source: postlfs/security/shadow.xml@ 980ef86b

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 980ef86b was 980ef86b, checked in by Randy McMurchy <randy@…>, 19 years ago

Updated to Shadow-4.0.12

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@5002 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 15.9 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY shadow-download-http "http://ftp.pld.org.pl/software/shadow/shadow-&shadow-version;.tar.bz2">
8 <!ENTITY shadow-download-ftp "ftp://ftp.pld.org.pl/software/shadow/shadow-&shadow-version;.tar.bz2">
9 <!ENTITY shadow-md5sum "609a417a45827c36ba6e33f9dc785371">
10 <!ENTITY shadow-size "1.0 MB">
11 <!ENTITY shadow-buildsize "13.4 MB">
12 <!ENTITY shadow-time "0.3 SBU">
13]>
14
15<sect1 id="shadow" xreflabel="Shadow-&shadow-version;">
16 <?dbhtml filename="shadow.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Shadow-&shadow-version;</title>
24
25 <indexterm zone="shadow">
26 <primary sortas="a-Shadow">Shadow</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Shadow</title>
31
32 <para><application>Shadow</application> was indeed installed in LFS and
33 there is no reason to reinstall it unless you installed
34 <application>Linux-PAM</application>. If you did, this will allow programs
35 like <command>login</command> and <command>su</command> to utilize
36 PAM.</para>
37
38 <bridgehead renderas="sect3">Package Information</bridgehead>
39 <itemizedlist spacing="compact">
40 <listitem>
41 <para>Download (HTTP): <ulink url="&shadow-download-http;"/></para>
42 </listitem>
43 <listitem>
44 <para>Download (FTP): <ulink url="&shadow-download-ftp;"/></para>
45 </listitem>
46 <listitem>
47 <para>Download MD5 sum: &shadow-md5sum;</para>
48 </listitem>
49 <listitem>
50 <para>Download size: &shadow-size;</para>
51 </listitem>
52 <listitem>
53 <para>Estimated disk space required: &shadow-buildsize;</para>
54 </listitem>
55 <listitem>
56 <para>Estimated build time: &shadow-time;</para>
57 </listitem>
58 </itemizedlist>
59
60<!--
61 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
62 <itemizedlist spacing='compact'>
63 <listitem>
64 <para>Patch to fix several invalid warning messages when used with
65 <application>Linux_PAM</application>: <ulink
66 url="&patch-root;/shadow-&shadow-version;-Linux_PAM_fixes-1.patch"/></para>
67 </listitem>
68 </itemizedlist>
69-->
70
71 <bridgehead renderas="sect3">Shadow Dependencies</bridgehead>
72
73 <bridgehead renderas="sect4">Required</bridgehead>
74 <para><xref linkend="Linux_PAM"/></para>
75
76 </sect2>
77
78 <sect2 role="installation">
79 <title>Installation of Shadow</title>
80
81 <para>Reinstall <application>Shadow</application> by running the following
82 commands:</para>
83
84<!--
85<screen><userinput>patch -Np1 -i ../shadow-&shadow-version;-Linux_PAM_fixes-1.patch &amp;&amp;
86<-->
87
88<screen><userinput>./configure --libdir=/lib --enable-shared \
89 --with-libpam --without-libcrack &amp;&amp;
90sed -i 's/groups$(EXEEXT) //' src/Makefile &amp;&amp;
91sed -i '/groups/d' man/Makefile &amp;&amp;
92make</userinput></screen>
93
94 <para>This package does not come with a test suite.</para>
95
96 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
97
98<screen role="root"><userinput>make install &amp;&amp;
99mv -v /usr/bin/passwd /bin &amp;&amp;
100mv -v /lib/libshadow.*a /usr/lib &amp;&amp;
101rm -v /lib/libshadow.so &amp;&amp;
102ln -v -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
103
104 </sect2>
105
106 <sect2 role="commands">
107 <title>Command Explanations</title>
108
109 <para><parameter>--without-libcrack</parameter>: This switch tells
110 <application>Shadow</application> not to use
111 <filename class='libraryfile'>libcrack</filename>. This is desired as
112 <application>Linux-PAM</application> already contains
113 <filename class='libraryfile'>libcrack</filename>.</para>
