source: postlfs/security/shadow.xml@ f4797d2

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since f4797d2 was f4797d2, checked in by Guy Dalziel <gdalziel@…>, 15 years ago

Updated to Shadow-4.1.4.2.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@7898 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 22.2 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY shadow-download-http " ">
8 <!ENTITY shadow-download-ftp "ftp://pkg-shadow.alioth.debian.org/pub/pkg-shadow/shadow-&shadow-version;.tar.bz2">
9 <!ENTITY shadow-md5sum "d593a9cab93c48ee0a6ba056db8c1997">
10 <!ENTITY shadow-size "1.8 MB">
11 <!ENTITY shadow-buildsize "30 MB">
12 <!ENTITY shadow-time "0.3 SBU">
13]>
14
15<sect1 id="shadow" xreflabel="Shadow-&shadow-version;">
16 <?dbhtml filename="shadow.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Shadow-&shadow-version;</title>
24
25 <indexterm zone="shadow">
26 <primary sortas="a-Shadow">Shadow</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Shadow</title>
31
32 <para><application>Shadow</application> was indeed installed in LFS and
33 there is no reason to reinstall it unless you installed
34 <application>CrackLib</application> or
35 <application>Linux-PAM</application> after your LFS system was completed.
36 If you have installed <application>CrackLib</application> after LFS, then
37 reinstalling <application>Shadow</application> will enable strong password
38 support. If you have installed <application>Linux-PAM</application>,
39 reinstalling <application>Shadow</application> will allow programs such as
40 <command>login</command> and <command>su</command> to utilize PAM.</para>
41
42 &lfs65_checked;
43
44 <bridgehead renderas="sect3">Package Information</bridgehead>
45 <itemizedlist spacing="compact">
46 <listitem>
47 <para>Download (HTTP): <ulink url="&shadow-download-http;"/></para>
48 </listitem>
49 <listitem>
50 <para>Download (FTP): <ulink url="&shadow-download-ftp;"/></para>
51 </listitem>
52 <listitem>
53 <para>Download MD5 sum: &shadow-md5sum;</para>
54 </listitem>
55 <listitem>
56 <para>Download size: &shadow-size;</para>
57 </listitem>
58 <listitem>
59 <para>Estimated disk space required: &shadow-buildsize;</para>
60 </listitem>
61 <listitem>
62 <para>Estimated build time: &shadow-time;</para>
63 </listitem>
64 </itemizedlist>
65
66 <!-- <bridgehead renderas="sect3">Additional Downloads</bridgehead>
67 <itemizedlist spacing='compact'>
68 <listitem>
69 <para>Required patch: <ulink
70 url="&patch-root;/shadow-&shadow-version;-useradd_fix-2.patch"/></para>
71 </listitem>
72 </itemizedlist> -->
73
74 <bridgehead renderas="sect3">Shadow Dependencies</bridgehead>
75
76 <bridgehead renderas="sect4">Required</bridgehead>
77 <para role="required"><xref linkend="linux-pam"/> and/or
78 <xref linkend="cracklib"/></para>
79
80 <para condition="html" role="usernotes">User Notes:
81 <ulink url="&blfs-wiki;/shadow"/></para>
82
83 </sect2>
84
85 <sect2 role="installation">
86 <title>Installation of Shadow</title>
87
88 <important>
89 <para>The installation commands shown below are for installations where
90 <application>Linux-PAM</application> has been installed (with or
91 without a <application>CrackLib</application> installation) and
92 <application>Shadow</application> is being reinstalled to support the
93 <application>Linux-PAM</application> installation.</para>
94
95 <para> If you are reinstalling <application>Shadow</application> to
96 provide strong password support using the
97 <application>CrackLib</application> library without using
98 <application>Linux-PAM</application>, ensure you add the
99 <parameter>--with-libcrack</parameter> parameter to the
100 <command>configure</command> script below and also issue the following
101 command:</para>
102
103<screen><userinput>sed -i 's@DICTPATH.*@DICTPATH\t/lib/cracklib/pw_dict@' etc/login.defs</userinput></screen>
104 </important>
105
106 <para>Reinstall <application>Shadow</application> by running the following
107 commands:</para>
108
109<screen><userinput>sed -i 's/groups$(EXEEXT) //' src/Makefile.in &amp;&amp;
110find man -name Makefile.in -exec sed -i 's/groups\.1 / /' {} \; &amp;&amp;
111sed -i -e 's/ ko//' -e 's/ zh_CN zh_TW//' man/Makefile.in &amp;&amp;
112
113for i in de fi fr id it pt_BR; do
114 convert-mans UTF-8 ISO-8859-1 man/${i}/*.?
