source: postlfs/security/shadow.xml@ d8684cbc

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since d8684cbc was d8684cbc, checked in by Randy McMurchy <randy@…>, 18 years ago

Updated to Shadow-4.0.13

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@5325 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 15.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY shadow-download-http "http://ftp.pld.org.pl/software/shadow/shadow-&shadow-version;.tar.bz2">
8 <!ENTITY shadow-download-ftp "ftp://ftp.pld.org.pl/software/shadow/shadow-&shadow-version;.tar.bz2">
9 <!ENTITY shadow-md5sum "5c6a105d89afb0900922260e9c5650cc">
10 <!ENTITY shadow-size "1.0 MB">
11 <!ENTITY shadow-buildsize "13.6 MB">
12 <!ENTITY shadow-time "0.3 SBU">
13]>
14
15<sect1 id="shadow" xreflabel="Shadow-&shadow-version;">
16 <?dbhtml filename="shadow.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Shadow-&shadow-version;</title>
24
25 <indexterm zone="shadow">
26 <primary sortas="a-Shadow">Shadow</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Shadow</title>
31
32 <para><application>Shadow</application> was indeed installed in LFS and
33 there is no reason to reinstall it unless you installed
34 <application>Linux-PAM</application>. If you did install
35 <application>Linux-PAM</application>, reinstalling
36 <application>Shadow</application> will allow programs such as
37 <command>login</command> and <command>su</command> to utilize PAM.</para>
38
39 <bridgehead renderas="sect3">Package Information</bridgehead>
40 <itemizedlist spacing="compact">
41 <listitem>
42 <para>Download (HTTP): <ulink url="&shadow-download-http;"/></para>
43 </listitem>
44 <listitem>
45 <para>Download (FTP): <ulink url="&shadow-download-ftp;"/></para>
46 </listitem>
47 <listitem>
48 <para>Download MD5 sum: &shadow-md5sum;</para>
49 </listitem>
50 <listitem>
51 <para>Download size: &shadow-size;</para>
52 </listitem>
53 <listitem>
54 <para>Estimated disk space required: &shadow-buildsize;</para>
55 </listitem>
56 <listitem>
57 <para>Estimated build time: &shadow-time;</para>
58 </listitem>
59 </itemizedlist>
60
61 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
62 <itemizedlist spacing='compact'>
63 <listitem>
64 <para>Required patch: <ulink
65 url="&patch-root;/shadow-&shadow-version;-configure_fix-1.patch"/></para>
66 </listitem>
67 </itemizedlist>
68
69 <bridgehead renderas="sect3">Shadow Dependencies</bridgehead>
70
71 <bridgehead renderas="sect4">Required</bridgehead>
72 <para><xref linkend="linux-pam"/></para>
73
74 </sect2>
75
76 <sect2 role="installation">
77 <title>Installation of Shadow</title>
78
79 <para>Reinstall <application>Shadow</application> by running the following
80 commands:</para>
81
82<screen><userinput>./configure --libdir=/lib --enable-shared \
83 --with-libpam --without-libcrack &amp;&amp;
84sed -i 's/groups$(EXEEXT) //' src/Makefile &amp;&amp;
85find man -name Makefile -exec sed -i '/groups/d' &amp;&amp;
86make</userinput></screen>
87
88 <para>This package does not come with a test suite.</para>
89
90 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
91
92<screen role="root"><userinput>make install &amp;&amp;
93mv -v /usr/bin/passwd /bin &amp;&amp;
94mv -v /lib/libshadow.*a /usr/lib &amp;&amp;
95rm -v /lib/libshadow.so &amp;&amp;
96ln -v -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
97
98 </sect2>
99
100 <sect2 role="commands">
101 <title>Command Explanations</title>
102
103 <para><parameter>--without-libcrack</parameter>: This switch tells
104 <application>Shadow</application> not to use
105 <filename class='libraryfile'>libcrack</filename>. This is desired as
106 <application>Linux-PAM</application> will provide
107 <filename class='libraryfile'>libcrack</filename> functionality.</para>
108
109 <para><command>sed -i ...</command>: These commands are used to suppress
