source: postlfs/security/shadow.xml@ b65246b

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since b65246b was b65246b, checked in by Randy McMurchy <randy@…>, 18 years ago

Added a note to the Shadow instructions about running the Linux-PAM test suite

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@6031 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 21.6 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY shadow-download-http "http://ftp.pld.org.pl/software/shadow/shadow-&shadow-version;.tar.bz2">
8 <!ENTITY shadow-download-ftp "ftp://ftp.pld.org.pl/software/shadow/shadow-&shadow-version;.tar.bz2">
9 <!ENTITY shadow-md5sum "a0452fa989f8ba45023cc5a08136568e">
10 <!ENTITY shadow-size "1.2 MB">
11 <!ENTITY shadow-buildsize "15.5 MB">
12 <!ENTITY shadow-time "0.3 SBU">
13]>
14
15<sect1 id="shadow" xreflabel="Shadow-&shadow-version;">
16 <?dbhtml filename="shadow.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 <keywordset>
22 <keyword role="package">shadow-&shadow-version;.tar</keyword>
23 <keyword role="ftpdir">shadow</keyword>
24 </keywordset>
25 </sect1info>
26
27 <title>Shadow-&shadow-version;</title>
28
29 <indexterm zone="shadow">
30 <primary sortas="a-Shadow">Shadow</primary>
31 </indexterm>
32
33 <sect2 role="package">
34 <title>Introduction to Shadow</title>
35
36 <para><application>Shadow</application> was indeed installed in LFS and
37 there is no reason to reinstall it unless you installed
38 <application>CrackLib</application> or
39 <application>Linux-PAM</application> after your LFS system was completed.
40 If you have installed <application>CrackLib</application> after LFS, then
41 reinstalling <application>Shadow</application> will enable strong password
42 support. If you have installed <application>Linux-PAM</application>,
43 reinstalling <application>Shadow</application> will allow programs such as
44 <command>login</command> and <command>su</command> to utilize PAM.</para>
45
46 <bridgehead renderas="sect3">Package Information</bridgehead>
47 <itemizedlist spacing="compact">
48 <listitem>
49 <para>Download (HTTP): <ulink url="&shadow-download-http;"/></para>
50 </listitem>
51 <listitem>
52 <para>Download (FTP): <ulink url="&shadow-download-ftp;"/></para>
53 </listitem>
54 <listitem>
55 <para>Download MD5 sum: &shadow-md5sum;</para>
56 </listitem>
57 <listitem>
58 <para>Download size: &shadow-size;</para>
59 </listitem>
60 <listitem>
61 <para>Estimated disk space required: &shadow-buildsize;</para>
62 </listitem>
63 <listitem>
64 <para>Estimated build time: &shadow-time;</para>
65 </listitem>
66 </itemizedlist>
67
68 <!--
69 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
70 <itemizedlist spacing='compact'>
71 <listitem>
72 <para>Required patch: <ulink
73 url="&patch-root;/shadow-&shadow-version;-configure_fix-1.patch"/></para>
74 </listitem>
75 </itemizedlist>
76 -->
77
78 <bridgehead renderas="sect3">Shadow Dependencies</bridgehead>
79
80 <bridgehead renderas="sect4">Required</bridgehead>
81 <para role="required"><xref linkend="linux-pam"/> and/or
82 <xref linkend="cracklib"/></para>
83
84 <para condition="html" role="usernotes">User Notes:
85 <ulink url="&blfs-wiki;/shadow"/></para>
86
87 </sect2>
88
89 <sect2 role="installation">
90 <title>Installation of Shadow</title>
91
92 <important>
93 <para>The installation shown below is for a situation where
94 <application>Linux-PAM</application> has been installed (with or
95 without a <application>CrackLib</application> installation) and
96 <application>Shadow</application> is being reinstalled to support the
97 <application>Linux-PAM</application> installation. If you are
98 reinstalling <application>Shadow</application> to provide strong
99 password support via the <application>CrackLib</application> library
100 and you have not installed <application>Linux-PAM</application>, ensure
101 you add the <parameter>--with-libcrack</parameter> parameter to the
102 <command>configure</command> script below.</para>
103 </important>
104
105 <para>Reinstall <application>Shadow</application> by running the following
106 commands:</para>
107
108<screen><userinput>./configure --libdir=/lib \
109 --enable-shared \
110 --without-selinux &amp;&amp;
111sed -i 's/groups$(EXEEXT) //' src/Makefile &amp;&amp;
112find man -name Makefile -exec sed -i '/groups/d' {} \; &amp;&amp;
113sed -i -e 's/ ko//' \
114 -e 's/ zh_CN zh_TW//' \
115 man/Makefile &amp;&amp;
116
117for i in de es fi fr id it pt_BR; do
118 convert-mans UTF-8 ISO-8859-1 man/${i}/*.?