115done &amp;&amp;
116
117for i in cs hu pl; do
118 convert-mans UTF-8 ISO-8859-2 man/${i}/*.?
119done &amp;&amp;
120
121convert-mans UTF-8 EUC-JP man/ja/*.? &amp;&amp;
122convert-mans UTF-8 KOI8-R man/ru/*.? &amp;&amp;
123convert-mans UTF-8 ISO-8859-9 man/tr/*.? &amp;&amp;
124
125sed -i -e 's@#ENCRYPT_METHOD DES@ENCRYPT_METHOD MD5@' \
126 -e 's@/var/spool/mail@/var/mail@' etc/login.defs &amp;&amp;
127
128./configure --sysconfdir=/etc &amp;&amp;
129make</userinput></screen>
130
131 <para>This package does not come with a test suite.</para>
132
133 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
134
135<screen role="root"><userinput>make install &amp;&amp;
136mv -v /usr/bin/passwd /bin</userinput></screen>
137
138 </sect2>
139
140 <sect2 role="commands">
141 <title>Command Explanations</title>
142
143 <para><command>sed -i 's/groups$(EXEEXT) //' src/Makefile.in</command>:
144 This command is used to suppress the installation of the
145 <command>groups</command> program as the version from the
146 <application>Coreutils</application> package installed during LFS is
147 preferred.</para>
148
149 <para><command>find man -name Makefile.in -exec ... {} \;</command>: This
150 command is used to suppress the installation of the
151 <command>groups</command> man pages so the existing ones installed from
152 the <application>Coreutils</application> package are not replaced.</para>
153
154 <para><command>sed -i -e '...' -e '...' man/Makefile.in</command>: This
155 command disables the installation of Chinese and Korean manual pages, since
156 <application>Man-DB</application> cannot format them properly.</para>
157
158 <para><command>convert-mans ...</command>: These commands are used to
159 convert some of the man pages so that <application>Man-DB</application>
160 will display them in the expected encodings.</para>
161
162 <para><command>sed -i -e 's@#ENCRYPT_METHOD DES@ENCRYPT_METHOD MD5@'
163 -e 's@/var/spool/mail@/var/mail@' etc/login.defs</command>:
164 Instead of using the default 'crypt' method, this command modifies the
165 installation to use the more secure 'MD5' method of password encryption,
166 which also allows passwords longer than eight characters. It also changes
167 the obsolete <filename class="directory">/var/spool/mail</filename>
168 location for user mailboxes that <application>Shadow</application> uses by
169 default to the <filename class="directory">/var/mail</filename>
170 location.</para>
171
172 <para><command>mv -v /usr/bin/passwd /bin</command>: The
173 <command>passwd</command> program may be needed during times when the
174 <filename class='directory'>/usr</filename> filesystem is not mounted so
175 it is moved into the root partition.</para>
176
177 </sect2>
178
179 <sect2 role="configuration">
180 <title>Configuring Shadow</title>
181
182 <para><application>Shadow</application>'s stock configuration for the
183 <command>useradd</command> utility may not be desirable for your
184 installation. One default parameter causes <command>useradd</command> to
185 create a mailbox file for any newly created user.