110 the installation of the <command>groups</command> program and man pages
111 as the version from the <application>Coreutils</application> package
112 installed during LFS is preferred.</para>
113
114 </sect2>
115
116 <sect2 role="configuration">
117 <title>Configuring Linux-PAM to Work with Shadow</title>
118
119 <sect3 id="pam.d">
120 <title>Config Files</title>
121
122 <para><filename>/etc/pam.d/*</filename> or alternatively
123 <filename>/etc/pam.conf, /etc/login.defs and
124 /etc/security/*</filename></para>
125
126 <indexterm zone="shadow pam.d">
127 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
128 </indexterm>
129
130 <indexterm zone="shadow pam.d">
131 <primary sortas="e-etc-pam.conf">/etc/pam.conf</primary>
132 </indexterm>
133
134 <indexterm zone="shadow pam.d">
135 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
136 </indexterm>
137
138 <indexterm zone="shadow pam.d">
139 <primary sortas="e-etc-security">/etc/security/*</primary>
140 </indexterm>
141
142 </sect3>
143
144 <sect3>
145 <title>Configuration Information</title>
146
147 <sect4 id="pam-login-defs">
148 <title>Configuring /etc/login.defs</title>
149
150 <para>The <command>login</command> program currently performs many
151 functions which <application>Linux-PAM</application> modules should
152 now handle. The following <command>sed</command> command will comment
153 out the appropriate lines in <filename>/etc/login.defs</filename>, and
154 stop <command>login</command> from performing these functions (a backup
155 file named <filename>/etc/login.defs.orig</filename> is also created
156 to preserve the original file's contents). Issue the following commands
157 as the <systemitem class="username">root</systemitem> user:</para>
158
159 <indexterm zone="shadow pam-login-defs">
160 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
161 </indexterm>
162
163<screen role="root"><userinput>install -v -m644 /etc/login.defs /etc/login.defs.orig &amp;&amp;
164for FUNCTION in LASTLOG_ENAB MAIL_CHECK_ENAB \
165 PORTTIME_CHECKS_ENAB CONSOLE \
166 MOTD_FILE NOLOGINS_FILE PASS_MIN_LEN \
167 SU_WHEEL_ONLY MD5_CRYPT_ENAB \
168 CONSOLE_GROUPS ENVIRON_FILE \
169 ULIMIT ENV_TZ ENV_HZ ENV_SUPATH \
170 ENV_PATH QMAIL_DIR MAIL_DIR MAIL_FILE \
171 CHFN_AUTH FAILLOG_ENAB QUOTAS_ENAB FTMP_FILE
172do
173 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
174done</userinput></screen>
175
176 <para>If you have <application>CrackLib</application> installed,
177 also comment out four more lines using the following command as the
178 <systemitem class="username">root</systemitem> user:</para>
179
180<screen role="root"><userinput>for FUNCTION in OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
181 PASS_CHANGE_TRIES PASS_ALWAYS_WARN
182do
183 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
184done</userinput></screen>
185
186 </sect4>
187
188 <sect4>
189 <title>Configuring the /etc/pam.d/ Files</title>
190
191 <para>Add the following <application>Linux-PAM</application> configuration
192 files to <filename class="directory">/etc/pam.d/</filename> (or add them
193 to <filename>/etc/pam.conf</filename> with the additional field for
194 the program). Issue the commands as the
195 <systemitem class="username">root</systemitem> user:</para>
196
197 </sect4>
198
199 <sect4>
200 <title>'login' (with CrackLib)</title>
201
202<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
203<literal># Begin /etc/pam.d/login
204
205auth requisite pam_securetty.so
206auth requisite pam_nologin.so
207auth required pam_unix.so
208account required pam_access.so
209account required pam_unix.so
210session required pam_env.so
211session required pam_motd.so
212session required pam_limits.so
213session optional pam_mail.so dir=/var/mail standard
214session optional pam_lastlog.so
215session required pam_unix.so
