source: postlfs/security/shadow.xml@ 90bc173

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 90bc173 was 90bc173, checked in by Randy McMurchy <randy@…>, 18 years ago

Added a missing command (patch installation) to the Shadow instructions

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@5326 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 15.9 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY shadow-download-http "http://ftp.pld.org.pl/software/shadow/shadow-&shadow-version;.tar.bz2">
8 <!ENTITY shadow-download-ftp "ftp://ftp.pld.org.pl/software/shadow/shadow-&shadow-version;.tar.bz2">
9 <!ENTITY shadow-md5sum "5c6a105d89afb0900922260e9c5650cc">
10 <!ENTITY shadow-size "1.0 MB">
11 <!ENTITY shadow-buildsize "13.6 MB">
12 <!ENTITY shadow-time "0.3 SBU">
13]>
14
15<sect1 id="shadow" xreflabel="Shadow-&shadow-version;">
16 <?dbhtml filename="shadow.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Shadow-&shadow-version;</title>
24
25 <indexterm zone="shadow">
26 <primary sortas="a-Shadow">Shadow</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Shadow</title>
31
32 <para><application>Shadow</application> was indeed installed in LFS and
33 there is no reason to reinstall it unless you installed
34 <application>Linux-PAM</application>. If you did install
35 <application>Linux-PAM</application>, reinstalling
36 <application>Shadow</application> will allow programs such as
37 <command>login</command> and <command>su</command> to utilize PAM.</para>
38
39 <bridgehead renderas="sect3">Package Information</bridgehead>
40 <itemizedlist spacing="compact">
41 <listitem>
42 <para>Download (HTTP): <ulink url="&shadow-download-http;"/></para>
43 </listitem>
44 <listitem>
45 <para>Download (FTP): <ulink url="&shadow-download-ftp;"/></para>
46 </listitem>
47 <listitem>
48 <para>Download MD5 sum: &shadow-md5sum;</para>
49 </listitem>
50 <listitem>
51 <para>Download size: &shadow-size;</para>
52 </listitem>
53 <listitem>
54 <para>Estimated disk space required: &shadow-buildsize;</para>
55 </listitem>
56 <listitem>
57 <para>Estimated build time: &shadow-time;</para>
58 </listitem>
59 </itemizedlist>
60
61 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
62 <itemizedlist spacing='compact'>
63 <listitem>
64 <para>Required patch: <ulink
65 url="&patch-root;/shadow-&shadow-version;-configure_fix-1.patch"/></para>
66 </listitem>
67 </itemizedlist>
68
69 <bridgehead renderas="sect3">Shadow Dependencies</bridgehead>
70
71 <bridgehead renderas="sect4">Required</bridgehead>
72 <para><xref linkend="linux-pam"/></para>
73
74 </sect2>
75
76 <sect2 role="installation">
77 <title>Installation of Shadow</title>
78
79 <para>Reinstall <application>Shadow</application> by running the following
80 commands:</para>
81
82<screen><userinput>patch -Np1 -i ../shadow-&shadow-version;-configure_fix-1.patch &amp;&amp;
83./configure --libdir=/lib --enable-shared \
84 --with-libpam --without-libcrack &amp;&amp;
85sed -i 's/groups$(EXEEXT) //' src/Makefile &amp;&amp;
86find man -name Makefile -exec sed -i '/groups/d' &amp;&amp;
87make</userinput></screen>
88
89 <para>This package does not come with a test suite.</para>
90
91 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
92
93<screen role="root"><userinput>make install &amp;&amp;
94mv -v /usr/bin/passwd /bin &amp;&amp;
95mv -v /lib/libshadow.*a /usr/lib &amp;&amp;
96rm -v /lib/libshadow.so &amp;&amp;
97ln -v -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
98
99 </sect2>
100
101 <sect2 role="commands">
102 <title>Command Explanations</title>
103
104 <para><parameter>--without-libcrack</parameter>: This switch tells
105 <application>Shadow</application> not to use
106 <filename class='libraryfile'>libcrack</filename>. This is desired as
107 <application>Linux-PAM</application> will provide
108 <filename class='libraryfile'>libcrack</filename> functionality.</para>
