source: postlfs/security/shadow.xml@ 6732c094

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 6732c094 was 6732c094, checked in by Randy McMurchy <randy@…>, 17 years ago

Updated all the XML files (and the one stylesheet) to use the 4.5 version of DocBook XML DTD

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@6716 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 22.3 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY shadow-download-http "http://ftp.pld.org.pl/software/shadow/old/shadow-&shadow-version;.tar.bz2">
8 <!ENTITY shadow-download-ftp "ftp://ftp.pld.org.pl/software/shadow/old/shadow-&shadow-version;.tar.bz2">
9 <!ENTITY shadow-md5sum "bc5972a195290533b4c0576276056ed9">
10 <!ENTITY shadow-size "1.4 MB">
11 <!ENTITY shadow-buildsize "17 MB">
12 <!ENTITY shadow-time "0.3 SBU">
13]>
14
15<sect1 id="shadow" xreflabel="Shadow-&shadow-version;">
16 <?dbhtml filename="shadow.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Shadow-&shadow-version;</title>
24
25 <indexterm zone="shadow">
26 <primary sortas="a-Shadow">Shadow</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Shadow</title>
31
32 <para><application>Shadow</application> was indeed installed in LFS and
33 there is no reason to reinstall it unless you installed
34 <application>CrackLib</application> or
35 <application>Linux-PAM</application> after your LFS system was completed.
36 If you have installed <application>CrackLib</application> after LFS, then
37 reinstalling <application>Shadow</application> will enable strong password
38 support. If you have installed <application>Linux-PAM</application>,
39 reinstalling <application>Shadow</application> will allow programs such as
40 <command>login</command> and <command>su</command> to utilize PAM.</para>
41
42 <bridgehead renderas="sect3">Package Information</bridgehead>
43 <itemizedlist spacing="compact">
44 <listitem>
45 <para>Download (HTTP): <ulink url="&shadow-download-http;"/></para>
46 </listitem>
47 <listitem>
48 <para>Download (FTP): <ulink url="&shadow-download-ftp;"/></para>
49 </listitem>
50 <listitem>
51 <para>Download MD5 sum: &shadow-md5sum;</para>
52 </listitem>
53 <listitem>
54 <para>Download size: &shadow-size;</para>
55 </listitem>
56 <listitem>
57 <para>Estimated disk space required: &shadow-buildsize;</para>
58 </listitem>
59 <listitem>
60 <para>Estimated build time: &shadow-time;</para>
61 </listitem>
62 </itemizedlist>
63
64 <!--
65 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
66 <itemizedlist spacing='compact'>
67 <listitem>
68 <para>Required patch: <ulink
69 url="&patch-root;/shadow-&shadow-version;-configure_fix-1.patch"/></para>
70 </listitem>
71 </itemizedlist>
72 -->
73
74 <bridgehead renderas="sect3">Shadow Dependencies</bridgehead>
75
76 <bridgehead renderas="sect4">Required</bridgehead>
77 <para role="required"><xref linkend="linux-pam"/> and/or
78 <xref linkend="cracklib"/></para>
79
80 <para condition="html" role="usernotes">User Notes:
81 <ulink url="&blfs-wiki;/shadow"/></para>
82
83 </sect2>
84
85 <sect2 role="installation">
86 <title>Installation of Shadow</title>
87
88 <important>
89 <para>The installation shown below is for a situation where
90 <application>Linux-PAM</application> has been installed (with or
91 without a <application>CrackLib</application> installation) and
92 <application>Shadow</application> is being reinstalled to support the
93 <application>Linux-PAM</application> installation. If you are
94 reinstalling <application>Shadow</application> to provide strong
95 password support via the <application>CrackLib</application> library
96 and you have not installed <application>Linux-PAM</application>, ensure
97 you add the <parameter>--with-libcrack</parameter> parameter to the
98 <command>configure</command> script below.</para>
99 </important>
100
101 <para>Reinstall <application>Shadow</application> by running the following
102 commands:</para>
103
104<screen><userinput>./configure --libdir=/lib \
105 --sysconfdir=/etc \
106 --enable-shared \
107 --without-selinux &amp;&amp;
108sed -i 's/groups$(EXEEXT) //' src/Makefile &amp;&amp;
109find man -name Makefile -exec sed -i '/groups/d' {} \; &amp;&amp;
110sed -i -e 's/ ko//' -e 's/ zh_CN zh_TW//' man/Makefile &amp;&amp;
111
112for i in de es fi fr id it pt_BR; do
113 convert-mans UTF-8 ISO-8859-1 man/${i}/*.?
