source: postlfs/security/shadow/shadow-config.xml@ 064db32a

10.0 10.1 11.0 6.0 6.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 ken/refactor-virt krejzi/svn lazarus nosym perl-modules qt5new systemd-11177 systemd-13485 trunk upgradedb v1_0 v5_0 v5_0-pre1 v5_1 v5_1-pre1 xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since 064db32a was 064db32a, checked in by Larry Lawrence <larry@…>, 19 years ago

caught a few more tags

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@876 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 3.6 KB
Line 
1<sect2>
2<title>Configuring PAM to work with shadow</title>
3
4<sect3><title>Config files</title>
5<para><filename>/etc/pam.d/login</filename>,
6<filename>/etc/pam.d/passwd</filename>,
7<filename>/etc/pam.d/su</filename>,
8<filename>/etc/pam.d/shadow</filename>,
9<filename>/etc/pam.d/useradd</filename></para>
10</sect3>
11
12<sect3><title>Configuration Information</title>
13
14<para>Add the following PAM configuration files to
15<filename>/etc/pam.d</filename> (or add them to
16<filename>/etc/pam.conf</filename> with
17the additional field for the program).
18</para>
19<screen><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"</userinput>
20# Begin /etc/pam.d/login
21
22auth requisite pam_securetty.so
23auth requisite pam_nologin.so
24auth required pam_env.so
25auth required pam_unix.so
26account required pam_access.so
27account required pam_unix.so
28session required pam_motd.so
29session required pam_limits.so
30session optional pam_mail.so dir=/var/mail standard
31session optional pam_lastlog.so
32session required pam_unix.so
33
34# End /etc/pam.d/login
35<userinput>EOF
36cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"</userinput>
37# Begin /etc/pam.d/passwd
38
39password required pam_unix.so md5 shadow
40
41# End /etc/pam.d/passwd
42<userinput>EOF
43cat &gt; /etc/pam.d/shadow &lt;&lt; "EOF"</userinput>
44# Begin /etc/pam.d/shadow
45
46auth sufficient pam_rootok.so
47auth required pam_unix.so
48account required pam_unix.so
49session required pam_unix.so
50password required pam_permit.so
51
52# End /etc/pam.d/shadow
53<userinput>EOF
54cat &gt; /etc/pam.d/su &lt;&lt; "EOF"</userinput>
55# Begin /etc/pam.d/su
56
57auth sufficient pam_rootok.so
58auth required pam_unix.so
59account required pam_unix.so
60session required pam_unix.so
61
62# End /etc/pam.d/su
63<userinput>EOF
64cat &gt; /etc/pam.d/useradd &lt;&lt; "EOF"</userinput>
65# Begin /etc/pam.d/useradd
66
67auth sufficient pam_rootok.so
68auth required pam_unix.so
69account required pam_unix.so
70session required pam_unix.so
71password required pam_permit.so
72
73# End /etc/pam.d/useradd
74<userinput>EOF
75cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"</userinput>
76# Begin /etc/pam.d/chage
77
78auth sufficient pam_rootok.so
79auth required pam_unix.so
80account required pam_unix.so
81session required pam_unix.so
82password required pam_permit.so
83
84# End /etc/pam.d/chage
85<userinput>EOF</userinput></screen>
86
87<para>Currently, <filename>/etc/pam.d/other</filename> is configured to
88allow anyone with an account on the machine to use programs
89that do not specifically have a configuration file of their own. After
90testing PAM for proper configuration, it can be changed to the
91following:</para>
92
93<screen><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"</userinput>
94# Begin /etc/pam.d/other
95
96auth required pam_deny.so
97auth required pam_warn.so
98account required pam_deny.so
99session required pam_deny.so
100password required pam_deny.so
101password required pam_warn.so
102
103# End /etc/pam.d/other
104<userinput>EOF</userinput></screen>
105
106<para>Finally, edit <filename>/etc/login.defs</filename> by adding '#'
107to the beginning of the following lines:</para>
108<screen>DIALUPS_CHECK_ENAB
109LASTLOG_ENAB
110MAIL_CHECK_ENAB
111PORTTIME_CHECKS_ENAB
112CONSOLE
113MOTD_FILE
114NOLOGINS_FILE
115PASS_MIN_LEN
116SU_WHEEL_ONLY
117MD5_CRYPT_ENAB
118CONSOLE_GROUPS
119ENVIRON_FILE</screen>
120
121<para>This stops login from performing these functions, as they will now
122be performed by PAM modules.</para>
123
124</sect3>
125
126</sect2>
127
Note: See TracBrowser for help on using the repository browser.