PAM to Work with Shadow</title>
123
124 <sect3 id="pam.d">
125 <title>Config Files</title>
126
127 <para><filename>/etc/pam.d/*</filename> or alternatively
128 <filename>/etc/pam.conf, /etc/login.defs and
129 /etc/security/*</filename></para>
130
131 <indexterm zone="shadow pam.d">
132 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
133 </indexterm>
134
135 <indexterm zone="shadow pam.d">
136 <primary sortas="e-etc-pam.conf">/etc/pam.conf</primary>
137 </indexterm>
138
139 <indexterm zone="shadow pam.d">
140 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
141 </indexterm>
142
143 <indexterm zone="shadow pam.d">
144 <primary sortas="e-etc-security">/etc/security/*</primary>
145 </indexterm>
146
147 </sect3>
148
149 <sect3>
150 <title>Configuration Information</title>
151
152 <sect4 id="pam-login-defs">
153 <title>Configuring /etc/login.defs</title>
154
155 <para>The <command>login</command> program currently performs many
156 functions which <application>Linux-PAM</application> modules should
157 now handle. The following <command>sed</command> command will comment
158 out the appropriate lines in <filename>/etc/login.defs</filename>, and
159 stop <command>login</command> from performing these functions (a backup
160 file named <filename>/etc/login.defs.orig</filename> is also created
161 to preserve the original file's contents). Issue the following commands
162 as the <systemitem class="username">root</systemitem> user:</para>
163
164 <indexterm zone="shadow pam-login-defs">
165 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
166 </indexterm>
167
168<screen role="root"><userinput>install -v -m644 /etc/login.defs /etc/login.defs.orig &amp;&amp;
169for FUNCTION in LASTLOG_ENAB MAIL_CHECK_ENAB \
170 PORTTIME_CHECKS_ENAB CONSOLE \
171 MOTD_FILE NOLOGINS_FILE PASS_MIN_LEN \
172 SU_WHEEL_ONLY MD5_CRYPT_ENAB \
173 CONSOLE_GROUPS ENVIRON_FILE \
174 ULIMIT ENV_TZ ENV_HZ ENV_SUPATH \
175 ENV_PATH QMAIL_DIR MAIL_DIR MAIL_FILE \
176 CHFN_AUTH FAILLOG_ENAB QUOTAS_ENAB FTMP_FILE
177do
178 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
179done</userinput></screen>
180
181 <para>If you have <application>CrackLib</application> installed,
182 also comment out four more lines using the following command as the
183 <systemitem class="username">root</systemitem> user:</para>
184
185<screen role="root"><userinput>for FUNCTION in OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
186 PASS_CHANGE_TRIES PASS_ALWAYS_WARN
187do
188 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
189done</userinput></screen>
190
191 </sect4>
192
193 <sect4>
194 <title>Configuring the /etc/pam.d/ Files</title>
195
196 <para>Add the following <application>Linux-PAM</application> configuration
197 files to <filename class="directory">/etc/pam.d/</filename> (or add them
198 to <filename>/etc/pam.conf</filename> with the additional field for
199 the program). Issue the commands as the
200 <systemitem class="username">root</systemitem> user:</para>
201
202 </sect4>
203
204 <sect4>
205 <title>'login' (with CrackLib)</title>
206
207<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
208<literal># Begin /etc/pam.d/login
209
210auth requisite pam_securetty.so
211auth requisite pam_nologin.so
212auth required pam_unix.so
213account required pam_access.so
214account required pam_unix.so
215session required pam_env.so
216session required pam_motd.so
217session required pam_limits.so
218session optional pam_mail.so dir=/var/mail standard
219session optional pam_lastlog.so
220session required pam_unix.so
221password required pam_cracklib.so retry=3 difok=8 minlen=5 \
222 dcredit=3 ocredit=3 \
223 ucredit=2 lcredit=2
224password required pam_unix.so md5 shadow use_authtok
225