119done &amp;&amp;
120
121for i in cs hu pl; do
122 convert-mans UTF-8 ISO-8859-2 man/${i}/*.?
123done &amp;&amp;
124
125convert-mans UTF-8 EUC-JP man/ja/*.? &amp;&amp;
126convert-mans UTF-8 KOI8-R man/ru/*.? &amp;&amp;
127convert-mans UTF-8 ISO-8859-9 man/tr/*.? &amp;&amp;
128
129make</userinput></screen>
130
131 <para>This package does not come with a test suite.</para>
132
133 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
134
135<screen role="root"><userinput>make install &amp;&amp;
136mv -v /usr/bin/passwd /bin &amp;&amp;
137mv -v /lib/libshadow.*a /usr/lib &amp;&amp;
138rm -v /lib/libshadow.so &amp;&amp;
139ln -v -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
140
141 </sect2>
142
143 <sect2 role="commands">
144 <title>Command Explanations</title>
145
146 <!-- Removed the -with-libpam and -without-libcrack options from the
147 default as these are the defaults. Pam will automatically be picked
148 up if it is installed, and CrackLib won't be used unless specifically
149 requested via -with-libcrack
150 <para><parameter>-without-libcrack</parameter>: This switch tells
151 <application>Shadow</application> not to use
152 <filename class='libraryfile'>libcrack</filename>. This is desired as
153 <application>Linux-PAM</application> will provide
154 <filename class='libraryfile'>libcrack</filename> functionality.</para>
155 -->
156
157 <para><parameter>--without-selinux</parameter>: Support for selinux is
158 enabled by default, but selinux is not built in a base LFS system. The
159 <command>configure</command> script will fail if this option is not
160 used.</para>
161
162 <para><command>sed -i 's/groups$(EXEEXT) //' src/Makefile</command>: This
163 command is used to suppress the installation of the
164 <command>groups</command> program as the version from the
165 <application>Coreutils</application> package installed during LFS is
166 preferred.</para>
167
168 <para><command>find man -name Makefile -exec ... {} \;</command>: This
169 command is used to suppress the installation of the
170 <command>groups</command> man pages so the existing ones installed from
171 the <application>Coreutils</application> package are not replaced.</para>
172
173 <para><command>sed -i -e '...' -e '...' man/Makefile</command>: This
174 command disables the installation of Chinese and Korean manual pages, since
175 <application>Man-DB</application> cannot format them properly.</para>
176
177 <para><command>convert-mans ...</command>: These commands are used to
178 convert some of the man pages so that <application>Man-DB</application>
179 will display them in the expected encodings.</para>
180
181 <para><command>mv -v /usr/bin/passwd /bin</command>: The
182 <command>passwd</command> program may be needed during times when the
183 <filename class='directory'>/usr</filename> filesystem is not mounted so
184 it is moved into the root partition.</para>
185
186 <para><command>mv -v ...; rm -v ...; ln -v ...</command>: These commands
187 are used to move the <filename class='libraryfile'>libshadow</filename>
188 library to the root partition to support the moving of the
189 <command>passwd</command> program earlier.</para>
190
191 </sect2>
192
193 <sect2 role="configuration">
194 <title>Configuring Linux-PAM to Work with Shadow</title>
195
196 <note>
197 <para>The rest of the page is devoted to configuring
198 <application>Shadow</application> to work properly with
199 <application>Linux-PAM</application>. If you do not have
200 <application>Linux-PAM</application> installed, and you reinstalled
