source: postlfs/security/shadow.xml@ 98fa7cc0

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 98fa7cc0 was 98fa7cc0, checked in by Randy McMurchy <randy@…>, 18 years ago

Minor modification to the description of the convert-mans program, suggested by Alexander Patrakov

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@5783 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 20.9 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY shadow-download-http "http://ftp.pld.org.pl/software/shadow/shadow-&shadow-version;.tar.bz2">
8 <!ENTITY shadow-download-ftp "ftp://ftp.pld.org.pl/software/shadow/shadow-&shadow-version;.tar.bz2">
9 <!ENTITY shadow-md5sum "a0452fa989f8ba45023cc5a08136568e">
10 <!ENTITY shadow-size "1.2 MB">
11 <!ENTITY shadow-buildsize "15.5 MB">
12 <!ENTITY shadow-time "0.3 SBU">
13]>
14
15<sect1 id="shadow" xreflabel="Shadow-&shadow-version;">
16 <?dbhtml filename="shadow.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 <keywordset>
22 <keyword role="package">shadow-&shadow-version;.tar</keyword>
23 <keyword role="ftpdir">shadow</keyword>
24 </keywordset>
25 </sect1info>
26
27 <title>Shadow-&shadow-version;</title>
28
29 <indexterm zone="shadow">
30 <primary sortas="a-Shadow">Shadow</primary>
31 </indexterm>
32
33 <sect2 role="package">
34 <title>Introduction to Shadow</title>
35
36 <para><application>Shadow</application> was indeed installed in LFS and
37 there is no reason to reinstall it unless you installed
38 <application>CrackLib</application> or
39 <application>Linux-PAM</application> after your LFS system was completed.
40 If you have installed <application>CrackLib</application> after LFS, then
41 reinstalling <application>Shadow</application> will enable strong password
42 support. If you have installed <application>Linux-PAM</application>,
43 reinstalling <application>Shadow</application> will allow programs such as
44 <command>login</command> and <command>su</command> to utilize PAM.</para>
45
46 <bridgehead renderas="sect3">Package Information</bridgehead>
47 <itemizedlist spacing="compact">
48 <listitem>
49 <para>Download (HTTP): <ulink url="&shadow-download-http;"/></para>
50 </listitem>
51 <listitem>
52 <para>Download (FTP): <ulink url="&shadow-download-ftp;"/></para>
53 </listitem>
54 <listitem>
55 <para>Download MD5 sum: &shadow-md5sum;</para>
56 </listitem>
57 <listitem>
58 <para>Download size: &shadow-size;</para>
59 </listitem>
60 <listitem>
61 <para>Estimated disk space required: &shadow-buildsize;</para>
62 </listitem>
63 <listitem>
64 <para>Estimated build time: &shadow-time;</para>
65 </listitem>
66 </itemizedlist>
67
68 <!--
69 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
70 <itemizedlist spacing='compact'>
71 <listitem>
72 <para>Required patch: <ulink
73 url="&patch-root;/shadow-&shadow-version;-configure_fix-1.patch"/></para>
74 </listitem>
75 </itemizedlist>
76 -->
77
78 <bridgehead renderas="sect3">Shadow Dependencies</bridgehead>
79
80 <bridgehead renderas="sect4">Required</bridgehead>
81 <para role="required"><xref linkend="linux-pam"/> and/or
82 <xref linkend="cracklib"/></para>
83
84 </sect2>
85
86 <sect2 role="installation">
87 <title>Installation of Shadow</title>
88
89 <important>
90 <para>The installation shown below is for a situation where
91 <application>Linux-PAM</application> has been installed (with or
92 without a <application>CrackLib</application> installation) and
93 <application>Shadow</application> is being reinstalled to support the
94 <application>Linux-PAM</application> installation. If you are
95 reinstalling <application>Shadow</application> to provide strong
96 password support via the <application>CrackLib</application> library
97 and you have not installed <application>Linux-PAM</application>, ensure
98 you add the <parameter>--with-libcrack</parameter> parameter to the
99 <command>configure</command> script below.</para>
100 </important>
101
102 <para>Reinstall <application>Shadow</application> by running the following
103 commands:</para>
104
105<screen><userinput>./configure --libdir=/lib \
106 --enable-shared \
107 --without-selinux &amp;&amp;
108sed -i 's/groups$(EXEEXT) //' src/Makefile &amp;&amp;
109find man -name Makefile -exec sed -i '/groups/d' {} \; &amp;&amp;
110sed -i -e 's/ ko//' \
111 -e 's/ zh_CN zh_TW//' \
112 man/Makefile &amp;&amp;
113
114for i in de es fi fr id it pt_BR; do
115 convert-mans UTF-8 ISO-8859-1 man/${i}/*.?
