source: postlfs/security/shadow.xml@ fe45ecd

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since fe45ecd was fe45ecd, checked in by DJ Lucas <dj@…>, 15 years ago

Removed/replaced convert-mans commands.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@7936 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 21.5 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY shadow-download-http " ">
8 <!ENTITY shadow-download-ftp "ftp://pkg-shadow.alioth.debian.org/pub/pkg-shadow/shadow-&shadow-version;.tar.bz2">
9 <!ENTITY shadow-md5sum "d593a9cab93c48ee0a6ba056db8c1997">
10 <!ENTITY shadow-size "1.8 MB">
11 <!ENTITY shadow-buildsize "30 MB">
12 <!ENTITY shadow-time "0.3 SBU">
13]>
14
15<sect1 id="shadow" xreflabel="Shadow-&shadow-version;">
16 <?dbhtml filename="shadow.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Shadow-&shadow-version;</title>
24
25 <indexterm zone="shadow">
26 <primary sortas="a-Shadow">Shadow</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Shadow</title>
31
32 <para><application>Shadow</application> was indeed installed in LFS and
33 there is no reason to reinstall it unless you installed
34 <application>CrackLib</application> or
35 <application>Linux-PAM</application> after your LFS system was completed.
36 If you have installed <application>CrackLib</application> after LFS, then
37 reinstalling <application>Shadow</application> will enable strong password
38 support. If you have installed <application>Linux-PAM</application>,
39 reinstalling <application>Shadow</application> will allow programs such as
40 <command>login</command> and <command>su</command> to utilize PAM.</para>
41
42 &lfs65_checked;
43
44 <bridgehead renderas="sect3">Package Information</bridgehead>
45 <itemizedlist spacing="compact">
46 <listitem>
47 <para>Download (HTTP): <ulink url="&shadow-download-http;"/></para>
48 </listitem>
49 <listitem>
50 <para>Download (FTP): <ulink url="&shadow-download-ftp;"/></para>
51 </listitem>
52 <listitem>
53 <para>Download MD5 sum: &shadow-md5sum;</para>
54 </listitem>
55 <listitem>
56 <para>Download size: &shadow-size;</para>
57 </listitem>
58 <listitem>
59 <para>Estimated disk space required: &shadow-buildsize;</para>
60 </listitem>
61 <listitem>
62 <para>Estimated build time: &shadow-time;</para>
63 </listitem>
64 </itemizedlist>
65
66 <!-- <bridgehead renderas="sect3">Additional Downloads</bridgehead>
67 <itemizedlist spacing='compact'>
68 <listitem>
69 <para>Required patch: <ulink
70 url="&patch-root;/shadow-&shadow-version;-useradd_fix-2.patch"/></para>
71 </listitem>
72 </itemizedlist> -->
73
74 <bridgehead renderas="sect3">Shadow Dependencies</bridgehead>
75
76 <bridgehead renderas="sect4">Required</bridgehead>
77 <para role="required"><xref linkend="linux-pam"/> and/or
78 <xref linkend="cracklib"/></para>
79
80 <para condition="html" role="usernotes">User Notes:
81 <ulink url="&blfs-wiki;/shadow"/></para>
82
83 </sect2>
84
85 <sect2 role="installation">
86 <title>Installation of Shadow</title>
87
88 <important>
89 <para>The installation commands shown below are for installations where
90 <application>Linux-PAM</application> has been installed (with or
91 without a <application>CrackLib</application> installation) and
92 <application>Shadow</application> is being reinstalled to support the
93 <application>Linux-PAM</application> installation.</para>
94
95 <para> If you are reinstalling <application>Shadow</application> to
96 provide strong password support using the
97 <application>CrackLib</application> library without using
98 <application>Linux-PAM</application>, ensure you add the
99 <parameter>--with-libcrack</parameter> parameter to the
100 <command>configure</command> script below and also issue the following
101 command:</para>
102
103<screen><userinput>sed -i 's@DICTPATH.*@DICTPATH\t/lib/cracklib/pw_dict@' etc/login.defs</userinput></screen>
104 </important>
105
106 <para>Reinstall <application>Shadow</application> by running the following
107 commands:</para>
108
109<screen><userinput>sed -i 's/groups$(EXEEXT) //' src/Makefile.in &amp;&amp;
110find man -name Makefile.in -exec sed -i 's/groups\.1 / /' {} \; &amp;&amp;