114done &amp;&amp;
115
116for i in cs hu pl; do
117 convert-mans UTF-8 ISO-8859-2 man/${i}/*.?
118done &amp;&amp;
119
120convert-mans UTF-8 EUC-JP man/ja/*.? &amp;&amp;
121convert-mans UTF-8 KOI8-R man/ru/*.? &amp;&amp;
122convert-mans UTF-8 ISO-8859-9 man/tr/*.? &amp;&amp;
123
124make</userinput></screen>
125
126 <para>This package does not come with a test suite.</para>
127
128 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
129
130<screen role="root"><userinput>make install &amp;&amp;
131mv -v /usr/bin/passwd /bin &amp;&amp;
132mv -v /lib/libshadow.*a /usr/lib &amp;&amp;
133rm -v /lib/libshadow.so &amp;&amp;
134ln -v -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
135
136 </sect2>
137
138 <sect2 role="commands">
139 <title>Command Explanations</title>
140
141 <!-- Removed the -with-libpam and -without-libcrack options from the
142 default as these are the defaults. Pam will automatically be picked
143 up if it is installed, and CrackLib won't be used unless specifically
144 requested via -with-libcrack
145 <para><parameter>-without-libcrack</parameter>: This switch tells
146 <application>Shadow</application> not to use
147 <filename class='libraryfile'>libcrack</filename>. This is desired as
148 <application>Linux-PAM</application> will provide
149 <filename class='libraryfile'>libcrack</filename> functionality.</para>
150 -->
151
152 <para><parameter>--without-selinux</parameter>: Support for selinux is
153 enabled by default, but selinux is not built in a base LFS system. The
154 <command>configure</command> script will fail if this option is not
155 used.</para>
156
157 <para><command>sed -i 's/groups$(EXEEXT) //' src/Makefile</command>: This
158 command is used to suppress the installation of the
159 <command>groups</command> program as the version from the
160 <application>Coreutils</application> package installed during LFS is
161 preferred.</para>
162
163 <para><command>find man -name Makefile -exec ... {} \;</command>: This
164 command is used to suppress the installation of the
165 <command>groups</command> man pages so the existing ones installed from
166 the <application>Coreutils</application> package are not replaced.</para>
167
168 <para><command>sed -i -e '...' -e '...' man/Makefile</command>: This
169 command disables the installation of Chinese and Korean manual pages, since
170 <application>Man-DB</application> cannot format them properly.</para>
171
172 <para><command>convert-mans ...</command>: These commands are used to
173 convert some of the man pages so that <application>Man-DB</application>
174 will display them in the expected encodings.</para>
175
176 <para><command>mv -v /usr/bin/passwd /bin</command>: The
177 <command>passwd</command> program may be needed during times when the
178 <filename class='directory'>/usr</filename> filesystem is not mounted so
179 it is moved into the root partition.</para>
180
181 <para><command>mv -v ...; rm -v ...; ln -v ...</command>: These commands
182 are used to move the <filename class='libraryfile'>libshadow</filename>
183 library to the root partition to support the moving of the
184 <command>passwd</command> program earlier.</para>
185
186 </sect2>
187
188 <sect2 role="configuration">
189 <title>Configuring Linux-PAM to Work with Shadow</title>
190
191 <note>
192 <para>The rest of this page is devoted to configuring
193 <application>Shadow</application> to work properly with
194 <application>Linux-PAM</application>. If you do not have
195 <application>Linux-PAM</application> installed, and you reinstalled
196 <application>Shadow</application> to support strong passwords via
197 the <application>CrackLib</application> library, no further configuration
198 is required.</para>
199 </note>
200
201 <sect3 id="pam.d">
202 <title>Config Files</title>
203
204 <para><filename>/etc/pam.d/*</filename> or alternatively
205 <filename>/etc/pam.conf, /etc/login.defs and
206 /etc/security/*</filename></para>
207
208 <indexterm zone="shadow pam.d">
209 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
210 </indexterm>
211
212 <indexterm zone="shadow pam.d">
213 <primary sortas="e-etc-pam.conf">/etc/pam.conf</primary>
214 </indexterm>
215
216 <indexterm zone="shadow pam.d">
217 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
218 </indexterm>
219
220 <indexterm zone="shadow pam.d">
221 <primary sortas="e-etc-security">/etc/security/*</primary>