109
110 <para><command>sed -i ...</command>: These commands are used to suppress
111 the installation of the <command>groups</command> program and man pages
112 as the version from the <application>Coreutils</application> package
113 installed during LFS is preferred.</para>
114
115 </sect2>
116
117 <sect2 role="configuration">
118 <title>Configuring Linux-PAM to Work with Shadow</title>
119
120 <sect3 id="pam.d">
121 <title>Config Files</title>
122
123 <para><filename>/etc/pam.d/*</filename> or alternatively
124 <filename>/etc/pam.conf, /etc/login.defs and
125 /etc/security/*</filename></para>
126
127 <indexterm zone="shadow pam.d">
128 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
129 </indexterm>
130
131 <indexterm zone="shadow pam.d">
132 <primary sortas="e-etc-pam.conf">/etc/pam.conf</primary>
133 </indexterm>
134
135 <indexterm zone="shadow pam.d">
136 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
137 </indexterm>
138
139 <indexterm zone="shadow pam.d">
140 <primary sortas="e-etc-security">/etc/security/*</primary>
141 </indexterm>
142
143 </sect3>
144
145 <sect3>
146 <title>Configuration Information</title>
147
148 <sect4 id="pam-login-defs">
149 <title>Configuring /etc/login.defs</title>
150
151 <para>The <command>login</command> program currently performs many
152 functions which <application>Linux-PAM</application> modules should
153 now handle. The following <command>sed</command> command will comment
154 out the appropriate lines in <filename>/etc/login.defs</filename>, and
155 stop <command>login</command> from performing these functions (a backup
156 file named <filename>/etc/login.defs.orig</filename> is also created
157 to preserve the original file's contents). Issue the following commands
158 as the <systemitem class="username">root</systemitem> user:</para>
159
160 <indexterm zone="shadow pam-login-defs">
161 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
162 </indexterm>
163
164<screen role="root"><userinput>install -v -m644 /etc/login.defs /etc/login.defs.orig &amp;&amp;
165for FUNCTION in LASTLOG_ENAB MAIL_CHECK_ENAB \
166 PORTTIME_CHECKS_ENAB CONSOLE \
167 MOTD_FILE NOLOGINS_FILE PASS_MIN_LEN \
168 SU_WHEEL_ONLY MD5_CRYPT_ENAB \
169 CONSOLE_GROUPS ENVIRON_FILE \
170 ULIMIT ENV_TZ ENV_HZ ENV_SUPATH \
171 ENV_PATH QMAIL_DIR MAIL_DIR MAIL_FILE \
172 CHFN_AUTH FAILLOG_ENAB QUOTAS_ENAB FTMP_FILE
173do
174 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
175done</userinput></screen>
176
177 <para>If you have <application>CrackLib</application> installed,
178 also comment out four more lines using the following command as the
179 <systemitem class="username">root</systemitem> user:</para>
180
181<screen role="root"><userinput>for FUNCTION in OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
182 PASS_CHANGE_TRIES PASS_ALWAYS_WARN
183do
184 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
185done</userinput></screen>
186
187 </sect4>
188
189 <sect4>
190 <title>Configuring the /etc/pam.d/ Files</title>
191
192 <para>Add the following <application>Linux-PAM</application> configuration
193 files to <filename class="directory">/etc/pam.d/</filename> (or add them
194 to <filename>/etc/pam.conf</filename> with the additional field for
195 the program). Issue the commands as the
196 <systemitem class="username">root</systemitem> user:</para>
197
198 </sect4>
199
200 <sect4>
201 <title>'login' (with CrackLib)</title>
202
203<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
204<literal># Begin /etc/pam.d/login
205
206auth requisite pam_securetty.so
207auth requisite pam_nologin.so
208auth required pam_unix.so
209account required pam_access.so
210account required pam_unix.so
211session required pam_env.so
212session required pam_motd.so
213session required pam_limits.so
214session optional pam_mail.so dir=/var/mail standard