111sed -i -e 's/ ko//' -e 's/ zh_CN zh_TW//' man/Makefile.in &amp;&amp;
112
113sed -i -e 's@#ENCRYPT_METHOD DES@ENCRYPT_METHOD MD5@' \
114 -e 's@/var/spool/mail@/var/mail@' etc/login.defs &amp;&amp;
115
116./configure --sysconfdir=/etc &amp;&amp;
117make</userinput></screen>
118
119 <para>This package does not come with a test suite.</para>
120
121 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
122
123<screen role="root"><userinput>make install &amp;&amp;
124mv -v /usr/bin/passwd /bin</userinput></screen>
125
126 </sect2>
127
128 <sect2 role="commands">
129 <title>Command Explanations</title>
130
131 <para><command>sed -i 's/groups$(EXEEXT) //' src/Makefile.in</command>:
132 This command is used to suppress the installation of the
133 <command>groups</command> program as the version from the
134 <application>Coreutils</application> package installed during LFS is
135 preferred.</para>
136
137 <para><command>find man -name Makefile.in -exec ... {} \;</command>: This
138 command is used to suppress the installation of the
139 <command>groups</command> man pages so the existing ones installed from
140 the <application>Coreutils</application> package are not replaced.</para>
141
142 <para><command>sed -i -e '...' -e '...' man/Makefile.in</command>: This
143 command disables the installation of Chinese and Korean manual pages, since
144 <application>Man-DB</application> cannot format them properly.</para>
145
146 <para><command>sed -i -e 's@#ENCRYPT_METHOD DES@ENCRYPT_METHOD MD5@'
147 -e 's@/var/spool/mail@/var/mail@' etc/login.defs</command>:
148 Instead of using the default 'crypt' method, this command modifies the
149 installation to use the more secure 'MD5' method of password encryption,
150 which also allows passwords longer than eight characters. It also changes
151 the obsolete <filename class="directory">/var/spool/mail</filename>
152 location for user mailboxes that <application>Shadow</application> uses by
153 default to the <filename class="directory">/var/mail</filename>
154 location.</para>
155
156 <para><command>mv -v /usr/bin/passwd /bin</command>: The
157 <command>passwd</command> program may be needed during times when the
158 <filename class='directory'>/usr</filename> filesystem is not mounted so
159 it is moved into the root partition.</para>
160
161 </sect2>
162
163 <sect2 role="configuration">
164 <title>Configuring Shadow</title>
165
166 <para><application>Shadow</application>'s stock configuration for the
167 <command>useradd</command> utility may not be desirable for your
168 installation. One default parameter causes <command>useradd</command> to
169 create a mailbox file for any newly created user.
170 <command>useradd</command> will make the group ownership of this file to
171 the <systemitem class="groupname">mail</systemitem> group with 0660
172 permissions. If you would prefer that these mailbox files are not created
173 by <command>useradd</command>, issue the
174 following command as the <systemitem class="username">root</systemitem> user:</para>
175
176<screen role="root"><userinput>sed -i 's/yes/no/' /etc/default/useradd</userinput></screen>
177
178 </sect2>
179
180 <sect2 role="configuration">
181 <title>Configuring Linux-PAM to Work with Shadow</title>
182
183 <note>
184 <para>The rest of this page is devoted to configuring
185 <application>Shadow</application> to work properly with
186 <application>Linux-PAM</application>. If you do not have
187 <application>Linux-PAM</application> installed, and you reinstalled
188 <application>Shadow</application> to support strong passwords via
189 the <application>CrackLib</application> library, no further configuration
190 is required.</para>
191 </note>
192
193 <sect3 id="pam.d">
194 <title>Config Files</title>
195
196 <para><filename>/etc/pam.d/*</filename> or alternatively
197 <filename>/etc/pam.conf, /etc/login.defs, and
198 /etc/security/*</filename></para>
199
200 <indexterm zone="shadow pam.d">
201 <primary sortas="e-etc-pam.d">/etc/pam.d/*</primary>
202 </indexterm>
203
204 <indexterm zone="shadow pam.d">
205 <primary sortas="e-etc-pam.conf">/etc/pam.conf</primary>
206 </indexterm>
207
208 <indexterm zone="shadow pam.d">
209 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