222 </indexterm>
223
224 </sect3>
225
226 <sect3>
227 <title>Configuration Information</title>
228
229 <para>Configuring your system to use <application>Linux-PAM</application>
230 can be a complex task. The information below will provide a basic setup
231 so that <application>Shadow</application>'s login and password
232 functionality will work effectively with
233 <application>Linux-PAM</application>. Review the information and links on
234 the <xref linkend="linux-pam"/> page for further configuration
235 information. For information specific to integrating
236 <application>Shadow</application>, <application>Linux-PAM</application>
237 and <application>CrackLib</application>, you can visit the following
238 links:</para>
239
240 <itemizedlist spacing="compact">
241 <listitem>
242 <para><ulink
243 url="http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam-6.html#ss6.3"/></para>
244 </listitem>
245 <listitem>
246 <para><ulink
247 url="http://www.deer-run.com/~hal/sysadmin/pam_cracklib.html"/></para>
248 </listitem>
249 </itemizedlist>
250
251 <sect4 id="pam-login-defs">
252 <title>Configuring /etc/login.defs</title>
253
254 <para>The <command>login</command> program currently performs many
255 functions which <application>Linux-PAM</application> modules should
256 now handle. The following <command>sed</command> command will comment
257 out the appropriate lines in <filename>/etc/login.defs</filename>, and
258 stop <command>login</command> from performing these functions (a backup
259 file named <filename>/etc/login.defs.orig</filename> is also created
260 to preserve the original file's contents). Issue the following commands
261 as the <systemitem class="username">root</systemitem> user:</para>
262
263 <indexterm zone="shadow pam-login-defs">
264 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
265 </indexterm>
266
267<screen role="root"><userinput>install -v -m644 /etc/login.defs /etc/login.defs.orig &amp;&amp;
268for FUNCTION in LASTLOG_ENAB MAIL_CHECK_ENAB \
269 PORTTIME_CHECKS_ENAB CONSOLE \
270 MOTD_FILE NOLOGINS_FILE PASS_MIN_LEN \
271 SU_WHEEL_ONLY MD5_CRYPT_ENAB \
272 CONSOLE_GROUPS ENVIRON_FILE \
273 ULIMIT ENV_TZ ENV_HZ ENV_SUPATH \
274 ENV_PATH QMAIL_DIR MAIL_DIR MAIL_FILE \
275 CHFN_AUTH FAILLOG_ENAB QUOTAS_ENAB FTMP_FILE \
276 OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
277 PASS_CHANGE_TRIES PASS_ALWAYS_WARN ISSUE_FILE
278do
279 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
280done</userinput></screen>
281
282 <!-- Moved the commenting of these four parameters into the section
283 above. If PAM is installed, it complains if these are not commented
284 regardless if CrackLib is installed.
285
286 <para>If you have <application>CrackLib</application> installed,
287 also comment out four more lines using the following command as the
288 <systemitem class="username">root</systemitem> user:</para>
289
290<screen role="root"><userinput>for FUNCTION in OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
291 PASS_CHANGE_TRIES PASS_ALWAYS_WARN
292do
293 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
294done</userinput></screen>
295
296 -->
297
298 </sect4>
299
300 <sect4>
301 <title>Configuring the /etc/pam.d/ Files</title>
302
303 <para>As mentioned previously in the
304 <application>Linux-PAM</application> instructions,
305 <application>Linux-PAM</application> has two supported methods for
306 configuration. The commands below assume that you've chosen to use
307 a directory based configuration, where each program has its own
308 configuration file. You can optionally use a single
309 <filename>/etc/pam.conf</filename> configuration file by using the
310 text from the files below, and supplying the program name as an
311 additional first field for each line.</para>
312
313 <para>As the <systemitem class="username">root</systemitem> user,
314 create the <filename class="directory">/etc/pam.d</filename>
315 directory with the following command:</para>
316
317 <screen role="root"><userinput>install -v -d -m755 /etc/pam.d</userinput></screen>
318
319 <para>While still the <systemitem class="username">root</systemitem>
320 user, add the following <application>Linux-PAM</application>
321 configuration files to the
322 <filename class="directory">/etc/pam.d/</filename> directory (or
323 add the contents to the <filename>/etc/pam.conf</filename> file) with
324 the following commands:</para>
