source: postlfs/security/shadow.xml@ bca744f

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since bca744f was bca744f, checked in by Randy McMurchy <randy@…>, 15 years ago

Updated to Shadow-4.1.2.2

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@7765 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 22.2 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY shadow-download-http " ">
8 <!ENTITY shadow-download-ftp "ftp://pkg-shadow.alioth.debian.org/pub/pkg-shadow/shadow-&shadow-version;.tar.bz2">
9 <!ENTITY shadow-md5sum "3d26d990d4c3add1b7f8387eec1d1fde">
10 <!ENTITY shadow-size "1.6 MB">
11 <!ENTITY shadow-buildsize "22 MB">
12 <!ENTITY shadow-time "0.3 SBU">
13]>
14
15<sect1 id="shadow" xreflabel="Shadow-&shadow-version;">
16 <?dbhtml filename="shadow.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Shadow-&shadow-version;</title>
24
25 <indexterm zone="shadow">
26 <primary sortas="a-Shadow">Shadow</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Shadow</title>
31
32 <para><application>Shadow</application> was indeed installed in LFS and
33 there is no reason to reinstall it unless you installed
34 <application>CrackLib</application> or
35 <application>Linux-PAM</application> after your LFS system was completed.
36 If you have installed <application>CrackLib</application> after LFS, then
37 reinstalling <application>Shadow</application> will enable strong password
38 support. If you have installed <application>Linux-PAM</application>,
39 reinstalling <application>Shadow</application> will allow programs such as
40 <command>login</command> and <command>su</command> to utilize PAM.</para>
41
42 <bridgehead renderas="sect3">Package Information</bridgehead>
43 <itemizedlist spacing="compact">
44 <listitem>
45 <para>Download (HTTP): <ulink url="&shadow-download-http;"/></para>
46 </listitem>
47 <listitem>
48 <para>Download (FTP): <ulink url="&shadow-download-ftp;"/></para>
49 </listitem>
50 <listitem>
51 <para>Download MD5 sum: &shadow-md5sum;</para>
52 </listitem>
53 <listitem>
54 <para>Download size: &shadow-size;</para>
55 </listitem>
56 <listitem>
57 <para>Estimated disk space required: &shadow-buildsize;</para>
58 </listitem>
59 <listitem>
60 <para>Estimated build time: &shadow-time;</para>
61 </listitem>
62 </itemizedlist>
63
64 <!-- <bridgehead renderas="sect3">Additional Downloads</bridgehead>
65 <itemizedlist spacing='compact'>
66 <listitem>
67 <para>Required patch: <ulink
68 url="&patch-root;/shadow-&shadow-version;-useradd_fix-2.patch"/></para>
69 </listitem>
70 </itemizedlist> -->
71
72 <bridgehead renderas="sect3">Shadow Dependencies</bridgehead>
73
74 <bridgehead renderas="sect4">Required</bridgehead>
75 <para role="required"><xref linkend="linux-pam"/> and/or
76 <xref linkend="cracklib"/></para>
77
78 <para condition="html" role="usernotes">User Notes:
79 <ulink url="&blfs-wiki;/shadow"/></para>
80
81 </sect2>
82
83 <sect2 role="installation">
84 <title>Installation of Shadow</title>
85
86 <important>
87 <para>The installation commands shown below are for installations where
88 <application>Linux-PAM</application> has been installed (with or
89 without a <application>CrackLib</application> installation) and
90 <application>Shadow</application> is being reinstalled to support the
91 <application>Linux-PAM</application> installation.</para>
92
93 <para> If you are reinstalling <application>Shadow</application> to
94 provide strong password support using the
95 <application>CrackLib</application> library without using
96 <application>Linux-PAM</application>, ensure you add the
97 <parameter>--with-libcrack</parameter> parameter to the
98 <command>configure</command> script below and also issue the following
99 command:</para>
100
101<screen><userinput>sed -i 's@DICTPATH.*@DICTPATH\t/lib/cracklib/pw_dict@' etc/login.defs</userinput></screen>
102 </important>
103
104 <para>Reinstall <application>Shadow</application> by running the following
105 commands:</para>
106
107<screen><userinput>sed -i 's/groups$(EXEEXT) //' src/Makefile.in &amp;&amp;
108find man -name Makefile.in -exec sed -i 's/groups\.1 / /' {} \; &amp;&amp;
109sed -i -e 's/ ko//' -e 's/ zh_CN zh_TW//' man/Makefile.in &amp;&amp;
110
111for i in de es fi fr id it pt_BR; do
112 convert-mans UTF-8 ISO-8859-1 man/${i}/*.?