116done &amp;&amp;
117
118for i in cs hu pl; do
119 convert-mans UTF-8 ISO-8859-2 man/${i}/*.?
120done &amp;&amp;
121
122convert-mans UTF-8 EUC-JP man/ja/*.? &amp;&amp;
123convert-mans UTF-8 KOI8-R man/ru/*.? &amp;&amp;
124convert-mans UTF-8 ISO-8859-9 man/tr/*.? &amp;&amp;
125
126make</userinput></screen>
127
128 <para>This package does not come with a test suite.</para>
129
130 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
131
132<screen role="root"><userinput>make install &amp;&amp;
133mv -v /usr/bin/passwd /bin &amp;&amp;
134mv -v /lib/libshadow.*a /usr/lib &amp;&amp;
135rm -v /lib/libshadow.so &amp;&amp;
136ln -v -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
137
138 </sect2>
139
140 <sect2 role="commands">
141 <title>Command Explanations</title>
142
143 <!-- Removed the -with-libpam and -without-libcrack options from the
144 default as these are the defaults. Pam will automatically be picked
145 up if it is installed, and CrackLib won't be used unless specifically
146 requested via -with-libcrack
147 <para><parameter>-without-libcrack</parameter>: This switch tells
148 <application>Shadow</application> not to use
149 <filename class='libraryfile'>libcrack</filename>. This is desired as
150 <application>Linux-PAM</application> will provide
151 <filename class='libraryfile'>libcrack</filename> functionality.</para>
152 -->
153
154 <para><parameter>--without-selinux</parameter>: Support for selinux is
155 enabled by default, but selinux is not built in a base LFS system. The
156 <command>configure</command> script will fail if this option is not
157 used.</para>
158
159 <para><command>sed -i 's/groups$(EXEEXT) //' src/Makefile</command>: This
160 command is used to suppress the installation of the
161 <command>groups</command> program as the version from the
162 <application>Coreutils</application> package installed during LFS is
163 preferred.</para>
164
165 <para><command>find man -name Makefile -exec ... {} \;</command>: This
166 command is used to suppress the installation of the
167 <command>groups</command> man pages so the existing ones installed from
168 the <application>Coreutils</application> package are not replaced.</para>
169
170 <para><command>sed -i -e '...' -e '...' man/Makefile</command>: This
171 command disables the installation of Chinese and Korean manual pages, since
172 <application>Man-DB</application> cannot format them properly.</para>
173
174 <para><command>convert-mans ...</command>: These commands are used to
175 convert some of the man pages so that <application>Man-DB</application>
176 will display them in the expected encodings.</para>
177
178 <para><command>mv -v /usr/bin/passwd /bin</command>: The
179 <command>passwd</command> program may be needed during times when the
180 <filename class='directory'>/usr</filename> filesystem is not mounted so
181 it is moved into the root partition.</para>
182
183 <para><command>mv -v ...; rm -v ...; ln -v ...</command>: These commands
184 are used to move the <filename class='libraryfile'>libshadow</filename>
185 library to the root partition to support the moving of the
186 <command>passwd</command> program earlier.</para>
187
188 </sect2>
189
190 <sect2 role="configuration">
191 <title>Configuring Linux-PAM to Work with Shadow</title>
192
193 <note>
194 <para>The rest of the page is devoted to configuring
195 <application>Shadow</application> to work properly with
196 <application>Linux-PAM</application>. If you do not have
197 <application>Linux-PAM</application> installed, and you reinstalled