216password required pam_cracklib.so retry=3 difok=8 minlen=5 \
217 dcredit=3 ocredit=3 \
218 ucredit=2 lcredit=2
219password required pam_unix.so md5 shadow use_authtok
220
221# End /etc/pam.d/login</literal>
222EOF</userinput></screen>
223
224 </sect4>
225
226 <sect4>
227 <title>'login' (without CrackLib)</title>
228
229<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
230<literal># Begin /etc/pam.d/login
231
232auth requisite pam_securetty.so
233auth requisite pam_nologin.so
234auth required pam_env.so
235auth required pam_unix.so
236account required pam_access.so
237account required pam_unix.so
238session required pam_motd.so
239session required pam_limits.so
240session optional pam_mail.so dir=/var/mail standard
241session optional pam_lastlog.so
242session required pam_unix.so
243password required pam_unix.so md5 shadow
244
245# End /etc/pam.d/login</literal>
246EOF</userinput></screen>
247
248 </sect4>
249
250 <sect4>
251 <title>'passwd' (with CrackLib)</title>
252
253<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
254<literal># Begin /etc/pam.d/passwd
255
256password required pam_cracklib.so retry=3 difok=8 minlen=5 \
257 dcredit=3 ocredit=3 \
258 ucredit=2 lcredit=2
259password required pam_unix.so md5 shadow use_authtok
260
261# End /etc/pam.d/passwd</literal>
262EOF</userinput></screen>
263
264 </sect4>
265
266 <sect4>
267 <title>'passwd' (without CrackLib)</title>
268
269<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
270<literal># Begin /etc/pam.d/passwd
271
272password required pam_unix.so md5 shadow
273
274# End /etc/pam.d/passwd</literal>
275EOF</userinput></screen>
276
277 </sect4>
278
279 <sect4>
280 <title>'su'</title>
281
282<screen role="root"><userinput>cat &gt; /etc/pam.d/su &lt;&lt; "EOF"
283<literal># Begin /etc/pam.d/su
284
285auth sufficient pam_rootok.so
286auth required pam_unix.so
287account required pam_unix.so
288session optional pam_mail.so dir=/var/mail standard
289session required pam_env.so
290session required pam_unix.so
291
292# End /etc/pam.d/su</literal>
293EOF</userinput></screen>
294
295 </sect4>
296
297 <sect4>
298 <title>'chage'</title>
299
300<screen role="root"><userinput>cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"
301<literal># Begin /etc/pam.d/chage
302
303auth sufficient pam_rootok.so
304auth required pam_unix.so
305account required pam_unix.so
306session required pam_unix.so
307password required pam_permit.so
308
309# End /etc/pam.d/chage</literal>
310EOF</userinput></screen>
311
312 </sect4>
313
314 <sect4>
315 <title>'chpasswd', 'newusers', 'groupadd', 'groupdel',
316 'groupmod', 'useradd', 'userdel', and 'usermod'</title>
317
318<screen role="root"><userinput>for PROGRAM in chpasswd newusers groupadd groupdel \
319 groupmod useradd userdel usermod
320do
321 install -v -m644 /etc/pam.d/chage /etc/pam.d/$PROGRAM
322 sed -i "s/chage/$PROGRAM/" /etc/pam.d/$PROGRAM
323done</userinput></screen>
324
325 <warning>
326 <para>At this point, you should do a simple test to see if
327 <application>Shadow</application> is working as expected. Open
328 another terminal and log in as a user, then <command>su</command> to
329 <systemitem class="username">root</systemitem>. If you do not see any
330 errors, then all is well and you should proceed with the rest of the
331 configuration. If you did receive errors, stop now and double check
332 the above configuration files manually. If you cannot find and
333 fix the error, you should recompile <application>Shadow</application>
334 replacing <option>--with-libpam</option> with
335 <option>--without-libpam</option> in the above instructions (also move
336 the <filename>/etc/login.defs.orig</filename> backup file to
337 <filename>/etc/login.defs</filename>). If you
338 fail to do this and the errors remain, you will be unable to log into
339 your system.</para>