325
326 </sect4>
327
328 <sect4>
329 <title>'login' (with CrackLib)</title>
330
331<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
332<literal># Begin /etc/pam.d/login
333
334auth requisite pam_securetty.so
335auth requisite pam_nologin.so
336auth required pam_unix.so
337account required pam_access.so
338account required pam_unix.so
339session required pam_env.so
340session required pam_motd.so
341session required pam_limits.so
342session optional pam_mail.so dir=/var/mail standard
343session optional pam_lastlog.so
344session required pam_unix.so
345password required pam_cracklib.so retry=3 difok=8 minlen=5 \
346 dcredit=3 ocredit=3 \
347 ucredit=2 lcredit=2
348password required pam_unix.so md5 shadow use_authtok
349
350# End /etc/pam.d/login</literal>
351EOF</userinput></screen>
352
353 </sect4>
354
355 <sect4>
356 <title>'login' (without CrackLib)</title>
357
358<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
359<literal># Begin /etc/pam.d/login
360
361auth requisite pam_securetty.so
362auth requisite pam_nologin.so
363auth required pam_env.so
364auth required pam_unix.so
365account required pam_access.so
366account required pam_unix.so
367session required pam_motd.so
368session required pam_limits.so
369session optional pam_mail.so dir=/var/mail standard
370session optional pam_lastlog.so
371session required pam_unix.so
372password required pam_unix.so md5 shadow
373
374# End /etc/pam.d/login</literal>
375EOF</userinput></screen>
376
377 </sect4>
378
379 <sect4>
380 <title>'passwd' (with CrackLib)</title>
381
382<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
383<literal># Begin /etc/pam.d/passwd
384
385password required pam_cracklib.so retry=3 difok=8 minlen=5 \
386 dcredit=3 ocredit=3 \
387 ucredit=2 lcredit=2
388password required pam_unix.so md5 shadow use_authtok
389
390# End /etc/pam.d/passwd</literal>
391EOF</userinput></screen>
392
393 </sect4>
394
395 <sect4>
396 <title>'passwd' (without CrackLib)</title>
397
398<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
399<literal># Begin /etc/pam.d/passwd
400
401password required pam_unix.so md5 shadow
402
403# End /etc/pam.d/passwd</literal>
404EOF</userinput></screen>
405
406 </sect4>
407
408 <sect4>
409 <title>'su'</title>
410
411<screen role="root"><userinput>cat &gt; /etc/pam.d/su &lt;&lt; "EOF"
412<literal># Begin /etc/pam.d/su
413
414auth sufficient pam_rootok.so
415auth required pam_unix.so
416account required pam_unix.so
417session optional pam_mail.so dir=/var/mail standard
418session required pam_env.so
419session required pam_unix.so
420
421# End /etc/pam.d/su</literal>
422EOF</userinput></screen>
423
424 </sect4>
425
426 <sect4>
427 <title>'chage'</title>
428
429<screen role="root"><userinput>cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"
430<literal># Begin /etc/pam.d/chage
431
432auth sufficient pam_rootok.so
433auth required pam_unix.so
434account required pam_unix.so
435session required pam_unix.so
436password required pam_permit.so
437
438# End /etc/pam.d/chage</literal>
439EOF</userinput></screen>
440
441 </sect4>
442
443 <sect4>
444 <title>'chpasswd', 'newusers', 'groupadd', 'groupdel',
445 'groupmod', 'useradd', 'userdel', and 'usermod'</title>
446
447<screen role="root"><userinput>for PROGRAM in chpasswd newusers groupadd groupdel \
448 groupmod useradd userdel usermod
449do
450 install -v -m644 /etc/pam.d/chage /etc/pam.d/$PROGRAM
451 sed -i "s/chage/$PROGRAM/" /etc/pam.d/$PROGRAM
452done</userinput></screen>
453
454 <warning>
455 <para>At this point, you should do a simple test to see if
456 <application>Shadow</application> is working as expected. Open
457 another terminal and log in as a user, then <command>su</command> to
458 <systemitem class="username">root</systemitem>. If you do not see any
459 errors, then all is well and you should proceed with the rest of the
460 configuration. If you did receive errors, stop now and double check
461 the above configuration files manually. You can also run the test
462 suite from the <application>Linux-PAM</application> package to assist
463 you in determining the problem. If you cannot find and
464 fix the error, you should recompile <application>Shadow</application>
465 replacing <option>--with-libpam</option> with
466 <option>--without-libpam</option> in the above instructions (also move
467 the <filename>/etc/login.defs.orig</filename> backup file to
