source: postlfs/security/shadow.xml@ 7fb0e285

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 7fb0e285 was 7fb0e285, checked in by DJ Lucas <dj@…>, 19 years ago

Added pam_env.conf default path

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@4900 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 15.5 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY shadow-download-http " ">
8 <!ENTITY shadow-download-ftp "ftp://ftp.pld.org.pl/software/shadow/old/shadow-&shadow-version;.tar.bz2">
9 <!ENTITY shadow-md5sum "66e3a3a60ea6b021a7babff311b07607">
10 <!ENTITY shadow-size "1.1 MB">
11 <!ENTITY shadow-buildsize "13 MB">
12 <!ENTITY shadow-time "0.3 SBU">
13]>
14
15<sect1 id="shadow" xreflabel="Shadow-&shadow-version;">
16 <?dbhtml filename="shadow.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Shadow-&shadow-version;</title>
24
25 <indexterm zone="shadow">
26 <primary sortas="a-Shadow">Shadow</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Shadow</title>
31
32 <para><application>Shadow</application> was indeed installed in LFS and
33 there is no reason to reinstall it unless you installed
34 <application>Linux-PAM</application>. If you did, this will allow programs
35 like <command>login</command> and <command>su</command> to utilize PAM.</para>
36
37 <bridgehead renderas="sect3">Package Information</bridgehead>
38 <itemizedlist spacing="compact">
39 <listitem>
40 <para>Download (HTTP): <ulink url="&shadow-download-http;"/></para>
41 </listitem>
42 <listitem>
43 <para>Download (FTP): <ulink url="&shadow-download-ftp;"/></para>
44 </listitem>
45 <listitem>
46 <para>Download MD5 sum: &shadow-md5sum;</para>
47 </listitem>
48 <listitem>
49 <para>Download size: &shadow-size;</para>
50 </listitem>
51 <listitem>
52 <para>Estimated disk space required: &shadow-buildsize;</para>
53 </listitem>
54 <listitem>
55 <para>Estimated build time: &shadow-time;</para>
56 </listitem>
57 </itemizedlist>
58
59 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
60 <itemizedlist spacing='compact'>
61 <listitem>
62 <para>Patch to fix several invalid warning messages when used with
63 <application>Linux_PAM</application>: <ulink
64 url="&patch-root;/shadow-&shadow-version;-Linux_PAM_fixes-1.patch"/></para>
65 </listitem>
66 </itemizedlist>
67
68 <bridgehead renderas="sect3">Shadow Dependencies</bridgehead>
69
70 <bridgehead renderas="sect4">Required</bridgehead>
71 <para><xref linkend="Linux_PAM"/></para>
72
73 </sect2>
74
75 <sect2 role="installation">
76 <title>Installation of Shadow</title>
77
78 <para>Reinstall <application>Shadow</application> by running the following
79 commands:</para>
80
81<screen><userinput>patch -Np1 -i ../shadow-&shadow-version;-Linux_PAM_fixes-1.patch &amp;&amp;
82./configure --libdir=/lib --enable-shared \
83 --with-libpam --without-libcrack &amp;&amp;
84sed -i 's/groups$(EXEEXT) //' src/Makefile &amp;&amp;
85sed -i '/groups/d' man/Makefile &amp;&amp;
86make</userinput></screen>
87
88 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
89
90<screen role="root"><userinput>make install &amp;&amp;
91mv -v /usr/bin/passwd /bin &amp;&amp;
92mv -v /lib/libshadow.*a /usr/lib &amp;&amp;
93rm -v /lib/libshadow.so &amp;&amp;
94ln -v -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
95
96 </sect2>
97
98 <sect2 role="commands">
99 <title>Command Explanations</title>
100
101 <para><parameter>--without-libcrack</parameter>: This switch tells
102 <application>Shadow</application> not to use
103 <filename class='libraryfile'>libcrack</filename>. This is desired as
104 <application>Linux-PAM</application> already contains
105 <filename class='libraryfile'>libcrack</filename>.</para>
106
107 <para><command>sed -i ...</command>: These commands are used to suppress