114
115 <para><parameter>--enable-shadowgrp</parameter>: This version of
116 <application>Shadow</application> defaults to not enabling
117 its group functionality, which causes <command>grpconv</command> to
118 fail.</para>
119
120 <para><command>sed -i ...</command>: These commands are used to suppress
121 the installation of the <command>groups</command> program as the version
122 from the <application>Coreutils</application> package installed during
123 LFS is preferred.</para>
124
125 </sect2>
126
127 <sect2 role="configuration">
128 <title>Configuring Linux-PAM to Work with Shadow</title>
129
130 <sect3 id="pam.d">
131 <title>Config Files</title>
132
133 <para><filename>/etc/pam.d/*</filename> or alternatively
134 <filename>/etc/pam.conf, /etc/login.defs and
135 /etc/security/*</filename></para>
136
137 <indexterm zone="shadow pam.d">
138 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
139 </indexterm>
140
141 <indexterm zone="shadow pam.d">
142 <primary sortas="e-etc-pam.conf">/etc/pam.conf</primary>
143 </indexterm>
144
145 <indexterm zone="shadow pam.d">
146 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
147 </indexterm>
148
149 <indexterm zone="shadow pam.d">
150 <primary sortas="e-etc-security">/etc/security/*</primary>
151 </indexterm>
152
153 </sect3>
154
155 <sect3>
156 <title>Configuration Information</title>
157
158 <sect4 id="pam-login-defs">
159 <title>Configuring /etc/login.defs</title>
160
161 <para>The <command>login</command> program currently performs many
162 functions which <application>Linux-PAM</application> modules should
163 now handle. The following <command>sed</command> command will comment
164 out the appropriate lines in <filename>/etc/login.defs</filename>, and
165 stop <command>login</command> from performing these functions (a backup
166 file named <filename>/etc/login.defs.orig</filename> is also created
167 to preserve the original file's contents):</para>
168
169 <indexterm zone="shadow pam-login-defs">
170 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
171 </indexterm>
172
173<screen role="root"><userinput>install -v -m644 /etc/login.defs /etc/login.defs.orig &amp;&amp;
174for FUNCTION in LASTLOG_ENAB MAIL_CHECK_ENAB \
175 PORTTIME_CHECKS_ENAB CONSOLE \
176 MOTD_FILE NOLOGINS_FILE PASS_MIN_LEN \
177 SU_WHEEL_ONLY MD5_CRYPT_ENAB \
178 CONSOLE_GROUPS ENVIRON_FILE \
179 ULIMIT ENV_TZ ENV_HZ ENV_SUPATH \
180 ENV_PATH QMAIL_DIR MAIL_DIR MAIL_FILE \
181 CHFN_AUTH FAILLOG_ENAB QUOTAS_ENAB FTMP_FILE
182do
183 sed -i -e "s/^$FUNCTION/# &amp;/" /etc/login.defs
184done</userinput></screen>
185
186 <para>If you have <application>CrackLib</application> installed,
187 also comment out four more lines using the following command:</para>
188
189<screen role="root"><userinput>for FUNCTION in OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
190 PASS_CHANGE_TRIES PASS_ALWAYS_WARN
191do
192 sed -i -e "s/^$FUNCTION/# &amp;/" /etc/login.defs
193done</userinput></screen>
194
195 </sect4>
196
197 <sect4>
198 <title>Configuring the /etc/pam.d/ Files</title>
199
200 <para>Add the following <application>Linux-PAM</application> configuration
201 files to <filename class="directory">/etc/pam.d/</filename> (or add them
202 to <filename>/etc/pam.conf</filename> with the additional field for
203 the program).</para>
204
205 </sect4>
206
207 <sect4>
208 <title>'login' (with CrackLib)</title>
209
210<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
211<literal># Begin /etc/pam.d/login
212
213auth requisite pam_securetty.so
214auth requisite pam_nologin.so
215auth required pam_unix.so
216account required pam_access.so
217account required pam_unix.so
218session required pam_env.so
219session required pam_motd.so
220session required pam_limits.so
221session optional pam_mail.so dir=/var/mail standard
222session optional pam_lastlog.so