186 <command>useradd</command> will make the group ownership of this file to
187 the <systemitem class="groupname">mail</systemitem> group with 0660
188 permissions. If you would prefer that these mailbox files are not created
189 by <command>useradd</command>, issue the
190 following command as the <systemitem class="username">root</systemitem> user:</para>
191
192<screen role="root"><userinput>sed -i 's/yes/no/' /etc/default/useradd</userinput></screen>
193
194 </sect2>
195
196 <sect2 role="configuration">
197 <title>Configuring Linux-PAM to Work with Shadow</title>
198
199 <note>
200 <para>The rest of this page is devoted to configuring
201 <application>Shadow</application> to work properly with
202 <application>Linux-PAM</application>. If you do not have
203 <application>Linux-PAM</application> installed, and you reinstalled
204 <application>Shadow</application> to support strong passwords via
205 the <application>CrackLib</application> library, no further configuration
206 is required.</para>
207 </note>
208
209 <sect3 id="pam.d">
210 <title>Config Files</title>
211
212 <para><filename>/etc/pam.d/*</filename> or alternatively
213 <filename>/etc/pam.conf, /etc/login.defs, and
214 /etc/security/*</filename></para>
215
216 <indexterm zone="shadow pam.d">
217 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
218 </indexterm>
219
220 <indexterm zone="shadow pam.d">
221 <primary sortas="e-etc-pam.conf">/etc/pam.conf</primary>
222 </indexterm>
223
224 <indexterm zone="shadow pam.d">
225 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
226 </indexterm>
227
228 <indexterm zone="shadow pam.d">
229 <primary sortas="e-etc-security">/etc/security/*</primary>
230 </indexterm>
231
232 </sect3>
233
234 <sect3>
235 <title>Configuration Information</title>
236
237 <para>Configuring your system to use <application>Linux-PAM</application>
238 can be a complex task. The information below will provide a basic setup
239 so that <application>Shadow</application>'s login and password
240 functionality will work effectively with
241 <application>Linux-PAM</application>. Review the information and links on
242 the <xref linkend="linux-pam"/> page for further configuration
243 information. For information specific to integrating
244 <application>Shadow</application>, <application>Linux-PAM</application>
245 and <application>CrackLib</application>, you can visit the following
246 links:</para>
247
248 <itemizedlist spacing="compact">
249 <listitem>
250 <para><ulink
251 url="http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam-6.html#ss6.3"/></para>
252 </listitem>
253 <listitem>
254 <para><ulink
255 url="http://www.deer-run.com/~hal/sysadmin/pam_cracklib.html"/></para>
256 </listitem>
257 </itemizedlist>
258
259 <sect4 id="pam-login-defs">
260 <title>Configuring /etc/login.defs</title>
261
262 <para>The <command>login</command> program currently performs many
263 functions which <application>Linux-PAM</application> modules should
264 now handle. The following <command>sed</command> command will comment
265 out the appropriate lines in <filename>/etc/login.defs</filename>, and
266 stop <command>login</command> from performing these functions (a backup
267 file named <filename>/etc/login.defs.orig</filename> is also created
268 to preserve the original file's contents). Issue the following commands
269 as the <systemitem class="username">root</systemitem> user:</para>
270
271 <indexterm zone="shadow pam-login-defs">
272 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
273 </indexterm>
274
275<screen role="root"><userinput>install -v -m644 /etc/login.defs /etc/login.defs.orig &amp;&amp;
276for FUNCTION in LASTLOG_ENAB MAIL_CHECK_ENAB \
277 PORTTIME_CHECKS_ENAB CONSOLE \
278 MOTD_FILE NOLOGINS_FILE PASS_MIN_LEN \
279 SU_WHEEL_ONLY MD5_CRYPT_ENAB \
280 CONSOLE_GROUPS ENVIRON_FILE \
281 ULIMIT ENV_TZ ENV_HZ ENV_SUPATH \
282 ENV_PATH QMAIL_DIR MAIL_DIR MAIL_FILE \
283 CHFN_AUTH FAILLOG_ENAB QUOTAS_ENAB FTMP_FILE \
284 OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
285 PASS_CHANGE_TRIES PASS_ALWAYS_WARN ISSUE_FILE
286do
287 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
288done</userinput></screen>
289
290 </sect4>
291
292 <sect4>
293 <title>Configuring the /etc/pam.d/ Files</title>
294
295 <para>As mentioned previously in the
296 <application>Linux-PAM</application> instructions,
297 <application>Linux-PAM</application> has two supported methods for
298 configuration. The commands below assume that you've chosen to use
299 a directory based configuration, where each program has its own
300 configuration file. You can optionally use a single
301 <filename>/etc/pam.conf</filename> configuration file by using the