215session optional pam_lastlog.so
216session required pam_unix.so
217password required pam_cracklib.so retry=3 difok=8 minlen=5 \
218 dcredit=3 ocredit=3 \
219 ucredit=2 lcredit=2
220password required pam_unix.so md5 shadow use_authtok
221
222# End /etc/pam.d/login</literal>
223EOF</userinput></screen>
224
225 </sect4>
226
227 <sect4>
228 <title>'login' (without CrackLib)</title>
229
230<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
231<literal># Begin /etc/pam.d/login
232
233auth requisite pam_securetty.so
234auth requisite pam_nologin.so
235auth required pam_env.so
236auth required pam_unix.so
237account required pam_access.so
238account required pam_unix.so
239session required pam_motd.so
240session required pam_limits.so
241session optional pam_mail.so dir=/var/mail standard
242session optional pam_lastlog.so
243session required pam_unix.so
244password required pam_unix.so md5 shadow
245
246# End /etc/pam.d/login</literal>
247EOF</userinput></screen>
248
249 </sect4>
250
251 <sect4>
252 <title>'passwd' (with CrackLib)</title>
253
254<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
255<literal># Begin /etc/pam.d/passwd
256
257password required pam_cracklib.so retry=3 difok=8 minlen=5 \
258 dcredit=3 ocredit=3 \
259 ucredit=2 lcredit=2
260password required pam_unix.so md5 shadow use_authtok
261
262# End /etc/pam.d/passwd</literal>
263EOF</userinput></screen>
264
265 </sect4>
266
267 <sect4>
268 <title>'passwd' (without CrackLib)</title>
269
270<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
271<literal># Begin /etc/pam.d/passwd
272
273password required pam_unix.so md5 shadow
274
275# End /etc/pam.d/passwd</literal>
276EOF</userinput></screen>
277
278 </sect4>
279
280 <sect4>
281 <title>'su'</title>
282
283<screen role="root"><userinput>cat &gt; /etc/pam.d/su &lt;&lt; "EOF"
284<literal># Begin /etc/pam.d/su
285
286auth sufficient pam_rootok.so
287auth required pam_unix.so
288account required pam_unix.so
289session optional pam_mail.so dir=/var/mail standard
290session required pam_env.so
291session required pam_unix.so
292
293# End /etc/pam.d/su</literal>
294EOF</userinput></screen>
295
296 </sect4>
297
298 <sect4>
299 <title>'chage'</title>
300
301<screen role="root"><userinput>cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"
302<literal># Begin /etc/pam.d/chage
303
304auth sufficient pam_rootok.so
305auth required pam_unix.so
306account required pam_unix.so
307session required pam_unix.so
308password required pam_permit.so
309
310# End /etc/pam.d/chage</literal>
311EOF</userinput></screen>
312
313 </sect4>
314
315 <sect4>
316 <title>'chpasswd', 'newusers', 'groupadd', 'groupdel',
317 'groupmod', 'useradd', 'userdel', and 'usermod'</title>
318
319<screen role="root"><userinput>for PROGRAM in chpasswd newusers groupadd groupdel \
320 groupmod useradd userdel usermod
321do
322 install -v -m644 /etc/pam.d/chage /etc/pam.d/$PROGRAM
323 sed -i "s/chage/$PROGRAM/" /etc/pam.d/$PROGRAM
324done</userinput></screen>
325
326 <warning>
327 <para>At this point, you should do a simple test to see if
328 <application>Shadow</application> is working as expected. Open
329 another terminal and log in as a user, then <command>su</command> to
330 <systemitem class="username">root</systemitem>. If you do not see any
331 errors, then all is well and you should proceed with the rest of the
332 configuration. If you did receive errors, stop now and double check
333 the above configuration files manually. If you cannot find and
334 fix the error, you should recompile <application>Shadow</application>
335 replacing <option>--with-libpam</option> with
336 <option>--without-libpam</option> in the above instructions (also move
337 the <filename>/etc/login.defs.orig</filename> backup file to
338 <filename>/etc/login.defs</filename>). If you
339 fail to do this and the errors remain, you will be unable to log into