223session required pam_unix.so
224password required pam_cracklib.so retry=3 difok=8 minlen=5 \
225 dcredit=3 ocredit=3 \
226 ucredit=2 lcredit=2
227password required pam_unix.so md5 shadow use_authtok
228
229# End /etc/pam.d/login</literal>
230EOF</userinput></screen>
231
232 </sect4>
233
234 <sect4>
235 <title>'login' (without CrackLib)</title>
236
237<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
238<literal># Begin /etc/pam.d/login
239
240auth requisite pam_securetty.so
241auth requisite pam_nologin.so
242auth required pam_env.so
243auth required pam_unix.so
244account required pam_access.so
245account required pam_unix.so
246session required pam_motd.so
247session required pam_limits.so
248session optional pam_mail.so dir=/var/mail standard
249session optional pam_lastlog.so
250session required pam_unix.so
251password required pam_unix.so md5 shadow
252
253# End /etc/pam.d/login</literal>
254EOF</userinput></screen>
255
256 </sect4>
257
258 <sect4>
259 <title>'passwd' (with CrackLib)</title>
260
261<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
262<literal># Begin /etc/pam.d/passwd
263
264password required pam_cracklib.so retry=3 difok=8 minlen=5 \
265 dcredit=3 ocredit=3 \
266 ucredit=2 lcredit=2
267password required pam_unix.so md5 shadow use_authtok
268
269# End /etc/pam.d/passwd</literal>
270EOF</userinput></screen>
271
272 </sect4>
273
274 <sect4>
275 <title>'passwd' (without CrackLib)</title>
276
277<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
278<literal># Begin /etc/pam.d/passwd
279
280password required pam_unix.so md5 shadow
281
282# End /etc/pam.d/passwd</literal>
283EOF</userinput></screen>
284
285 </sect4>
286
287 <sect4>
288 <title>'su'</title>
289
290<screen role="root"><userinput>cat &gt; /etc/pam.d/su &lt;&lt; "EOF"
291<literal># Begin /etc/pam.d/su
292
293auth sufficient pam_rootok.so
294auth required pam_unix.so
295account required pam_unix.so
296session optional pam_mail.so dir=/var/mail standard
297session required pam_env.so
298session required pam_unix.so
299
300# End /etc/pam.d/su</literal>
301EOF</userinput></screen>
302
303 </sect4>
304
305 <sect4>
306 <title>'chage'</title>
307
308<screen role="root"><userinput>cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"
309<literal># Begin /etc/pam.d/chage
310
311auth sufficient pam_rootok.so
312auth required pam_unix.so
313account required pam_unix.so
314session required pam_unix.so
315password required pam_permit.so
316
317# End /etc/pam.d/chage</literal>
318EOF</userinput></screen>
319
320 </sect4>
321
322 <sect4>
323 <title>'chpasswd', 'newusers', 'groupadd', 'groupdel',
324 'groupmod', 'useradd', 'userdel', and 'usermod'</title>
325
326<screen role="root"><userinput>for PROGRAM in chpasswd newusers groupadd groupdel \
327 groupmod useradd userdel usermod
328do
329 install -v -m644 /etc/pam.d/chage /etc/pam.d/$PROGRAM
330 sed -i -e "s/chage/$PROGRAM/" /etc/pam.d/$PROGRAM
331done</userinput></screen>
332
333 <warning>
334 <para>At this point, you should do a simple test to see if
335 <application>Shadow</application> is working as expected. Open
336 another terminal and log in as a user, then <command>su</command> to
337 <systemitem class="username">root</systemitem>. If you do not see any
338 errors, then all is well and you should proceed with the rest of the
339 configuration. If you did receive errors, stop now and double check
340 the above configuration files manually. If you cannot find and
341 fix the error, you should recompile <application>Shadow</application>
342 replacing <option>--with-libpam</option> with
343 <option>--without-libpam</option> in the above instructions (also move
344 the <filename>/etc/login.defs.orig</filename> backup file to
345 <filename>/etc/login.defs</filename>). If you
346 fail to do this and the errors remain, you will be unable to log into