113done &amp;&amp;
114
115for i in cs hu pl; do
116 convert-mans UTF-8 ISO-8859-2 man/${i}/*.?
117done &amp;&amp;
118
119convert-mans UTF-8 EUC-JP man/ja/*.? &amp;&amp;
120convert-mans UTF-8 KOI8-R man/ru/*.? &amp;&amp;
121convert-mans UTF-8 ISO-8859-9 man/tr/*.? &amp;&amp;
122
123sed -i -e 's@#ENCRYPT_METHOD DES@ENCRYPT_METHOD MD5@' \
124 -e 's@/var/spool/mail@/var/mail@' etc/login.defs &amp;&amp;
125
126./configure --sysconfdir=/etc &amp;&amp;
127make</userinput></screen>
128
129 <para>This package does not come with a test suite.</para>
130
131 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
132
133<screen role="root"><userinput>make install &amp;&amp;
134mv -v /usr/bin/passwd /bin</userinput></screen>
135
136 </sect2>
137
138 <sect2 role="commands">
139 <title>Command Explanations</title>
140
141 <para><command>sed -i 's/groups$(EXEEXT) //' src/Makefile.in</command>:
142 This command is used to suppress the installation of the
143 <command>groups</command> program as the version from the
144 <application>Coreutils</application> package installed during LFS is
145 preferred.</para>
146
147 <para><command>find man -name Makefile.in -exec ... {} \;</command>: This
148 command is used to suppress the installation of the
149 <command>groups</command> man pages so the existing ones installed from
150 the <application>Coreutils</application> package are not replaced.</para>
151
152 <para><command>sed -i -e '...' -e '...' man/Makefile.in</command>: This
153 command disables the installation of Chinese and Korean manual pages, since
154 <application>Man-DB</application> cannot format them properly.</para>
155
156 <para><command>convert-mans ...</command>: These commands are used to
157 convert some of the man pages so that <application>Man-DB</application>
158 will display them in the expected encodings.</para>
159
160 <para><command>sed -i -e 's@#ENCRYPT_METHOD DES@ENCRYPT_METHOD MD5@'
161 -e 's@/var/spool/mail@/var/mail@' etc/login.defs</command>:
162 Instead of using the default 'crypt' method, this command modifies the
163 installation to use the more secure 'MD5' method of password encryption,
164 which also allows passwords longer than eight characters. It also changes
165 the obsolete <filename class="directory">/var/spool/mail</filename>
166 location for user mailboxes that <application>Shadow</application> uses by
167 default to the <filename class="directory">/var/mail</filename>
168 location.</para>
169
170 <para><command>mv -v /usr/bin/passwd /bin</command>: The
171 <command>passwd</command> program may be needed during times when the
172 <filename class='directory'>/usr</filename> filesystem is not mounted so
173 it is moved into the root partition.</para>
174
175 </sect2>
176
177 <sect2 role="configuration">
178 <title>Configuring Shadow</title>
179
180 <para><application>Shadow</application>'s stock configuration for the
181 <command>useradd</command> utility may not be desireable for your
182 installation. One default parameter causes <command>useradd</command> to
183 create a mailbox file for any newly created user.