210 </indexterm>
211
212 <indexterm zone="shadow pam.d">
213 <primary sortas="e-etc-security">/etc/security/*</primary>
214 </indexterm>
215
216 </sect3>
217
218 <sect3>
219 <title>Configuration Information</title>
220
221 <para>Configuring your system to use <application>Linux-PAM</application>
222 can be a complex task. The information below will provide a basic setup
223 so that <application>Shadow</application>'s login and password
224 functionality will work effectively with
225 <application>Linux-PAM</application>. Review the information and links on
226 the <xref linkend="linux-pam"/> page for further configuration
227 information. For information specific to integrating
228 <application>Shadow</application>, <application>Linux-PAM</application>
229 and <application>CrackLib</application>, you can visit the following
230 links:</para>
231
232 <itemizedlist spacing="compact">
233 <listitem>
234 <para><ulink
235 url="http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam-6.html#ss6.3"/></para>
236 </listitem>
237 <listitem>
238 <para><ulink
239 url="http://www.deer-run.com/~hal/sysadmin/pam_cracklib.html"/></para>
240 </listitem>
241 </itemizedlist>
242
243 <sect4 id="pam-login-defs">
244 <title>Configuring /etc/login.defs</title>
245
246 <para>The <command>login</command> program currently performs many
247 functions which <application>Linux-PAM</application> modules should
248 now handle. The following <command>sed</command> command will comment
249 out the appropriate lines in <filename>/etc/login.defs</filename>, and
250 stop <command>login</command> from performing these functions (a backup
251 file named <filename>/etc/login.defs.orig</filename> is also created
252 to preserve the original file's contents). Issue the following commands
253 as the <systemitem class="username">root</systemitem> user:</para>
254
255 <indexterm zone="shadow pam-login-defs">
256 <primary sortas="e-etc-login.defs">/etc/login.defs</primary>
257 </indexterm>
258
259<screen role="root"><userinput>install -v -m644 /etc/login.defs /etc/login.defs.orig &amp;&amp;
260for FUNCTION in LASTLOG_ENAB MAIL_CHECK_ENAB \
261 PORTTIME_CHECKS_ENAB CONSOLE \
262 MOTD_FILE NOLOGINS_FILE PASS_MIN_LEN \
263 SU_WHEEL_ONLY MD5_CRYPT_ENAB \
264 CONSOLE_GROUPS ENVIRON_FILE \
265 ULIMIT ENV_TZ ENV_HZ ENV_SUPATH \
266 ENV_PATH QMAIL_DIR MAIL_DIR MAIL_FILE \
267 CHFN_AUTH FAILLOG_ENAB QUOTAS_ENAB FTMP_FILE \
268 OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
269 PASS_CHANGE_TRIES PASS_ALWAYS_WARN ISSUE_FILE
270do
271 sed -i "s/^$FUNCTION/# &amp;/" /etc/login.defs
272done</userinput></screen>
273
274 </sect4>
275
276 <sect4>
277 <title>Configuring the /etc/pam.d/ Files</title>
278
279 <para>As mentioned previously in the
280 <application>Linux-PAM</application> instructions,
281 <application>Linux-PAM</application> has two supported methods for
282 configuration. The commands below assume that you've chosen to use
283 a directory based configuration, where each program has its own
284 configuration file. You can optionally use a single
285 <filename>/etc/pam.conf</filename> configuration file by using the
286 text from the files below, and supplying the program name as an
287 additional first field for each line.</para>
288
289 <para>As the <systemitem class="username">root</systemitem> user,
290 replace the following <application>Linux-PAM</application>
291 configuration files in the
292 <filename class="directory">/etc/pam.d/</filename> directory (or
293 add the contents to the <filename>/etc/pam.conf</filename> file) using
294 the following commands:</para>
295
296 </sect4>
297
298 <sect4>
299 <title>'login' (with CrackLib)</title>
300
301<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
302<literal># Begin /etc/pam.d/login
303
304auth requisite pam_nologin.so
305auth required pam_securetty.so
306auth required pam_unix.so
307account required pam_access.so
308account required pam_unix.so
309session required pam_env.so
310session required pam_motd.so
311session required pam_limits.so
312session optional pam_mail.so dir=/var/mail standard
313session optional pam_lastlog.so
314session required pam_unix.so