347 your system.</para>
348 </warning>
349
350 </sect4>
351
352 <sect4>
353 <title>Other</title>
354
355 <para>Currently, <filename>/etc/pam.d/other</filename> is configured
356 to allow anyone with an account on the machine to use PAM-aware
357 programs without a configuration file for that program. After testing
358 <application>Linux-PAM</application> for proper configuration, install
359 a more restrictive <filename>other</filename> file so that
360 program-specific configuration files are required:</para>
361
362<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
363<literal># Begin /etc/pam.d/other
364
365auth required pam_deny.so
366auth required pam_warn.so
367account required pam_deny.so
368session required pam_deny.so
369password required pam_deny.so
370password required pam_warn.so
371
372# End /etc/pam.d/other</literal>
373EOF</userinput></screen>
374
375 </sect4>
376
377 <sect4 id="pam-access">
378 <title>Configuring Login Access</title>
379
380 <para>Instead of using the <filename>/etc/login.access</filename>
381 file for controlling access to the system,
382 <application>Linux-PAM</application> uses the
383 <filename class='libraryfile'>pam_access.so</filename> module along
384 with the <filename>/etc/security/access.conf</filename> file. Rename
385 the <filename>/etc/login.access</filename> file using the following
386 command:</para>
387
388 <indexterm zone="shadow pam-access">
389 <primary sortas="e-etc-security-access.conf">/etc/security/access.conf</primary>
390 </indexterm>
391
392<screen role="root"><userinput>if [ -f /etc/login.access ]; then
393 mv -v /etc/login.access /etc/login.access.NOUSE
394fi</userinput></screen>
395
396 </sect4>
397
398 <sect4 id="pam-limits">
399 <title>Configuring Resource Limits</title>
400
401 <para>Instead of using the <filename>/etc/limits</filename> file
402 for limiting usage of system resources,
403 <application>Linux-PAM</application> uses the
404 <filename class='libraryfile'>pam_limits.so</filename> module along
405 with the <filename>/etc/security/limits.conf</filename> file. Rename
406 the <filename>/etc/limits</filename> file using the following
407 command:</para>
408
409 <indexterm zone="shadow pam-limits">
410 <primary sortas="e-etc-security-limits.conf">/etc/security/limits.conf</primary>
411 </indexterm>
412
413<screen role="root"><userinput>if [ -f /etc/limits ]; then
414 mv -v /etc/limits /etc/limits.NOUSE
415fi</userinput></screen>
416
417 </sect4>
418
419
420 <sect4 id="pam-env">
421 <title>Configuring Default Environment</title>
422
423 <para>During previous configuration, several items were removed from
424 <filename>/etc/login.defs</filename>. Some of these items are now
425 controlled by the <filename class='libraryfile'>pam_env.so</filename>
426 module and the <filename>/etc/security/pam_env.conf</filename>
427 configuration file. In particular, the default path has been
428 changed. To recover your default path, execute the following
429 commands:</para>
430
431<screen><userinput><command>ENV_PATH=`grep '^ENV_PATH' /etc/login.defs.orig | \
432 awk '{ print $2 }' | sed 's/PATH=//'` &amp;&amp;
433echo 'PATH DEFAULT='`echo "${ENV_PATH}"`' OVERRIDE=${PATH}' \
434 >> /etc/security/pam_env.conf &amp;&amp;
435unset ENV_PATH</command></userinput></screen>
436
437 <note><para>ENV_SUPATH is no longer supported. You must create
438 a valid <filename>/root/.bashrc</filename> file to provide a
439 modified path for the super-user.</para></note>
440
441 </sect4>
442
443 </sect3>
444
445 </sect2>
446
447 <sect2 role="content">
448 <title>Contents</title>
449
450 <para>A list of the installed files, along with their short descriptions
451 can be found at
452 <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.</para>
453
454 </sect2>
455
456</sect1>
Note: See TracBrowser for help on using the repository browser.