184 <command>useradd</command> will make the group ownership of this file to
185 the <systemitem class="groupname">mail</systemitem> group with 0660
186 permissions. If you would prefer that these mailbox files are not created
187 by <command>useradd</command>, issue the
188 following command as the <systemitem class="username">root</systemitem> user:</para>
189
190<screen role="root"><userinput>sed -i 's/yes/no/' /etc/default/useradd</userinput></screen>
191
192 </sect2>
193
194 <sect2 role="configuration">
195 <title>Configuring Linux-PAM to Work with Shadow</title>
196
197 <note>
198 <para>The rest of this page is devoted to configuring
199 <application>Shadow</application> to work properly with
200 <application>Linux-PAM</application>. If you do not have
201 <application>Linux-PAM</application> installed, and you reinstalled
202 <application>Shadow</application> to support strong passwords via
203 the <application>CrackLib</application> library, no further configuration
204 is required.</para>
205 </note>
206
207 <sect3 id="pam.d">
208 <title>Config Files</title>
209
210 <para><filename>/etc/pam.d/*</filename> or alternatively
211 <filename>/etc/pam.conf, /etc/login.defs, and
212 /etc/security/*</filename></para>
213
214 <indexterm zone="shadow pam.d">
215 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
216 </indexterm>
217
218 <indexterm zone="shadow pam.d">
219 <primary sortas="e-etc-pam.conf">/etc/pam.conf</primary>
220 </indexterm>
221
222 <indexterm zone="shadow pam.d">
223 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
224 </indexterm>
225
226 <indexterm zone="shadow pam.d">
227 <primary sortas="e-etc-security">/etc/security/*</primary>
228 </indexterm>
229
230 </sect3>
231
232 <sect3>
233 <title>Configuration Information</title>
234
235 <para>Configuring your system to use <application>Linux-PAM</application>
236 can be a complex task. The information below will provide a basic setup
237 so that <application>Shadow</application>'s login and password
238 functionality will work effectively with
239 <application>Linux-PAM</application>. Review the information and links on
240 the <xref linkend="linux-pam"/> page for further configuration
241 information. For information specific to integrating
242 <application>Shadow</application>, <application>Linux-PAM</application>
243 and <application>CrackLib</application>, you can visit the following
244 links:</para>
245
246 <itemizedlist spacing="compact">
247 <listitem>
248 <para><ulink
249 url="http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam-6.html#ss6.3"/></para>
250 </listitem>
251 <listitem>
252 <para><ulink
253 url="http://www.deer-run.com/~hal/sysadmin/pam_cracklib.html"/></para>
254 </listitem>
255 </itemizedlist>
256
257 <sect4 id="pam-login-defs">
258 <title>Configuring /etc/login.defs</title>
259
260 <para>The <command>login</command> program currently performs many
261 functions which <application>Linux-PAM</application> modules should
262 now handle. The following <command>sed</command> command will comment
263 out the appropriate lines in <filename>/etc/login.defs</filename>, and
264 stop <command>login</command> from performing these functions (a backup
265 file named <filename>/etc/login.defs.orig</filename> is also created
266 to preserve the original file's contents). Issue the following commands
267 as the <systemitem class="username">root</systemitem> user:</para>
268
269 <indexterm zone="shadow pam-login-defs">
270 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
271 </indexterm>
272
273<screen role="root"><userinput>install -v -m644 /etc/login.defs /etc/login.defs.orig &amp;&amp;
274for FUNCTION in LASTLOG_ENAB MAIL_CHECK_ENAB \
275 PORTTIME_CHECKS_ENAB CONSOLE \
276 MOTD_FILE NOLOGINS_FILE PASS_MIN_LEN \
277 SU_WHEEL_ONLY MD5_CRYPT_ENAB \
278 CONSOLE_GROUPS ENVIRON_FILE \
279 ULIMIT ENV_TZ ENV_HZ ENV_SUPATH \
280 ENV_PATH QMAIL_DIR MAIL_DIR MAIL_FILE \
281 CHFN_AUTH FAILLOG_ENAB QUOTAS_ENAB FTMP_FILE \
282 OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
283 PASS_CHANGE_TRIES PASS_ALWAYS_WARN ISSUE_FILE
284do
285 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
286done</userinput></screen>
287
288 </sect4>
289
290 <sect4>
291 <title>Configuring the /etc/pam.d/ Files</title>
292
293 <para>As mentioned previously in the
294 <application>Linux-PAM</application> instructions,
295 <application>Linux-PAM</application> has two supported methods for
296 configuration. The commands below assume that you've chosen to use
297 a directory based configuration, where each program has its own
298 configuration file. You can optionally use a single
299 <filename>/etc/pam.conf</filename> configuration file by using the