201 <application>Shadow</application> to support strong passwords via
202 the <application>CrackLib</application> library, no further configuration
203 is required.</para>
204 </note>
205
206 <sect3 id="pam.d">
207 <title>Config Files</title>
208
209 <para><filename>/etc/pam.d/*</filename> or alternatively
210 <filename>/etc/pam.conf, /etc/login.defs and
211 /etc/security/*</filename></para>
212
213 <indexterm zone="shadow pam.d">
214 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
215 </indexterm>
216
217 <indexterm zone="shadow pam.d">
218 <primary sortas="e-etc-pam.conf">/etc/pam.conf</primary>
219 </indexterm>
220
221 <indexterm zone="shadow pam.d">
222 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
223 </indexterm>
224
225 <indexterm zone="shadow pam.d">
226 <primary sortas="e-etc-security">/etc/security/*</primary>
227 </indexterm>
228
229 </sect3>
230
231 <sect3>
232 <title>Configuration Information</title>
233
234 <para>Configuring your system to use <application>Linux-PAM</application>
235 can be a complex task. The information below will provide a basic setup
236 so that <application>Shadow</application>'s login and password
237 functionality will work effectively with
238 <application>Linux-PAM</application>. Review the information and links on
239 the <xref linkend="linux-pam"/> page for further configuration
240 information. For information specific to integrating
241 <application>Shadow</application>, <application>Linux-PAM</application>
242 and <application>CrackLib</application>, you can visit the following
243 links:</para>
244
245 <itemizedlist spacing="compact">
246 <listitem>
247 <para><ulink
248 url="http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam-6.html#ss6.3"/></para>
249 </listitem>
250 <listitem>
251 <para><ulink
252 url="http://www.deer-run.com/~hal/sysadmin/pam_cracklib.html"/></para>
253 </listitem>
254 </itemizedlist>
255
256 <sect4 id="pam-login-defs">
257 <title>Configuring /etc/login.defs</title>
258
259 <para>The <command>login</command> program currently performs many
260 functions which <application>Linux-PAM</application> modules should
261 now handle. The following <command>sed</command> command will comment
262 out the appropriate lines in <filename>/etc/login.defs</filename>, and
263 stop <command>login</command> from performing these functions (a backup
264 file named <filename>/etc/login.defs.orig</filename> is also created
265 to preserve the original file's contents). Issue the following commands
266 as the <systemitem class="username">root</systemitem> user:</para>
267
268 <indexterm zone="shadow pam-login-defs">
269 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
270 </indexterm>
271
272<screen role="root"><userinput>install -v -m644 /etc/login.defs /etc/login.defs.orig &amp;&amp;
273for FUNCTION in LASTLOG_ENAB MAIL_CHECK_ENAB \
274 PORTTIME_CHECKS_ENAB CONSOLE \
275 MOTD_FILE NOLOGINS_FILE PASS_MIN_LEN \
276 SU_WHEEL_ONLY MD5_CRYPT_ENAB \
277 CONSOLE_GROUPS ENVIRON_FILE \
278 ULIMIT ENV_TZ ENV_HZ ENV_SUPATH \
279 ENV_PATH QMAIL_DIR MAIL_DIR MAIL_FILE \
280 CHFN_AUTH FAILLOG_ENAB QUOTAS_ENAB FTMP_FILE \
281 OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
282 PASS_CHANGE_TRIES PASS_ALWAYS_WARN
283do
284 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
285done</userinput></screen>
286
287 <!-- Moved the commenting of these four parameters into the section
288 above. If PAM is installed, it complains if these are not commented
289 regardless if CrackLib is installed.