226# End /etc/pam.d/login</literal>
227EOF</userinput></screen>
228
229 </sect4>
230
231 <sect4>
232 <title>'login' (without CrackLib)</title>
233
234<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
235<literal># Begin /etc/pam.d/login
236
237auth requisite pam_securetty.so
238auth requisite pam_nologin.so
239auth required pam_env.so
240auth required pam_unix.so
241account required pam_access.so
242account required pam_unix.so
243session required pam_motd.so
244session required pam_limits.so
245session optional pam_mail.so dir=/var/mail standard
246session optional pam_lastlog.so
247session required pam_unix.so
248password required pam_unix.so md5 shadow
249
250# End /etc/pam.d/login</literal>
251EOF</userinput></screen>
252
253 </sect4>
254
255 <sect4>
256 <title>'passwd' (with CrackLib)</title>
257
258<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
259<literal># Begin /etc/pam.d/passwd
260
261password required pam_cracklib.so retry=3 difok=8 minlen=5 \
262 dcredit=3 ocredit=3 \
263 ucredit=2 lcredit=2
264password required pam_unix.so md5 shadow use_authtok
265
266# End /etc/pam.d/passwd</literal>
267EOF</userinput></screen>
268
269 </sect4>
270
271 <sect4>
272 <title>'passwd' (without CrackLib)</title>
273
274<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
275<literal># Begin /etc/pam.d/passwd
276
277password required pam_unix.so md5 shadow
278
279# End /etc/pam.d/passwd</literal>
280EOF</userinput></screen>
281
282 </sect4>
283
284 <sect4>
285 <title>'su'</title>
286
287<screen role="root"><userinput>cat &gt; /etc/pam.d/su &lt;&lt; "EOF"
288<literal># Begin /etc/pam.d/su
289
290auth sufficient pam_rootok.so
291auth required pam_unix.so
292account required pam_unix.so
293session optional pam_mail.so dir=/var/mail standard
294session required pam_env.so
295session required pam_unix.so
296
297# End /etc/pam.d/su</literal>
298EOF</userinput></screen>
299
300 </sect4>
301
302 <sect4>
303 <title>'chage'</title>
304
305<screen role="root"><userinput>cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"
306<literal># Begin /etc/pam.d/chage
307
308auth sufficient pam_rootok.so
309auth required pam_unix.so
310account required pam_unix.so
311session required pam_unix.so
312password required pam_permit.so
313
314# End /etc/pam.d/chage</literal>
315EOF</userinput></screen>
316
317 </sect4>
318
319 <sect4>
320 <title>'chpasswd', 'newusers', 'groupadd', 'groupdel',
321 'groupmod', 'useradd', 'userdel', and 'usermod'</title>
322
323<screen role="root"><userinput>for PROGRAM in chpasswd newusers groupadd groupdel \
324 groupmod useradd userdel usermod
325do
326 install -v -m644 /etc/pam.d/chage /etc/pam.d/$PROGRAM
327 sed -i "s/chage/$PROGRAM/" /etc/pam.d/$PROGRAM
328done</userinput></screen>
329
330 <warning>
331 <para>At this point, you should do a simple test to see if
332 <application>Shadow</application> is working as expected. Open
333 another terminal and log in as a user, then <command>su</command> to
334 <systemitem class="username">root</systemitem>. If you do not see any
335 errors, then all is well and you should proceed with the rest of the
336 configuration. If you did receive errors, stop now and double check
337 the above configuration files manually. If you cannot find and
338 fix the error, you should recompile <application>Shadow</application>
339 replacing <option>--with-libpam</option> with
340 <option>--without-libpam</option> in the above instructions (also move
341 the <filename>/etc/login.defs.orig</filename> backup file to
342 <filename>/etc/login.defs</filename>). If you
343 fail to do this and the errors remain, you will be unable to log into
344 your system.</para>
345 </warning>
346
347 </sect4>
348
349 <sect4>
350 <title>Other</title>
351