340 </warning>
341
342 </sect4>
343
344 <sect4>
345 <title>Other</title>
346
347 <para>Currently, <filename>/etc/pam.d/other</filename> is configured
348 to allow anyone with an account on the machine to use PAM-aware
349 programs without a configuration file for that program. After testing
350 <application>Linux-PAM</application> for proper configuration, install
351 a more restrictive <filename>other</filename> file so that
352 program-specific configuration files are required:</para>
353
354<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
355<literal># Begin /etc/pam.d/other
356
357auth required pam_deny.so
358auth required pam_warn.so
359account required pam_deny.so
360session required pam_deny.so
361password required pam_deny.so
362password required pam_warn.so
363
364# End /etc/pam.d/other</literal>
365EOF</userinput></screen>
366
367 </sect4>
368
369 <sect4 id="pam-access">
370 <title>Configuring Login Access</title>
371
372 <para>Instead of using the <filename>/etc/login.access</filename>
373 file for controlling access to the system,
374 <application>Linux-PAM</application> uses the
375 <filename class='libraryfile'>pam_access.so</filename> module along
376 with the <filename>/etc/security/access.conf</filename> file. Rename
377 the <filename>/etc/login.access</filename> file using the following
378 command:</para>
379
380 <indexterm zone="shadow pam-access">
381 <primary sortas="e-etc-security-access.conf">/etc/security/access.conf</primary>
382 </indexterm>
383
384<screen role="root"><userinput>if [ -f /etc/login.access ]; then
385 mv -v /etc/login.access /etc/login.access.NOUSE
386fi</userinput></screen>
387
388 </sect4>
389
390 <sect4 id="pam-limits">
391 <title>Configuring Resource Limits</title>
392
393 <para>Instead of using the <filename>/etc/limits</filename> file
394 for limiting usage of system resources,
395 <application>Linux-PAM</application> uses the
396 <filename class='libraryfile'>pam_limits.so</filename> module along
397 with the <filename>/etc/security/limits.conf</filename> file. Rename
398 the <filename>/etc/limits</filename> file using the following
399 command:</para>
400
401 <indexterm zone="shadow pam-limits">
402 <primary sortas="e-etc-security-limits.conf">/etc/security/limits.conf</primary>
403 </indexterm>
404
405<screen role="root"><userinput>if [ -f /etc/limits ]; then
406 mv -v /etc/limits /etc/limits.NOUSE
407fi</userinput></screen>
408
409 </sect4>
410
411 <sect4 id="pam-env">
412 <title>Configuring Default Environment</title>
413
414 <para>During previous configuration, several items were removed from
415 <filename>/etc/login.defs</filename>. Some of these items are now
416 controlled by the <filename class='libraryfile'>pam_env.so</filename>
417 module and the <filename>/etc/security/pam_env.conf</filename>
418 configuration file. In particular, the default path has been
419 changed. To recover your default path, execute the following
420 commands:</para>
421
422<screen role="root"><userinput>ENV_PATH=`grep '^ENV_PATH' /etc/login.defs.orig | \
423 awk '{ print $2 }' | sed 's/PATH=//'` &amp;&amp;
424echo 'PATH DEFAULT='`echo "${ENV_PATH}"`\
425' OVERRIDE=${PATH}' \
426 >> /etc/security/pam_env.conf &amp;&amp;
427unset ENV_PATH</userinput></screen>
428
429 <note>
430 <para>ENV_SUPATH is no longer supported. You must create
431 a valid <filename>/root/.bashrc</filename> file to provide a
432 modified path for the super-user.</para>
433 </note>
434
435 </sect4>
436
437 </sect3>
438
439 </sect2>
440
441 <sect2 role="content">
442 <title>Contents</title>
443
444 <para>A list of the installed files, along with their short descriptions
445 can be found at
446 <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.</para>
447
448 </sect2>
449
450</sect1>
Note: See TracBrowser for help on using the repository browser.