198 <application>Shadow</application> to support strong passwords via
199 the <application>CrackLib</application> library, no further configuration
200 is required.</para>
201 </note>
202
203 <sect3 id="pam.d">
204 <title>Config Files</title>
205
206 <para><filename>/etc/pam.d/*</filename> or alternatively
207 <filename>/etc/pam.conf, /etc/login.defs and
208 /etc/security/*</filename></para>
209
210 <indexterm zone="shadow pam.d">
211 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
212 </indexterm>
213
214 <indexterm zone="shadow pam.d">
215 <primary sortas="e-etc-pam.conf">/etc/pam.conf</primary>
216 </indexterm>
217
218 <indexterm zone="shadow pam.d">
219 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
220 </indexterm>
221
222 <indexterm zone="shadow pam.d">
223 <primary sortas="e-etc-security">/etc/security/*</primary>
224 </indexterm>
225
226 </sect3>
227
228 <sect3>
229 <title>Configuration Information</title>
230
231 <para>Configuring your system to use <application>Linux-PAM</application>
232 can be a complex task. The information below will provide a basic setup
233 so that <application>Shadow</application>'s login and password
234 functionality will work effectively with
235 <application>Linux-PAM</application>. Review the information and links on
236 the <xref linkend="linux-pam"/> page for further configuration
237 information. For information specific to integrating
238 <application>Shadow</application>, <application>Linux-PAM</application>
239 and <application>CrackLib</application>, you can visit the following
240 links:</para>
241
242 <itemizedlist spacing="compact">
243 <listitem>
244 <para><ulink
245 url="http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam-6.html#ss6.3"/></para>
246 </listitem>
247 <listitem>
248 <para><ulink
249 url="http://www.deer-run.com/~hal/sysadmin/pam_cracklib.html"/></para>
250 </listitem>
251 </itemizedlist>
252
253 <sect4 id="pam-login-defs">
254 <title>Configuring /etc/login.defs</title>
255
256 <para>The <command>login</command> program currently performs many
257 functions which <application>Linux-PAM</application> modules should
258 now handle. The following <command>sed</command> command will comment
259 out the appropriate lines in <filename>/etc/login.defs</filename>, and
260 stop <command>login</command> from performing these functions (a backup
261 file named <filename>/etc/login.defs.orig</filename> is also created
262 to preserve the original file's contents). Issue the following commands
263 as the <systemitem class="username">root</systemitem> user:</para>
264
265 <indexterm zone="shadow pam-login-defs">
266 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
267 </indexterm>
268
269<screen role="root"><userinput>install -v -m644 /etc/login.defs /etc/login.defs.orig &amp;&amp;
270for FUNCTION in LASTLOG_ENAB MAIL_CHECK_ENAB \
271 PORTTIME_CHECKS_ENAB CONSOLE \
272 MOTD_FILE NOLOGINS_FILE PASS_MIN_LEN \
273 SU_WHEEL_ONLY MD5_CRYPT_ENAB \
274 CONSOLE_GROUPS ENVIRON_FILE \
275 ULIMIT ENV_TZ ENV_HZ ENV_SUPATH \
276 ENV_PATH QMAIL_DIR MAIL_DIR MAIL_FILE \
277 CHFN_AUTH FAILLOG_ENAB QUOTAS_ENAB FTMP_FILE \
278 OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
279 PASS_CHANGE_TRIES PASS_ALWAYS_WARN
280do
281 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
282done</userinput></screen>
283
284 <!-- Moved the commenting of these four parameters into the section
285 above. If PAM is installed, it complains if these are not commented
286 regardless if CrackLib is installed.