468 <filename>/etc/login.defs</filename>). If you
469 fail to do this and the errors remain, you will be unable to log into
470 your system.</para>
471 </warning>
472
473 </sect4>
474
475 <sect4>
476 <title>Other</title>
477
478 <para>Currently, <filename>/etc/pam.d/other</filename> is configured
479 to allow anyone with an account on the machine to use PAM-aware
480 programs without a configuration file for that program. After testing
481 <application>Linux-PAM</application> for proper configuration, install
482 a more restrictive <filename>other</filename> file so that
483 program-specific configuration files are required:</para>
484
485<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
486<literal># Begin /etc/pam.d/other
487
488auth required pam_deny.so
489auth required pam_warn.so
490account required pam_deny.so
491session required pam_deny.so
492password required pam_deny.so
493password required pam_warn.so
494
495# End /etc/pam.d/other</literal>
496EOF</userinput></screen>
497
498 <para>If you preserved the source tree from the
499 <application>Linux-PAM</application> package (or you feel like unpacking
500 that tarball, then running <command>configure</command> and
501 <command>make</command>), now would be a good time to run the test
502 suite from this package. This test suite will use the configuration you
503 just finished during the tests. All the tests should pass.</para>
504
505 </sect4>
506
507 <sect4 id="pam-access">
508 <title>Configuring Login Access</title>
509
510 <para>Instead of using the <filename>/etc/login.access</filename>
511 file for controlling access to the system,
512 <application>Linux-PAM</application> uses the
513 <filename class='libraryfile'>pam_access.so</filename> module along
514 with the <filename>/etc/security/access.conf</filename> file. Rename
515 the <filename>/etc/login.access</filename> file using the following
516 command:</para>
517
518 <indexterm zone="shadow pam-access">
519 <primary sortas="e-etc-security-access.conf">/etc/security/access.conf</primary>
520 </indexterm>
521
522<screen role="root"><userinput>if [ -f /etc/login.access ]; then
523 mv -v /etc/login.access /etc/login.access.NOUSE
524fi</userinput></screen>
525
526 </sect4>
527
528 <sect4 id="pam-limits">
529 <title>Configuring Resource Limits</title>
530
531 <para>Instead of using the <filename>/etc/limits</filename> file
532 for limiting usage of system resources,
533 <application>Linux-PAM</application> uses the
534 <filename class='libraryfile'>pam_limits.so</filename> module along
535 with the <filename>/etc/security/limits.conf</filename> file. Rename
536 the <filename>/etc/limits</filename> file using the following
537 command:</para>
538
539 <indexterm zone="shadow pam-limits">
540 <primary sortas="e-etc-security-limits.conf">/etc/security/limits.conf</primary>
541 </indexterm>
542
543<screen role="root"><userinput>if [ -f /etc/limits ]; then
544 mv -v /etc/limits /etc/limits.NOUSE
545fi</userinput></screen>
546
547 </sect4>
548
549 <sect4 id="pam-env">
550 <title>Configuring Default Environment</title>
551
552 <para>During previous configuration, several items were removed from
553 <filename>/etc/login.defs</filename>. Some of these items are now
554 controlled by the <filename class='libraryfile'>pam_env.so</filename>
555 module and the <filename>/etc/security/pam_env.conf</filename>
556 configuration file. In particular, the default path has been
557 changed. To recover your default path, execute the following
558 commands:</para>
559
560<screen role="root"><userinput>ENV_PATH=`grep '^ENV_PATH' /etc/login.defs.orig | \
561 awk '{ print $2 }' | sed 's/PATH=//'` &amp;&amp;
562echo 'PATH DEFAULT='`echo "${ENV_PATH}"`\
563' OVERRIDE=${PATH}' \
564 >> /etc/security/pam_env.conf &amp;&amp;
565unset ENV_PATH</userinput></screen>
566
567 <note>
568 <para>ENV_SUPATH is no longer supported. You must create
569 a valid <filename>/root/.bashrc</filename> file to provide a
570 modified path for the super-user.</para>
571 </note>
572
573 </sect4>
574
575 </sect3>
576
577 </sect2>
578
579 <sect2 role="content">
580 <title>Contents</title>
581
582 <para>A list of the installed files, along with their short descriptions
583 can be found at
584 <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.</para>
585
586 </sect2>
587
588</sect1>
Note: See TracBrowser for help on using the repository browser.