302 text from the files below, and supplying the program name as an
303 additional first field for each line.</para>
304
305 <para>As the <systemitem class="username">root</systemitem> user,
306 replace the following <application>Linux-PAM</application>
307 configuration files in the
308 <filename class="directory">/etc/pam.d/</filename> directory (or
309 add the contents to the <filename>/etc/pam.conf</filename> file) using
310 the following commands:</para>
311
312 </sect4>
313
314 <sect4>
315 <title>'login' (with CrackLib)</title>
316
317<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
318<literal># Begin /etc/pam.d/login
319
320auth requisite pam_nologin.so
321auth required pam_securetty.so
322auth required pam_unix.so
323account required pam_access.so
324account required pam_unix.so
325session required pam_env.so
326session required pam_motd.so
327session required pam_limits.so
328session optional pam_mail.so dir=/var/mail standard
329session optional pam_lastlog.so
330session required pam_unix.so
331password required pam_cracklib.so retry=3
332password required pam_unix.so md5 shadow use_authtok
333
334# End /etc/pam.d/login</literal>
335EOF</userinput></screen>
336
337 </sect4>
338
339 <sect4>
340 <title>'login' (without CrackLib)</title>
341
342<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
343<literal># Begin /etc/pam.d/login
344
345auth requisite pam_nologin.so
346auth required pam_securetty.so
347auth required pam_env.so
348auth required pam_unix.so
349account required pam_access.so
350account required pam_unix.so
351session required pam_motd.so
352session required pam_limits.so
353session optional pam_mail.so dir=/var/mail standard
354session optional pam_lastlog.so
355session required pam_unix.so
356password required pam_unix.so md5 shadow
357
358# End /etc/pam.d/login</literal>
359EOF</userinput></screen>
360
361 </sect4>
362
363 <sect4>
364 <title>'passwd' (with CrackLib)</title>
365
366<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
367<literal># Begin /etc/pam.d/passwd
368
369password required pam_cracklib.so type=Linux retry=1 \
370 difok=5 diffignore=23 minlen=9 \
371 dcredit=1 ucredit=1 lcredit=1 \
372 ocredit=1 \
373 dictpath=/lib/cracklib/pw_dict
374password required pam_unix.so md5 shadow use_authtok
375
376# End /etc/pam.d/passwd</literal>
377EOF</userinput></screen>
378
379 <note><para>In its default configuration, owing to credits,
380 pam_cracklib will allow multiple case passwords as short as 6
381 characters, even with the <parameter>minlen</parameter> value
382 set to 11. You should review the pam_cracklib(8) man page and
383 determine if these default values are acceptable for the security
384 of your system.</para></note>
385
386 </sect4>
387
388 <sect4>
389 <title>'passwd' (without CrackLib)</title>
390
391<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
392<literal># Begin /etc/pam.d/passwd
393
394password required pam_unix.so md5 shadow
395
396# End /etc/pam.d/passwd</literal>
397EOF</userinput></screen>
398
399 </sect4>
400
401 <sect4>
402 <title>'su'</title>
403
404<screen role="root"><userinput>cat &gt; /etc/pam.d/su &lt;&lt; "EOF"
405<literal># Begin /etc/pam.d/su
406
407auth sufficient pam_rootok.so
408auth required pam_unix.so
409account required pam_unix.so
410session optional pam_mail.so dir=/var/mail standard
411session optional pam_xauth.so
412session required pam_env.so
413session required pam_unix.so
414
415# End /etc/pam.d/su</literal>
416EOF</userinput></screen>
417
418 </sect4>
419
420 <sect4>
421 <title>'chage'</title>
422
423<screen role="root"><userinput>cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"
424<literal># Begin /etc/pam.d/chage
425
426auth sufficient pam_rootok.so
427auth required pam_unix.so
428account required pam_unix.so
429session required pam_unix.so
430password required pam_permit.so
431
432# End /etc/pam.d/chage</literal>
433EOF</userinput></screen>
434
435 </sect4>
436
437 <sect4>
438 <title>'chfn', 'chgpasswd', 'chgpasswd', 'chsh', 'groupadd',
439 'groupdel', 'groupmems', 'groupmod', 'newusers', 'useradd', 'userdel'
440 and 'usermod'</title>
441
442<screen role="root"><userinput>for PROGRAM in chfn chgpasswd chpasswd chsh groupadd groupdel \
443 groupmems groupmod newusers useradd userdel usermod
444do
445 install -v -m644 /etc/pam.d/chage /etc/pam.d/$PROGRAM
446 sed -i "s/chage/$PROGRAM/" /etc/pam.d/$PROGRAM
447done</userinput></screen>
448
449 <warning>
450 <para>At this point, you should do a simple test to see if
451 <application>Shadow</application> is working as expected. Open
452 another terminal and log in as a user, then <command>su</command> to
453 <systemitem class="username">root</systemitem>. If you do not see any