315password required pam_cracklib.so retry=3
316password required pam_unix.so md5 shadow use_authtok
317
318# End /etc/pam.d/login</literal>
319EOF</userinput></screen>
320
321 </sect4>
322
323 <sect4>
324 <title>'login' (without CrackLib)</title>
325
326<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
327<literal># Begin /etc/pam.d/login
328
329auth requisite pam_nologin.so
330auth required pam_securetty.so
331auth required pam_env.so
332auth required pam_unix.so
333account required pam_access.so
334account required pam_unix.so
335session required pam_motd.so
336session required pam_limits.so
337session optional pam_mail.so dir=/var/mail standard
338session optional pam_lastlog.so
339session required pam_unix.so
340password required pam_unix.so md5 shadow
341
342# End /etc/pam.d/login</literal>
343EOF</userinput></screen>
344
345 </sect4>
346
347 <sect4>
348 <title>'passwd' (with CrackLib)</title>
349
350<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
351<literal># Begin /etc/pam.d/passwd
352
353password required pam_cracklib.so type=Linux retry=1 \
354 difok=5 diffignore=23 minlen=9 \
355 dcredit=1 ucredit=1 lcredit=1 \
356 ocredit=1 \
357 dictpath=/lib/cracklib/pw_dict
358password required pam_unix.so md5 shadow use_authtok
359
360# End /etc/pam.d/passwd</literal>
361EOF</userinput></screen>
362
363 <note><para>In its default configuration, owing to credits,
364 pam_cracklib will allow multiple case passwords as short as 6
365 characters, even with the <parameter>minlen</parameter> value
366 set to 11. You should review the pam_cracklib(8) man page and
367 determine if these default values are acceptable for the security
368 of your system.</para></note>
369
370 </sect4>
371
372 <sect4>
373 <title>'passwd' (without CrackLib)</title>
374
375<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
376<literal># Begin /etc/pam.d/passwd
377
378password required pam_unix.so md5 shadow
379
380# End /etc/pam.d/passwd</literal>
381EOF</userinput></screen>
382
383 </sect4>
384
385 <sect4>
386 <title>'su'</title>
387
388<screen role="root"><userinput>cat &gt; /etc/pam.d/su &lt;&lt; "EOF"
389<literal># Begin /etc/pam.d/su
390
391auth sufficient pam_rootok.so
392auth required pam_unix.so
393account required pam_unix.so
394session optional pam_mail.so dir=/var/mail standard
395session optional pam_xauth.so
396session required pam_env.so
397session required pam_unix.so
398
399# End /etc/pam.d/su</literal>
400EOF</userinput></screen>
401
402 </sect4>
403
404 <sect4>
405 <title>'chage'</title>
406
407<screen role="root"><userinput>cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"
408<literal># Begin /etc/pam.d/chage
409
410auth sufficient pam_rootok.so
411auth required pam_unix.so
412account required pam_unix.so
413session required pam_unix.so
414password required pam_permit.so
415
416# End /etc/pam.d/chage</literal>
417EOF</userinput></screen>
418
419 </sect4>
420
421 <sect4>
422 <title>'chfn', 'chgpasswd', 'chgpasswd', 'chsh', 'groupadd',
423 'groupdel', 'groupmems', 'groupmod', 'newusers', 'useradd', 'userdel'
424 and 'usermod'</title>
425
426<screen role="root"><userinput>for PROGRAM in chfn chgpasswd chpasswd chsh groupadd groupdel \
427 groupmems groupmod newusers useradd userdel usermod
428do
429 install -v -m644 /etc/pam.d/chage /etc/pam.d/$PROGRAM
430 sed -i "s/chage/$PROGRAM/" /etc/pam.d/$PROGRAM
431done</userinput></screen>
432
433 <warning>
434 <para>At this point, you should do a simple test to see if
435 <application>Shadow</application> is working as expected. Open
436 another terminal and log in as a user, then <command>su</command> to
437 <systemitem class="username">root</systemitem>. If you do not see any
438 errors, then all is well and you should proceed with the rest of the
439 configuration. If you did receive errors, stop now and double check
440 the above configuration files manually. You can also run the test
441 suite from the <application>Linux-PAM</application> package to assist
442 you in determining the problem. If you cannot find and
443 fix the error, you should recompile <application>Shadow</application>
444 adding the <option>--without-libpam</option> switch to the