108 the installation of the <command>groups</command> program as the version
109 from the <application>Coreutils</application> package installed during
110 LFS is preferred.</para>
111
112 </sect2>
113
114 <sect2 role="configuration">
115 <title>Configuring Linux-PAM to Work with Shadow</title>
116
117 <sect3 id="pam.d">
118 <title>Config Files</title>
119
120 <para><filename>/etc/pam.d/*</filename> or alternatively
121 <filename>/etc/pam.conf, /etc/login.defs and
122 /etc/security/*</filename></para>
123
124 <indexterm zone="shadow pam.d">
125 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
126 </indexterm>
127
128 <indexterm zone="shadow pam.d">
129 <primary sortas="e-etc-pam.conf">/etc/pam.conf</primary>
130 </indexterm>
131
132 <indexterm zone="shadow pam.d">
133 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
134 </indexterm>
135
136 <indexterm zone="shadow pam.d">
137 <primary sortas="e-etc-security">/etc/security/*</primary>
138 </indexterm>
139
140 </sect3>
141
142 <sect3>
143 <title>Configuration Information</title>
144
145 <sect4 id="pam-login-defs">
146 <title>Configuring /etc/login.defs</title>
147
148 <para>The <command>login</command> program currently performs many
149 functions which <application>Linux-PAM</application> modules should
150 now handle. The following <command>sed</command> command will comment
151 out the appropriate lines in <filename>/etc/login.defs</filename>, and
152 stop <command>login</command> from performing these functions (a backup
153 file named <filename>/etc/login.defs.orig</filename> is also created
154 to preserve the original file's contents):</para>
155
156 <indexterm zone="shadow pam-login-defs">
157 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
158 </indexterm>
159
160<screen role="root"><userinput>install -v -m644 /etc/login.defs /etc/login.defs.orig &amp;&amp;
161for FUNCTION in LASTLOG_ENAB MAIL_CHECK_ENAB \
162 PORTTIME_CHECKS_ENAB CONSOLE \
163 MOTD_FILE NOLOGINS_FILE PASS_MIN_LEN \
164 SU_WHEEL_ONLY MD5_CRYPT_ENAB \
165 CONSOLE_GROUPS ENVIRON_FILE \
166 ULIMIT ENV_TZ ENV_HZ ENV_SUPATH \
167 ENV_PATH QMAIL_DIR MAIL_DIR MAIL_FILE \
168 CHFN_AUTH FAILLOG_ENAB QUOTAS_ENAB FTMP_FILE
169do
170 sed -i -e "s/^$FUNCTION/# &amp;/" /etc/login.defs
171done</userinput></screen>
172
173 <para>If you have <application>CrackLib</application> installed,
174 also comment out four more lines using the following command:</para>
175
176<screen role="root"><userinput>for FUNCTION in OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
177 PASS_CHANGE_TRIES PASS_ALWAYS_WARN
178do
179 sed -i -e "s/^$FUNCTION/# &amp;/" /etc/login.defs
180done</userinput></screen>
181
182 </sect4>
183
184 <sect4>
185 <title>Configuring the /etc/pam.d/ Files</title>
186
187 <para>Add the following <application>Linux-PAM</application> configuration
188 files to <filename class="directory">/etc/pam.d/</filename> (or add them
189 to <filename>/etc/pam.conf</filename> with the additional field for
190 the program).</para>
191
192 </sect4>
193
194 <sect4>
195 <title>'login' (with CrackLib)</title>
196
197<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
198<literal># Begin /etc/pam.d/login
199
200auth requisite pam_securetty.so
201auth requisite pam_nologin.so
202auth required pam_unix.so
203account required pam_access.so
204account required pam_unix.so
205session required pam_env.so
206session required pam_motd.so
207session required pam_limits.so
208session optional pam_mail.so dir=/var/mail standard
209session optional pam_lastlog.so
210session required pam_unix.so
211password required pam_cracklib.so retry=3 difok=8 minlen=5 \
212 dcredit=3 ocredit=3 \
213 ucredit=2 lcredit=2
214password required pam_unix.so md5 shadow use_authtok
215