290
291 <para>If you have <application>CrackLib</application> installed,
292 also comment out four more lines using the following command as the
293 <systemitem class="username">root</systemitem> user:</para>
294
295<screen role="root"><userinput>for FUNCTION in OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
296 PASS_CHANGE_TRIES PASS_ALWAYS_WARN
297do
298 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
299done</userinput></screen>
300
301 -->
302
303 </sect4>
304
305 <sect4>
306 <title>Configuring the /etc/pam.d/ Files</title>
307
308 <para>Add the following <application>Linux-PAM</application> configuration
309 files to <filename class="directory">/etc/pam.d/</filename> (or add them
310 to <filename>/etc/pam.conf</filename> with the additional field for
311 the program). Issue the commands as the
312 <systemitem class="username">root</systemitem> user:</para>
313
314 </sect4>
315
316 <sect4>
317 <title>'login' (with CrackLib)</title>
318
319<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
320<literal># Begin /etc/pam.d/login
321
322auth requisite pam_securetty.so
323auth requisite pam_nologin.so
324auth required pam_unix.so
325account required pam_access.so
326account required pam_unix.so
327session required pam_env.so
328session required pam_motd.so
329session required pam_limits.so
330session optional pam_mail.so dir=/var/mail standard
331session optional pam_lastlog.so
332session required pam_unix.so
333password required pam_cracklib.so retry=3 difok=8 minlen=5 \
334 dcredit=3 ocredit=3 \
335 ucredit=2 lcredit=2
336password required pam_unix.so md5 shadow use_authtok
337
338# End /etc/pam.d/login</literal>
339EOF</userinput></screen>
340
341 </sect4>
342
343 <sect4>
344 <title>'login' (without CrackLib)</title>
345
346<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
347<literal># Begin /etc/pam.d/login
348
349auth requisite pam_securetty.so
350auth requisite pam_nologin.so
351auth required pam_env.so
352auth required pam_unix.so
353account required pam_access.so
354account required pam_unix.so
355session required pam_motd.so
356session required pam_limits.so
357session optional pam_mail.so dir=/var/mail standard
358session optional pam_lastlog.so
359session required pam_unix.so
360password required pam_unix.so md5 shadow
361
362# End /etc/pam.d/login</literal>
363EOF</userinput></screen>
364
365 </sect4>
366
367 <sect4>
368 <title>'passwd' (with CrackLib)</title>
369
370<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
371<literal># Begin /etc/pam.d/passwd
372
373password required pam_cracklib.so retry=3 difok=8 minlen=5 \
374 dcredit=3 ocredit=3 \
375 ucredit=2 lcredit=2
376password required pam_unix.so md5 shadow use_authtok
377
378# End /etc/pam.d/passwd</literal>
379EOF</userinput></screen>
380
381 </sect4>
382
383 <sect4>
384 <title>'passwd' (without CrackLib)</title>
385
386<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
387<literal># Begin /etc/pam.d/passwd
388
389password required pam_unix.so md5 shadow
390
391# End /etc/pam.d/passwd</literal>
392EOF</userinput></screen>
393
394 </sect4>
395
396 <sect4>
397 <title>'su'</title>
398
399<screen role="root"><userinput>cat &gt; /etc/pam.d/su &lt;&lt; "EOF"
400<literal># Begin /etc/pam.d/su
401
402auth sufficient pam_rootok.so
403auth required pam_unix.so
404account required pam_unix.so
405session optional pam_mail.so dir=/var/mail standard
406session required pam_env.so
407session required pam_unix.so
408
409# End /etc/pam.d/su</literal>
410EOF</userinput></screen>
411
412 </sect4>
413
414 <sect4>
415 <title>'chage'</title>
416
417<screen role="root"><userinput>cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"
418<literal># Begin /etc/pam.d/chage
419
420auth sufficient pam_rootok.so
421auth required pam_unix.so
422account required pam_unix.so
423session required pam_unix.so
424password required pam_permit.so
425
426# End /etc/pam.d/chage</literal>
427EOF</userinput></screen>
428
429 </sect4>
430
431 <sect4>
432 <title>'chpasswd', 'newusers', 'groupadd', 'groupdel',
433 'groupmod', 'useradd', 'userdel', and 'usermod'</title>
434
435<screen role="root"><userinput>for PROGRAM in chpasswd newusers groupadd groupdel \
436 groupmod useradd userdel usermod
437do
438 install -v -m644 /etc/pam.d/chage /etc/pam.d/$PROGRAM
439 sed -i "s/chage/$PROGRAM/" /etc/pam.d/$PROGRAM
440done</userinput></screen>
441
442 <warning>
443 <para>At this point, you should do a simple test to see if
444 <application>Shadow</application> is working as expected. Open
445 another terminal and log in as a user, then <command>su</command> to
446 <systemitem class="username">root</systemitem>. If you do not see any
447 errors, then all is well and you should proceed with the rest of the
448 configuration. If you did receive errors, stop now and double check