454 errors, then all is well and you should proceed with the rest of the
455 configuration. If you did receive errors, stop now and double check
456 the above configuration files manually. You can also run the test
457 suite from the <application>Linux-PAM</application> package to assist
458 you in determining the problem. If you cannot find and
459 fix the error, you should recompile <application>Shadow</application>
460 adding the <option>--without-libpam</option> switch to the
461 <command>configure</command> command in the above instructions
462 (also move the <filename>/etc/login.defs.orig</filename> backup
463 file to <filename>/etc/login.defs</filename>). If you
464 fail to do this and the errors remain, you will be unable to log into
465 your system.</para>
466 </warning>
467
468 </sect4>
469
470 <sect4>
471 <title>Other</title>
472
473 <para>Currently, <filename>/etc/pam.d/other</filename> is configured
474 to allow anyone with an account on the machine to use PAM-aware
475 programs without a configuration file for that program. After testing
476 <application>Linux-PAM</application> for proper configuration, install
477 a more restrictive <filename>other</filename> file so that
478 program-specific configuration files are required:</para>
479
480<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
481<literal># Begin /etc/pam.d/other
482
483auth required pam_deny.so
484auth required pam_warn.so
485account required pam_deny.so
486account required pam_warn.so
487password required pam_deny.so
488password required pam_warn.so
489session required pam_deny.so
490session required pam_warn.so
491
492# End /etc/pam.d/other</literal>
493EOF</userinput></screen>
494
495 </sect4>
496
497 <sect4 id="pam-access">
498 <title>Configuring Login Access</title>
499
500 <para>Instead of using the <filename>/etc/login.access</filename>
501 file for controlling access to the system,
502 <application>Linux-PAM</application> uses the
503 <filename class='libraryfile'>pam_access.so</filename> module along
504 with the <filename>/etc/security/access.conf</filename> file. Rename
505 the <filename>/etc/login.access</filename> file using the following
506 command:</para>
507
508 <indexterm zone="shadow pam-access">
509 <primary sortas="e-etc-security-access.conf">/etc/security/access.conf</primary>
510 </indexterm>
511
512<screen role="root"><userinput>if [ -f /etc/login.access ]; then
513 mv -v /etc/login.access /etc/login.access.NOUSE
514fi</userinput></screen>
515
516 </sect4>
517
518 <sect4 id="pam-limits">
519 <title>Configuring Resource Limits</title>
520
521 <para>Instead of using the <filename>/etc/limits</filename> file
522 for limiting usage of system resources,
523 <application>Linux-PAM</application> uses the
524 <filename class='libraryfile'>pam_limits.so</filename> module along
525 with the <filename>/etc/security/limits.conf</filename> file. Rename
526 the <filename>/etc/limits</filename> file using the following
527 command:</para>
528
529 <indexterm zone="shadow pam-limits">
530 <primary sortas="e-etc-security-limits.conf">/etc/security/limits.conf</primary>
531 </indexterm>
532
533<screen role="root"><userinput>if [ -f /etc/limits ]; then
534 mv -v /etc/limits /etc/limits.NOUSE
535fi</userinput></screen>
536
537 </sect4>
538
539 <sect4 id="pam-env">
540 <title>Configuring Default Environment</title>
541
542 <para>During previous configuration, several items were removed from
543 <filename>/etc/login.defs</filename>. Some of these items are now
544 controlled by the <filename class='libraryfile'>pam_env.so</filename>
545 module and the <filename>/etc/security/pam_env.conf</filename>
546 configuration file. In particular, the default path has been
547 changed. To recover your default path, execute the following
548 commands:</para>
549
550<screen role="root"><userinput>ENV_PATH=`grep '^ENV_PATH' /etc/login.defs.orig | \
551 awk '{ print $2 }' | sed 's/PATH=//'` &amp;&amp;
552echo 'PATH DEFAULT='`echo "${ENV_PATH}"`\
553' OVERRIDE=${PATH}' \
554 >> /etc/security/pam_env.conf &amp;&amp;
555unset ENV_PATH</userinput></screen>
556
557 <note>
558 <para>ENV_SUPATH is no longer supported. You must create
559 a valid <filename>/root/.bashrc</filename> file to provide a
560 modified path for the super-user.</para>
561 </note>
562
563 </sect4>
564
565 </sect3>
566
567 </sect2>
568
569 <sect2 role="content">
570 <title>Contents</title>
571
572 <para>A list of the installed files, along with their short descriptions
573 can be found at
574 <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.</para>
575
576 </sect2>
577
578</sect1>
Note: See TracBrowser for help on using the repository browser.