216# End /etc/pam.d/login</literal>
217EOF</userinput></screen>
218
219 </sect4>
220
221 <sect4>
222 <title>'login' (without CrackLib)</title>
223
224<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
225<literal># Begin /etc/pam.d/login
226
227auth requisite pam_securetty.so
228auth requisite pam_nologin.so
229auth required pam_env.so
230auth required pam_unix.so
231account required pam_access.so
232account required pam_unix.so
233session required pam_motd.so
234session required pam_limits.so
235session optional pam_mail.so dir=/var/mail standard
236session optional pam_lastlog.so
237session required pam_unix.so
238password required pam_unix.so md5 shadow
239
240# End /etc/pam.d/login</literal>
241EOF</userinput></screen>
242
243 </sect4>
244
245 <sect4>
246 <title>'passwd' (with CrackLib)</title>
247
248<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
249<literal># Begin /etc/pam.d/passwd
250
251password required pam_cracklib.so retry=3 difok=8 minlen=5 \
252 dcredit=3 ocredit=3 \
253 ucredit=2 lcredit=2
254password required pam_unix.so md5 shadow use_authtok
255
256# End /etc/pam.d/passwd</literal>
257EOF</userinput></screen>
258
259 </sect4>
260
261 <sect4>
262 <title>'passwd' (without CrackLib)</title>
263
264<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
265<literal># Begin /etc/pam.d/passwd
266
267password required pam_unix.so md5 shadow
268
269# End /etc/pam.d/passwd</literal>
270EOF</userinput></screen>
271
272 </sect4>
273
274 <sect4>
275 <title>'su'</title>
276
277<screen role="root"><userinput>cat &gt; /etc/pam.d/su &lt;&lt; "EOF"
278<literal># Begin /etc/pam.d/su
279
280auth sufficient pam_rootok.so
281auth required pam_unix.so
282account required pam_unix.so
283session optional pam_mail.so dir=/var/mail standard
284session required pam_env.so
285session required pam_unix.so
286
287# End /etc/pam.d/su</literal>
288EOF</userinput></screen>
289
290 </sect4>
291
292 <sect4>
293 <title>'chage'</title>
294
295<screen role="root"><userinput>cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"
296<literal># Begin /etc/pam.d/chage
297
298auth sufficient pam_rootok.so
299auth required pam_unix.so
300account required pam_unix.so
301session required pam_unix.so
302password required pam_permit.so
303
304# End /etc/pam.d/chage</literal>
305EOF</userinput></screen>
306
307 </sect4>
308
309 <sect4>
310 <title>'chpasswd', 'newusers', 'groupadd', 'groupdel',
311 'groupmod', 'useradd', 'userdel', and 'usermod'</title>
312
313<screen role="root"><userinput>for PROGRAM in chpasswd newusers groupadd groupdel \
314 groupmod useradd userdel usermod
315do
316 install -v -m644 /etc/pam.d/chage /etc/pam.d/$PROGRAM
317 sed -i -e "s/chage/$PROGRAM/" /etc/pam.d/$PROGRAM
318done</userinput></screen>
319
320 <warning>
321 <para>At this point, you should do a simple test to see if
322 <application>Shadow</application> is working as expected. Open
323 another terminal and log in as a user, then <command>su</command> to
324 <systemitem class="username">root</systemitem>. If you do not see any
325 errors, then all is well and you should proceed with the rest of the
326 configuration. If you did receive errors, stop now and double check
327 the above configuration files manually. If you cannot find and
328 fix the error, you should recompile <application>Shadow</application>
329 replacing <option>--with-libpam</option> with
330 <option>--without-libpam</option> in the above instructions (also move
331 the <filename>/etc/login.defs.orig</filename> backup file to
332 <filename>/etc/login.defs</filename>). If you
333 fail to do this and the errors remain, you will be unable to log into
334 your system.</para>
335 </warning>
336
337 </sect4>
338
339 <sect4>
340 <title>Other</title>
341