300 text from the files below, and supplying the program name as an
301 additional first field for each line.</para>
302
303 <para>As the <systemitem class="username">root</systemitem> user,
304 replace the following <application>Linux-PAM</application>
305 configuration files in the
306 <filename class="directory">/etc/pam.d/</filename> directory (or
307 add the contents to the <filename>/etc/pam.conf</filename> file) using
308 the following commands:</para>
309
310 </sect4>
311
312 <sect4>
313 <title>'login' (with CrackLib)</title>
314
315<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
316<literal># Begin /etc/pam.d/login
317
318auth requisite pam_nologin.so
319auth required pam_securetty.so
320auth required pam_unix.so
321account required pam_access.so
322account required pam_unix.so
323session required pam_env.so
324session required pam_motd.so
325session required pam_limits.so
326session optional pam_mail.so dir=/var/mail standard
327session optional pam_lastlog.so
328session required pam_unix.so
329password required pam_cracklib.so retry=3
330password required pam_unix.so md5 shadow use_authtok
331
332# End /etc/pam.d/login</literal>
333EOF</userinput></screen>
334
335 </sect4>
336
337 <sect4>
338 <title>'login' (without CrackLib)</title>
339
340<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
341<literal># Begin /etc/pam.d/login
342
343auth requisite pam_nologin.so
344auth required pam_securetty.so
345auth required pam_env.so
346auth required pam_unix.so
347account required pam_access.so
348account required pam_unix.so
349session required pam_motd.so
350session required pam_limits.so
351session optional pam_mail.so dir=/var/mail standard
352session optional pam_lastlog.so
353session required pam_unix.so
354password required pam_unix.so md5 shadow
355
356# End /etc/pam.d/login</literal>
357EOF</userinput></screen>
358
359 </sect4>
360
361 <sect4>
362 <title>'passwd' (with CrackLib)</title>
363
364<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
365<literal># Begin /etc/pam.d/passwd
366
367password required pam_cracklib.so type=Linux retry=1 \
368 difok=5 diffignore=23 minlen=9 \
369 dcredit=1 ucredit=1 lcredit=1 \
370 ocredit=1 \
371 dictpath=/lib/cracklib/pw_dict
372password required pam_unix.so md5 shadow use_authtok
373
374# End /etc/pam.d/passwd</literal>
375EOF</userinput></screen>
376
377 <note><para>In its default configuration, owing to credits,
378 pam_cracklib will allow multiple case passwords as short as 6
379 characters, even with the <parameter>minlen</parameter> value
380 set to 11. You should review the pam_cracklib(8) man page and
381 determine if these default values are acceptable for the security
382 of your system.</para></note>
383
384 </sect4>
385
386 <sect4>
387 <title>'passwd' (without CrackLib)</title>
388
389<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
390<literal># Begin /etc/pam.d/passwd
391
392password required pam_unix.so md5 shadow
393
394# End /etc/pam.d/passwd</literal>
395EOF</userinput></screen>
396
397 </sect4>
398
399 <sect4>
400 <title>'su'</title>
401
402<screen role="root"><userinput>cat &gt; /etc/pam.d/su &lt;&lt; "EOF"
403<literal># Begin /etc/pam.d/su
404
405auth sufficient pam_rootok.so
406auth required pam_unix.so
407account required pam_unix.so
408session optional pam_mail.so dir=/var/mail standard
409session optional pam_xauth.so
410session required pam_env.so
411session required pam_unix.so
412
413# End /etc/pam.d/su</literal>
414EOF</userinput></screen>
415
416 </sect4>
417
418 <sect4>
419 <title>'chage'</title>
420
421<screen role="root"><userinput>cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"
422<literal># Begin /etc/pam.d/chage
423
424auth sufficient pam_rootok.so
425auth required pam_unix.so
426account required pam_unix.so
427session required pam_unix.so
428password required pam_permit.so
429
430# End /etc/pam.d/chage</literal>
431EOF</userinput></screen>
432
433 </sect4>
434
435 <sect4>
436 <title>'chfn', 'chgpasswd', 'chgpasswd', 'chsh', 'groupadd',
437 'groupdel', 'groupmems', 'groupmod', 'newusers', 'useradd', 'userdel'
438 and 'usermod'</title>
439
440<screen role="root"><userinput>for PROGRAM in chfn chgpasswd chpasswd chsh groupadd groupdel \
441 groupmems groupmod newusers useradd userdel usermod
442do
443 install -v -m644 /etc/pam.d/chage /etc/pam.d/$PROGRAM
444 sed -i "s/chage/$PROGRAM/" /etc/pam.d/$PROGRAM
445done</userinput></screen>
446
447 <warning>
448 <para>At this point, you should do a simple test to see if
449 <application>Shadow</application> is working as expected. Open
450 another terminal and log in as a user, then <command>su</command> to
451 <systemitem class="username">root</systemitem>. If you do not see any