449 the above configuration files manually. You can also run the test
450 suite from the <application>Linux-PAM</application> package to assist
451 you in determining the problem. If you cannot find and
452 fix the error, you should recompile <application>Shadow</application>
453 replacing <option>--with-libpam</option> with
454 <option>--without-libpam</option> in the above instructions (also move
455 the <filename>/etc/login.defs.orig</filename> backup file to
456 <filename>/etc/login.defs</filename>). If you
457 fail to do this and the errors remain, you will be unable to log into
458 your system.</para>
459 </warning>
460
461 </sect4>
462
463 <sect4>
464 <title>Other</title>
465
466 <para>Currently, <filename>/etc/pam.d/other</filename> is configured
467 to allow anyone with an account on the machine to use PAM-aware
468 programs without a configuration file for that program. After testing
469 <application>Linux-PAM</application> for proper configuration, install
470 a more restrictive <filename>other</filename> file so that
471 program-specific configuration files are required:</para>
472
473<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
474<literal># Begin /etc/pam.d/other
475
476auth required pam_deny.so
477auth required pam_warn.so
478account required pam_deny.so
479session required pam_deny.so
480password required pam_deny.so
481password required pam_warn.so
482
483# End /etc/pam.d/other</literal>
484EOF</userinput></screen>
485
486 <para>If you preserved the source tree from the
487 <application>Linux-PAM</application> package (or you feel like unpacking
488 that tarball, then running <command>configure</command> and
489 <command>make</command>), now would be a good time to run the test
490 suite from this package. This test suite will use the configuration you
491 just finished during the tests. All the tests should pass.</para>
492
493 </sect4>
494
495 <sect4 id="pam-access">
496 <title>Configuring Login Access</title>
497
498 <para>Instead of using the <filename>/etc/login.access</filename>
499 file for controlling access to the system,
500 <application>Linux-PAM</application> uses the
501 <filename class='libraryfile'>pam_access.so</filename> module along
502 with the <filename>/etc/security/access.conf</filename> file. Rename
503 the <filename>/etc/login.access</filename> file using the following
504 command:</para>
505
506 <indexterm zone="shadow pam-access">
507 <primary sortas="e-etc-security-access.conf">/etc/security/access.conf</primary>
508 </indexterm>
509
510<screen role="root"><userinput>if [ -f /etc/login.access ]; then
511 mv -v /etc/login.access /etc/login.access.NOUSE
512fi</userinput></screen>
513
514 </sect4>
515
516 <sect4 id="pam-limits">
517 <title>Configuring Resource Limits</title>
518
519 <para>Instead of using the <filename>/etc/limits</filename> file
520 for limiting usage of system resources,
521 <application>Linux-PAM</application> uses the
522 <filename class='libraryfile'>pam_limits.so</filename> module along
523 with the <filename>/etc/security/limits.conf</filename> file. Rename
524 the <filename>/etc/limits</filename> file using the following
525 command:</para>
526
527 <indexterm zone="shadow pam-limits">
528 <primary sortas="e-etc-security-limits.conf">/etc/security/limits.conf</primary>
529 </indexterm>
530
531<screen role="root"><userinput>if [ -f /etc/limits ]; then
532 mv -v /etc/limits /etc/limits.NOUSE
533fi</userinput></screen>
534
535 </sect4>
536
537 <sect4 id="pam-env">
538 <title>Configuring Default Environment</title>
539
540 <para>During previous configuration, several items were removed from
541 <filename>/etc/login.defs</filename>. Some of these items are now
542 controlled by the <filename class='libraryfile'>pam_env.so</filename>
543 module and the <filename>/etc/security/pam_env.conf</filename>
544 configuration file. In particular, the default path has been
545 changed. To recover your default path, execute the following
546 commands:</para>
547
548<screen role="root"><userinput>ENV_PATH=`grep '^ENV_PATH' /etc/login.defs.orig | \
549 awk '{ print $2 }' | sed 's/PATH=//'` &amp;&amp;
550echo 'PATH DEFAULT='`echo "${ENV_PATH}"`\
551' OVERRIDE=${PATH}' \
552 >> /etc/security/pam_env.conf &amp;&amp;
553unset ENV_PATH</userinput></screen>
554
555 <note>
556 <para>ENV_SUPATH is no longer supported. You must create
557 a valid <filename>/root/.bashrc</filename> file to provide a
558 modified path for the super-user.</para>
559 </note>
560
561 </sect4>
562
563 </sect3>
564
565 </sect2>
566
567 <sect2 role="content">
568 <title>Contents</title>
569
570 <para>A list of the installed files, along with their short descriptions
571 can be found at
572 <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.</para>
573
574 </sect2>
575
576</sect1>
Note: See TracBrowser for help on using the repository browser.