340 your system.</para>
341 </warning>
342
343 </sect4>
344
345 <sect4>
346 <title>Other</title>
347
348 <para>Currently, <filename>/etc/pam.d/other</filename> is configured
349 to allow anyone with an account on the machine to use PAM-aware
350 programs without a configuration file for that program. After testing
351 <application>Linux-PAM</application> for proper configuration, install
352 a more restrictive <filename>other</filename> file so that
353 program-specific configuration files are required:</para>
354
355<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
356<literal># Begin /etc/pam.d/other
357
358auth required pam_deny.so
359auth required pam_warn.so
360account required pam_deny.so
361session required pam_deny.so
362password required pam_deny.so
363password required pam_warn.so
364
365# End /etc/pam.d/other</literal>
366EOF</userinput></screen>
367
368 </sect4>
369
370 <sect4 id="pam-access">
371 <title>Configuring Login Access</title>
372
373 <para>Instead of using the <filename>/etc/login.access</filename>
374 file for controlling access to the system,
375 <application>Linux-PAM</application> uses the
376 <filename class='libraryfile'>pam_access.so</filename> module along
377 with the <filename>/etc/security/access.conf</filename> file. Rename
378 the <filename>/etc/login.access</filename> file using the following
379 command:</para>
380
381 <indexterm zone="shadow pam-access">
382 <primary sortas="e-etc-security-access.conf">/etc/security/access.conf</primary>
383 </indexterm>
384
385<screen role="root"><userinput>if [ -f /etc/login.access ]; then
386 mv -v /etc/login.access /etc/login.access.NOUSE
387fi</userinput></screen>
388
389 </sect4>
390
391 <sect4 id="pam-limits">
392 <title>Configuring Resource Limits</title>
393
394 <para>Instead of using the <filename>/etc/limits</filename> file
395 for limiting usage of system resources,
396 <application>Linux-PAM</application> uses the
397 <filename class='libraryfile'>pam_limits.so</filename> module along
398 with the <filename>/etc/security/limits.conf</filename> file. Rename
399 the <filename>/etc/limits</filename> file using the following
400 command:</para>
401
402 <indexterm zone="shadow pam-limits">
403 <primary sortas="e-etc-security-limits.conf">/etc/security/limits.conf</primary>
404 </indexterm>
405
406<screen role="root"><userinput>if [ -f /etc/limits ]; then
407 mv -v /etc/limits /etc/limits.NOUSE
408fi</userinput></screen>
409
410 </sect4>
411
412 <sect4 id="pam-env">
413 <title>Configuring Default Environment</title>
414
415 <para>During previous configuration, several items were removed from
416 <filename>/etc/login.defs</filename>. Some of these items are now
417 controlled by the <filename class='libraryfile'>pam_env.so</filename>
418 module and the <filename>/etc/security/pam_env.conf</filename>
419 configuration file. In particular, the default path has been
420 changed. To recover your default path, execute the following
421 commands:</para>
422
423<screen role="root"><userinput>ENV_PATH=`grep '^ENV_PATH' /etc/login.defs.orig | \
424 awk '{ print $2 }' | sed 's/PATH=//'` &amp;&amp;
425echo 'PATH DEFAULT='`echo "${ENV_PATH}"`\
426' OVERRIDE=${PATH}' \
427 >> /etc/security/pam_env.conf &amp;&amp;
428unset ENV_PATH</userinput></screen>
429
430 <note>
431 <para>ENV_SUPATH is no longer supported. You must create
432 a valid <filename>/root/.bashrc</filename> file to provide a
433 modified path for the super-user.</para>
434 </note>
435
436 </sect4>
437
438 </sect3>
439
440 </sect2>
441
442 <sect2 role="content">
443 <title>Contents</title>
444
445 <para>A list of the installed files, along with their short descriptions
446 can be found at
447 <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.</para>
448
449 </sect2>
450
451</sect1>
Note: See TracBrowser for help on using the repository browser.