source: postlfs/security/shadow/shadow-config.xml@ 36ae4612

10.0 10.1 11.0 11.1 6.0 6.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 krejzi/svn lazarus nosym perl-modules qt5new systemd-11177 systemd-13485 trunk upgradedb v5_0 v5_0-pre1 v5_1 v5_1-pre1 xry111/intltool xry111/test-20220226
Last change on this file since 36ae4612 was cf7ae162, checked in by Larry Lawrence <larry@…>, 19 years ago

update to lcms-1.11

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@1150 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 3.8 KB
Line 
1<sect2>
2<title>Configuring <application><acronym>PAM</acronym></application> to work
3with <application>shadow</application></title>
4
5<sect3><title>Config files</title>
6<para><filename>/etc/pam.d/login</filename>,
7<filename>/etc/pam.d/passwd</filename>,
8<filename>/etc/pam.d/su</filename>,
9<filename>/etc/pam.d/shadow</filename>,
10<filename>/etc/pam.d/useradd</filename></para>
11</sect3>
12
13<sect3><title>Configuration Information</title>
14
15<para>Add the following <application><acronym>PAM</acronym></application>
16configuration files to <filename>/etc/pam.d</filename> (or add them to
17<filename>/etc/pam.conf</filename> with the additional field for the program).
18</para>
19<screen><userinput><command>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"</command>
20# Begin /etc/pam.d/login
21
22auth requisite pam_securetty.so
23auth requisite pam_nologin.so
24auth required pam_env.so
25auth required pam_unix.so
26account required pam_access.so
27account required pam_unix.so
28session required pam_motd.so
29session required pam_limits.so
30session optional pam_mail.so dir=/var/mail standard
31session optional pam_lastlog.so
32session required pam_unix.so
33
34# End /etc/pam.d/login
35<command>EOF
36cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"</command>
37# Begin /etc/pam.d/passwd
38
39password required pam_unix.so md5 shadow
40
41# End /etc/pam.d/passwd
42<command>EOF
43cat &gt; /etc/pam.d/shadow &lt;&lt; "EOF"</command>
44# Begin /etc/pam.d/shadow
45
46auth sufficient pam_rootok.so
47auth required pam_unix.so
48account required pam_unix.so
49session required pam_unix.so
50password required pam_permit.so
51
52# End /etc/pam.d/shadow
53<command>EOF
54cat &gt; /etc/pam.d/su &lt;&lt; "EOF"</command>
55# Begin /etc/pam.d/su
56
57auth sufficient pam_rootok.so
58auth required pam_unix.so
59account required pam_unix.so
60session required pam_unix.so
61
62# End /etc/pam.d/su
63<command>EOF
64cat &gt; /etc/pam.d/useradd &lt;&lt; "EOF"</command>
65# Begin /etc/pam.d/useradd
66
67auth sufficient pam_rootok.so
68auth required pam_unix.so
69account required pam_unix.so
70session required pam_unix.so
71password required pam_permit.so
72
73# End /etc/pam.d/useradd
74<command>EOF
75cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"</command>
76# Begin /etc/pam.d/chage
77
78auth sufficient pam_rootok.so
79auth required pam_unix.so
80account required pam_unix.so
81session required pam_unix.so
82password required pam_permit.so
83
84# End /etc/pam.d/chage
85<command>EOF</command></userinput></screen>
86
87<para>Currently, <filename>/etc/pam.d/other</filename> is configured to
88allow anyone with an account on the machine to use programs
89that do not specifically have a configuration file of their own. After
90testing <application><acronym>PAM</acronym></application> for proper
91configuration, it can be changed to the following:</para>
92
93<screen><userinput><command>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"</command>
94# Begin /etc/pam.d/other
95
96auth required pam_deny.so
97auth required pam_warn.so
98account required pam_deny.so
99session required pam_deny.so
100password required pam_deny.so
101password required pam_warn.so
102
103# End /etc/pam.d/other
104<command>EOF</command></userinput></screen>
105
106<para>Finally, edit <filename>/etc/login.defs</filename> by adding '#'
107to the beginning of the following lines:</para>
108<screen>DIALUPS_CHECK_ENAB
109LASTLOG_ENAB
110MAIL_CHECK_ENAB
111PORTTIME_CHECKS_ENAB
112CONSOLE
113MOTD_FILE
114NOLOGINS_FILE
115PASS_MIN_LEN
116SU_WHEEL_ONLY
117MD5_CRYPT_ENAB
118CONSOLE_GROUPS
119ENVIRON_FILE</screen>
120
121<para>This stops <command>login</command> from performing these functions, as
122they will now be performed by <acronym>PAM</acronym> modules.</para>
123
124</sect3>
125
126</sect2>
127
Note: See TracBrowser for help on using the repository browser.