342 <para>Currently, <filename>/etc/pam.d/other</filename> is configured
343 to allow anyone with an account on the machine to use PAM-aware
344 programs without a configuration file for that program. After testing
345 <application>Linux-PAM</application> for proper configuration, install
346 a more restrictive <filename>other</filename> file so that
347 program-specific configuration files are required:</para>
348
349<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
350<literal># Begin /etc/pam.d/other
351
352auth required pam_deny.so
353auth required pam_warn.so
354account required pam_deny.so
355session required pam_deny.so
356password required pam_deny.so
357password required pam_warn.so
358
359# End /etc/pam.d/other</literal>
360EOF</userinput></screen>
361
362 </sect4>
363
364 <sect4 id="pam-access">
365 <title>Configuring Login Access</title>
366
367 <para>Instead of using the <filename>/etc/login.access</filename>
368 file for controlling access to the system,
369 <application>Linux-PAM</application> uses the
370 <filename class='libraryfile'>pam_access.so</filename> module along
371 with the <filename>/etc/security/access.conf</filename> file. Rename
372 the <filename>/etc/login.access</filename> file using the following
373 command:</para>
374
375 <indexterm zone="shadow pam-access">
376 <primary sortas="e-etc-security-access.conf">/etc/security/access.conf</primary>
377 </indexterm>
378
379<screen role="root"><userinput>if [ -f /etc/login.access ]; then
380 mv -v /etc/login.access /etc/login.access.NOUSE
381fi</userinput></screen>
382
383 </sect4>
384
385 <sect4 id="pam-limits">
386 <title>Configuring Resource Limits</title>
387
388 <para>Instead of using the <filename>/etc/limits</filename> file
389 for limiting usage of system resources,
390 <application>Linux-PAM</application> uses the
391 <filename class='libraryfile'>pam_limits.so</filename> module along
392 with the <filename>/etc/security/limits.conf</filename> file. Rename
393 the <filename>/etc/limits</filename> file using the following
394 command:</para>
395
396 <indexterm zone="shadow pam-limits">
397 <primary sortas="e-etc-security-limits.conf">/etc/security/limits.conf</primary>
398 </indexterm>
399
400<screen role="root"><userinput>if [ -f /etc/limits ]; then
401 mv -v /etc/limits /etc/limits.NOUSE
402fi</userinput></screen>
403
404 </sect4>
405
406
407 <sect4 id="pam-env">
408 <title>Configuring Default Environment</title>
409
410 <para>In previous configuration, serveral items were removed from
411 <filename>/etc/login.defs</filename>. Some of these items are now
412 controlled by the <filename class='libraryfile'>pam_env.so</filename>
413 module and the <filename>/etc/security/pam_env.conf</filename>
414 configuration file. In particular, the default path has been
415 changed. To recover your default path, execute the following
416 commands:</para>
417
418<screen><userinput><command>ENV_PATH=`grep '^ENV_PATH' /etc/login.defs.orig | \
419 awk '{ print $2 }' | sed 's/PATH=//'` &amp;&amp;
420echo 'PATH DEFAULT='`echo "${ENV_PATH}"`' OVERRIDE=${PATH}' \
421 >> /etc/security/pam_env.conf &amp;&amp;
422unset ENV_PATH</command></userinput></screen>
423
424 <note><para>ENV_SUPATH is no longer supported. You must create
425 a valid <filename>/root/.bashrc</filename> file to provide a
426 modified path for the super user.</para></note>
427
428 </sect4>
429
430 </sect3>
431
432 </sect2>
433
434 <sect2 role="content">
435 <title>Contents</title>
436
437 <para>A list of the installed files, along with their short descriptions
438 can be found at
439 <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.</para>
440
441 </sect2>
442
443</sect1>
Note: See TracBrowser for help on using the repository browser.