452 errors, then all is well and you should proceed with the rest of the
453 configuration. If you did receive errors, stop now and double check
454 the above configuration files manually. You can also run the test
455 suite from the <application>Linux-PAM</application> package to assist
456 you in determining the problem. If you cannot find and
457 fix the error, you should recompile <application>Shadow</application>
458 adding the <option>--without-libpam</option> switch to the
459 <command>configure</command> command in the above instructions
460 (also move the <filename>/etc/login.defs.orig</filename> backup
461 file to <filename>/etc/login.defs</filename>). If you
462 fail to do this and the errors remain, you will be unable to log into
463 your system.</para>
464 </warning>
465
466 </sect4>
467
468 <sect4>
469 <title>Other</title>
470
471 <para>Currently, <filename>/etc/pam.d/other</filename> is configured
472 to allow anyone with an account on the machine to use PAM-aware
473 programs without a configuration file for that program. After testing
474 <application>Linux-PAM</application> for proper configuration, install
475 a more restrictive <filename>other</filename> file so that
476 program-specific configuration files are required:</para>
477
478<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
479<literal># Begin /etc/pam.d/other
480
481auth required pam_deny.so
482auth required pam_warn.so
483account required pam_deny.so
484account required pam_warn.so
485password required pam_deny.so
486password required pam_warn.so
487session required pam_deny.so
488session required pam_warn.so
489
490# End /etc/pam.d/other</literal>
491EOF</userinput></screen>
492
493 </sect4>
494
495 <sect4 id="pam-access">
496 <title>Configuring Login Access</title>
497
498 <para>Instead of using the <filename>/etc/login.access</filename>
499 file for controlling access to the system,
500 <application>Linux-PAM</application> uses the
501 <filename class='libraryfile'>pam_access.so</filename> module along
502 with the <filename>/etc/security/access.conf</filename> file. Rename
503 the <filename>/etc/login.access</filename> file using the following
504 command:</para>
505
506 <indexterm zone="shadow pam-access">
507 <primary sortas="e-etc-security-access.conf">/etc/security/access.conf</primary>
508 </indexterm>
509
510<screen role="root"><userinput>if [ -f /etc/login.access ]; then
511 mv -v /etc/login.access /etc/login.access.NOUSE
512fi</userinput></screen>
513
514 </sect4>
515
516 <sect4 id="pam-limits">
517 <title>Configuring Resource Limits</title>
518
519 <para>Instead of using the <filename>/etc/limits</filename> file
520 for limiting usage of system resources,
521 <application>Linux-PAM</application> uses the
522 <filename class='libraryfile'>pam_limits.so</filename> module along
523 with the <filename>/etc/security/limits.conf</filename> file. Rename
524 the <filename>/etc/limits</filename> file using the following
525 command:</para>
526
527 <indexterm zone="shadow pam-limits">
528 <primary sortas="e-etc-security-limits.conf">/etc/security/limits.conf</primary>
529 </indexterm>
530
531<screen role="root"><userinput>if [ -f /etc/limits ]; then
532 mv -v /etc/limits /etc/limits.NOUSE
533fi</userinput></screen>
534
535 </sect4>
536
537 <sect4 id="pam-env">
538 <title>Configuring Default Environment</title>
539
540 <para>During previous configuration, several items were removed from
541 <filename>/etc/login.defs</filename>. Some of these items are now
542 controlled by the <filename class='libraryfile'>pam_env.so</filename>
543 module and the <filename>/etc/security/pam_env.conf</filename>
544 configuration file. In particular, the default path has been
545 changed. To recover your default path, execute the following
546 commands:</para>
547
548<screen role="root"><userinput>ENV_PATH=`grep '^ENV_PATH' /etc/login.defs.orig | \
549 awk '{ print $2 }' | sed 's/PATH=//'` &amp;&amp;
550echo 'PATH DEFAULT='`echo "${ENV_PATH}"`\
551' OVERRIDE=${PATH}' \
552 >> /etc/security/pam_env.conf &amp;&amp;
553unset ENV_PATH</userinput></screen>
554
555 <note>
556 <para>ENV_SUPATH is no longer supported. You must create
557 a valid <filename>/root/.bashrc</filename> file to provide a
558 modified path for the super-user.</para>
559 </note>
560
561 </sect4>
562
563 </sect3>
564
565 </sect2>
566
567 <sect2 role="content">
568 <title>Contents</title>
569
570 <para>A list of the installed files, along with their short descriptions
571 can be found at
572 <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.</para>
573
574 </sect2>
575
576</sect1>
Note: See TracBrowser for help on using the repository browser.