445 <command>configure</command> command in the above instructions
446 (also move the <filename>/etc/login.defs.orig</filename> backup
447 file to <filename>/etc/login.defs</filename>). If you
448 fail to do this and the errors remain, you will be unable to log into
449 your system.</para>
450 </warning>
451
452 </sect4>
453
454 <sect4>
455 <title>Other</title>
456
457 <para>Currently, <filename>/etc/pam.d/other</filename> is configured
458 to allow anyone with an account on the machine to use PAM-aware
459 programs without a configuration file for that program. After testing
460 <application>Linux-PAM</application> for proper configuration, install
461 a more restrictive <filename>other</filename> file so that
462 program-specific configuration files are required:</para>
463
464<screen role="root"><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"
465<literal># Begin /etc/pam.d/other
466
467auth required pam_deny.so
468auth required pam_warn.so
469account required pam_deny.so
470account required pam_warn.so
471password required pam_deny.so
472password required pam_warn.so
473session required pam_deny.so
474session required pam_warn.so
475
476# End /etc/pam.d/other</literal>
477EOF</userinput></screen>
478
479 </sect4>
480
481 <sect4 id="pam-access">
482 <title>Configuring Login Access</title>
483
484 <para>Instead of using the <filename>/etc/login.access</filename>
485 file for controlling access to the system,
486 <application>Linux-PAM</application> uses the
487 <filename class='libraryfile'>pam_access.so</filename> module along
488 with the <filename>/etc/security/access.conf</filename> file. Rename
489 the <filename>/etc/login.access</filename> file using the following
490 command:</para>
491
492 <indexterm zone="shadow pam-access">
493 <primary sortas="e-etc-security-access.conf">/etc/security/access.conf</primary>
494 </indexterm>
495
496<screen role="root"><userinput>if [ -f /etc/login.access ]; then
497 mv -v /etc/login.access /etc/login.access.NOUSE
498fi</userinput></screen>
499
500 </sect4>
501
502 <sect4 id="pam-limits">
503 <title>Configuring Resource Limits</title>
504
505 <para>Instead of using the <filename>/etc/limits</filename> file
506 for limiting usage of system resources,
507 <application>Linux-PAM</application> uses the
508 <filename class='libraryfile'>pam_limits.so</filename> module along
509 with the <filename>/etc/security/limits.conf</filename> file. Rename
510 the <filename>/etc/limits</filename> file using the following
511 command:</para>
512
513 <indexterm zone="shadow pam-limits">
514 <primary sortas="e-etc-security-limits.conf">/etc/security/limits.conf</primary>
515 </indexterm>
516
517<screen role="root"><userinput>if [ -f /etc/limits ]; then
518 mv -v /etc/limits /etc/limits.NOUSE
519fi</userinput></screen>
520
521 </sect4>
522
523 <sect4 id="pam-env">
524 <title>Configuring Default Environment</title>
525
526 <para>During previous configuration, several items were removed from
527 <filename>/etc/login.defs</filename>. Some of these items are now
528 controlled by the <filename class='libraryfile'>pam_env.so</filename>
529 module and the <filename>/etc/security/pam_env.conf</filename>
530 configuration file. In particular, the default path has been
531 changed. To recover your default path, execute the following
532 commands:</para>
533
534<screen role="root"><userinput>ENV_PATH=`grep '^ENV_PATH' /etc/login.defs.orig | \
535 awk '{ print $2 }' | sed 's/PATH=//'` &amp;&amp;
536echo 'PATH DEFAULT='`echo "${ENV_PATH}"`\
537' OVERRIDE=${PATH}' \
538 >> /etc/security/pam_env.conf &amp;&amp;
539unset ENV_PATH</userinput></screen>
540
541 <note>
542 <para>ENV_SUPATH is no longer supported. You must create
543 a valid <filename>/root/.bashrc</filename> file to provide a
544 modified path for the super-user.</para>
545 </note>
546
547 </sect4>
548
549 </sect3>
550
551 </sect2>
552
553 <sect2 role="content">
554 <title>Contents</title>
555
556 <para>A list of the installed files, along with their short descriptions
557 can be found at
558 <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.</para>
559
560 </sect2>
561
562</sect1>
Note: See TracBrowser for help on using the repository browser.