352 <para>Currently, <filename>/etc/pam.d/other</filename> is configured
353 to allow anyone with an account on the machine to use PAM-aware
354 programs without a configuration file for that program. After testing
355 <application>Linux-PAM</application> for proper configuration, install
356 a more restrictive <filename>other</filename> file so that
357 program-specific configuration files are required:</para>
358
359<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
360<literal># Begin /etc/pam.d/other
361
362auth required pam_deny.so
363auth required pam_warn.so
364account required pam_deny.so
365session required pam_deny.so
366password required pam_deny.so
367password required pam_warn.so
368
369# End /etc/pam.d/other</literal>
370EOF</userinput></screen>
371
372 </sect4>
373
374 <sect4 id="pam-access">
375 <title>Configuring Login Access</title>
376
377 <para>Instead of using the <filename>/etc/login.access</filename>
378 file for controlling access to the system,
379 <application>Linux-PAM</application> uses the
380 <filename class='libraryfile'>pam_access.so</filename> module along
381 with the <filename>/etc/security/access.conf</filename> file. Rename
382 the <filename>/etc/login.access</filename> file using the following
383 command:</para>
384
385 <indexterm zone="shadow pam-access">
386 <primary sortas="e-etc-security-access.conf">/etc/security/access.conf</primary>
387 </indexterm>
388
389<screen role="root"><userinput>if [ -f /etc/login.access ]; then
390 mv -v /etc/login.access /etc/login.access.NOUSE
391fi</userinput></screen>
392
393 </sect4>
394
395 <sect4 id="pam-limits">
396 <title>Configuring Resource Limits</title>
397
398 <para>Instead of using the <filename>/etc/limits</filename> file
399 for limiting usage of system resources,
400 <application>Linux-PAM</application> uses the
401 <filename class='libraryfile'>pam_limits.so</filename> module along
402 with the <filename>/etc/security/limits.conf</filename> file. Rename
403 the <filename>/etc/limits</filename> file using the following
404 command:</para>
405
406 <indexterm zone="shadow pam-limits">
407 <primary sortas="e-etc-security-limits.conf">/etc/security/limits.conf</primary>
408 </indexterm>
409
410<screen role="root"><userinput>if [ -f /etc/limits ]; then
411 mv -v /etc/limits /etc/limits.NOUSE
412fi</userinput></screen>
413
414 </sect4>
415
416 <sect4 id="pam-env">
417 <title>Configuring Default Environment</title>
418
419 <para>During previous configuration, several items were removed from
420 <filename>/etc/login.defs</filename>. Some of these items are now
421 controlled by the <filename class='libraryfile'>pam_env.so</filename>
422 module and the <filename>/etc/security/pam_env.conf</filename>
423 configuration file. In particular, the default path has been
424 changed. To recover your default path, execute the following
425 commands:</para>
426
427<screen role="root"><userinput>ENV_PATH=`grep '^ENV_PATH' /etc/login.defs.orig | \
428 awk '{ print $2 }' | sed 's/PATH=//'` &amp;&amp;
429echo 'PATH DEFAULT='`echo "${ENV_PATH}"`\
430' OVERRIDE=${PATH}' \
431 >> /etc/security/pam_env.conf &amp;&amp;
432unset ENV_PATH</userinput></screen>
433
434 <note>
435 <para>ENV_SUPATH is no longer supported. You must create
436 a valid <filename>/root/.bashrc</filename> file to provide a
437 modified path for the super-user.</para>
438 </note>
439
440 </sect4>
441
442 </sect3>
443
444 </sect2>
445
446 <sect2 role="content">
447 <title>Contents</title>
448
449 <para>A list of the installed files, along with their short descriptions
450 can be found at
451 <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.</para>
452
453 </sect2>
454
455</sect1>
Note: See TracBrowser for help on using the repository browser.