287
288 <para>If you have <application>CrackLib</application> installed,
289 also comment out four more lines using the following command as the
290 <systemitem class="username">root</systemitem> user:</para>
291
292<screen role="root"><userinput>for FUNCTION in OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
293 PASS_CHANGE_TRIES PASS_ALWAYS_WARN
294do
295 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
296done</userinput></screen>
297
298 -->
299
300 </sect4>
301
302 <sect4>
303 <title>Configuring the /etc/pam.d/ Files</title>
304
305 <para>Add the following <application>Linux-PAM</application> configuration
306 files to <filename class="directory">/etc/pam.d/</filename> (or add them
307 to <filename>/etc/pam.conf</filename> with the additional field for
308 the program). Issue the commands as the
309 <systemitem class="username">root</systemitem> user:</para>
310
311 </sect4>
312
313 <sect4>
314 <title>'login' (with CrackLib)</title>
315
316<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
317<literal># Begin /etc/pam.d/login
318
319auth requisite pam_securetty.so
320auth requisite pam_nologin.so
321auth required pam_unix.so
322account required pam_access.so
323account required pam_unix.so
324session required pam_env.so
325session required pam_motd.so
326session required pam_limits.so
327session optional pam_mail.so dir=/var/mail standard
328session optional pam_lastlog.so
329session required pam_unix.so
330password required pam_cracklib.so retry=3 difok=8 minlen=5 \
331 dcredit=3 ocredit=3 \
332 ucredit=2 lcredit=2
333password required pam_unix.so md5 shadow use_authtok
334
335# End /etc/pam.d/login</literal>
336EOF</userinput></screen>
337
338 </sect4>
339
340 <sect4>
341 <title>'login' (without CrackLib)</title>
342
343<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
344<literal># Begin /etc/pam.d/login
345
346auth requisite pam_securetty.so
347auth requisite pam_nologin.so
348auth required pam_env.so
349auth required pam_unix.so
350account required pam_access.so
351account required pam_unix.so
352session required pam_motd.so
353session required pam_limits.so
354session optional pam_mail.so dir=/var/mail standard
355session optional pam_lastlog.so
356session required pam_unix.so
357password required pam_unix.so md5 shadow
358
359# End /etc/pam.d/login</literal>
360EOF</userinput></screen>
361
362 </sect4>
363
364 <sect4>
365 <title>'passwd' (with CrackLib)</title>
366
367<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
368<literal># Begin /etc/pam.d/passwd
369
370password required pam_cracklib.so retry=3 difok=8 minlen=5 \
371 dcredit=3 ocredit=3 \
372 ucredit=2 lcredit=2
373password required pam_unix.so md5 shadow use_authtok
374
375# End /etc/pam.d/passwd</literal>
376EOF</userinput></screen>
377
378 </sect4>
379
380 <sect4>
381 <title>'passwd' (without CrackLib)</title>
382
383<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
384<literal># Begin /etc/pam.d/passwd
385
386password required pam_unix.so md5 shadow
387
388# End /etc/pam.d/passwd</literal>
389EOF</userinput></screen>
390
391 </sect4>
392
393 <sect4>
394 <title>'su'</title>
395
396<screen role="root"><userinput>cat &gt; /etc/pam.d/su &lt;&lt; "EOF"
397<literal># Begin /etc/pam.d/su
398
399auth sufficient pam_rootok.so
400auth required pam_unix.so
401account required pam_unix.so
402session optional pam_mail.so dir=/var/mail standard
403session required pam_env.so
404session required pam_unix.so
405
406# End /etc/pam.d/su</literal>
407EOF</userinput></screen>
408
409 </sect4>
410
411 <sect4>
412 <title>'chage'</title>
413
414<screen role="root"><userinput>cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"
415<literal># Begin /etc/pam.d/chage
416
417auth sufficient pam_rootok.so
418auth required pam_unix.so
419account required pam_unix.so
420session required pam_unix.so
421password required pam_permit.so
422
423# End /etc/pam.d/chage</literal>
424EOF</userinput></screen>
425
426 </sect4>
427
428 <sect4>
429 <title>'chpasswd', 'newusers', 'groupadd', 'groupdel',
430 'groupmod', 'useradd', 'userdel', and 'usermod'</title>
431
432<screen role="root"><userinput>for PROGRAM in chpasswd newusers groupadd groupdel \
433 groupmod useradd userdel usermod
434do
435 install -v -m644 /etc/pam.d/chage /etc/pam.d/$PROGRAM
436 sed -i "s/chage/$PROGRAM/" /etc/pam.d/$PROGRAM
437done</userinput></screen>
438
439 <warning>
440 <para>At this point, you should do a simple test to see if
441 <application>Shadow</application> is working as expected. Open
442 another terminal and log in as a user, then <command>su</command> to
443 <systemitem class="username">root</systemitem>. If you do not see any
444 errors, then all is well and you should proceed with the rest of the
445 configuration. If you did receive errors, stop now and double check
446 the above configuration files manually. If you cannot find and
447 fix the error, you should recompile <application>Shadow</application>
448 replacing <option>--with-libpam</option> with
449 <option>--without-libpam</option> in the above instructions (also move
450 the <filename>/etc/login.defs.orig</filename> backup file to
451 <filename>/etc/login.defs</filename>). If you
452 fail to do this and the errors remain, you will be unable to log into
453 your system.</para>
454 </warning>
455
456 </sect4>
457
458 <sect4>
459 <title>Other</title>
460
461 <para>Currently, <filename>/etc/pam.d/other</filename> is configured
462 to allow anyone with an account on the machine to use PAM-aware
463 programs without a configuration file for that program. After testing
464 <application>Linux-PAM</application> for proper configuration, install
465 a more restrictive <filename>other</filename> file so that
466 program-specific configuration files are required:</para>
467
468<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
469<literal># Begin /etc/pam.d/other
470
471auth required pam_deny.so
472auth required pam_warn.so
473account required pam_deny.so
474session required pam_deny.so
475password required pam_deny.so
476password required pam_warn.so
477
478# End /etc/pam.d/other</literal>
479EOF</userinput></screen>
480
481 </sect4>
482
483 <sect4 id="pam-access">
484 <title>Configuring Login Access</title>
485
486 <para>Instead of using the <filename>/etc/login.access</filename>
487 file for controlling access to the system,
488 <application>Linux-PAM</application> uses the
489 <filename class='libraryfile'>pam_access.so</filename> module along
490 with the <filename>/etc/security/access.conf</filename> file. Rename
491 the <filename>/etc/login.access</filename> file using the following
492 command:</para>
493
494 <indexterm zone="shadow pam-access">
495 <primary sortas="e-etc-security-access.conf">/etc/security/access.conf</primary>
496 </indexterm>
497
498<screen role="root"><userinput>if [ -f /etc/login.access ]; then
499 mv -v /etc/login.access /etc/login.access.NOUSE
500fi</userinput></screen>
501
502 </sect4>
503
504 <sect4 id="pam-limits">
505 <title>Configuring Resource Limits</title>
506
507 <para>Instead of using the <filename>/etc/limits</filename> file
508 for limiting usage of system resources,
509 <application>Linux-PAM</application> uses the
510 <filename class='libraryfile'>pam_limits.so</filename> module along
511 with the <filename>/etc/security/limits.conf</filename> file. Rename
512 the <filename>/etc/limits</filename> file using the following
513 command:</para>
514
515 <indexterm zone="shadow pam-limits">
516 <primary sortas="e-etc-security-limits.conf">/etc/security/limits.conf</primary>
517 </indexterm>
518
519<screen role="root"><userinput>if [ -f /etc/limits ]; then
520 mv -v /etc/limits /etc/limits.NOUSE
521fi</userinput></screen>
522
523 </sect4>
524
525 <sect4 id="pam-env">
526 <title>Configuring Default Environment</title>
527
528 <para>During previous configuration, several items were removed from
529 <filename>/etc/login.defs</filename>. Some of these items are now
530 controlled by the <filename class='libraryfile'>pam_env.so</filename>
531 module and the <filename>/etc/security/pam_env.conf</filename>
532 configuration file. In particular, the default path has been
533 changed. To recover your default path, execute the following
534 commands:</para>
535
536<screen role="root"><userinput>ENV_PATH=`grep '^ENV_PATH' /etc/login.defs.orig | \
537 awk '{ print $2 }' | sed 's/PATH=//'` &amp;&amp;
538echo 'PATH DEFAULT='`echo "${ENV_PATH}"`\
539' OVERRIDE=${PATH}' \
540 >> /etc/security/pam_env.conf &amp;&amp;
541unset ENV_PATH</userinput></screen>
542
543 <note>
544 <para>ENV_SUPATH is no longer supported. You must create
545 a valid <filename>/root/.bashrc</filename> file to provide a
546 modified path for the super-user.</para>
547 </note>
548
549 </sect4>
550
551 </sect3>
552
553 </sect2>
554
555 <sect2 role="content">
556 <title>Contents</title>
557
558 <para>A list of the installed files, along with their short descriptions
559 can be found at
560 <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.</para>
561
562 </sect2>
563
564</sect1>
Note: See TracBrowser for help on using the repository browser.