source: postlfs/security/shadow/shadow-config.xml@ c8e101d8

10.0 10.1 11.0 11.1 6.0 6.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 krejzi/svn lazarus nosym perl-modules qt5new systemd-11177 systemd-13485 trunk upgradedb v1_0 v5_0 v5_0-pre1 v5_1 v5_1-pre1 xry111/intltool xry111/test-20220226
Last change on this file since c8e101d8 was c8e101d8, checked in by Larry Lawrence <larry@…>, 20 years ago

integrate libglade14 into previous submissions, alphabatized credits, minor edits for consistency and another Shadow error

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@485 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 3.5 KB
Line 
1<sect2>
2<title>Configuring PAM to work with shadow</title>
3
4<sect3><title>Config files</title>
5<para><userinput>/etc/pam.d/login /etc/pam.d/passwd /etc/pam.d/su
6/etc/pam.d/shadow /etc/pam.d/useradd</userinput></para>
7</sect3>
8
9<sect3><title>Configuration Information</title>
10
11<para>Add the following PAM configuration files to
12<filename>/etc/pam.d</filename> (or add them to
13<filename>/etc/pam.conf</filename> with
14the additional field for the program).
15</para>
16<screen><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"</userinput>
17# Begin /etc/pam.d/login
18
19auth requisite pam_securetty.so
20auth requisite pam_nologin.so
21auth required pam_env.so
22auth required pam_unix.so
23account required pam_access.so
24account required pam_unix.so
25session required pam_motd.so
26session required pam_limits.so
27session optional pam_mail.so dir=/var/mail standard
28session optional pam_lastlog.so
29session required pam_unix.so
30
31# End /etc/pam.d/login
32<userinput>EOF
33cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"</userinput>
34# Begin /etc/pam.d/passwd
35
36password required pam_unix.so md5 shadow
37
38# End /etc/pam.d/passwd
39<userinput>EOF
40cat &gt; /etc/pam.d/shadow &lt;&lt; "EOF"</userinput>
41# Begin /etc/pam.d/shadow
42
43auth sufficient pam_rootok.so
44auth required pam_unix.so
45account required pam_unix.so
46session required pam_unix.so
47password required pam_permit.so
48
49# End /etc/pam.d/shadow
50<userinput>EOF
51cat &gt; /etc/pam.d/su &lt;&lt; "EOF"</userinput>
52# Begin /etc/pam.d/su
53
54auth sufficient pam_rootok.so
55auth required pam_unix.so
56account required pam_unix.so
57session required pam_unix.so
58
59# End /etc/pam.d/su
60<userinput>EOF
61cat &gt; /etc/pam.d/useradd &lt;&lt; "EOF"</userinput>
62# Begin /etc/pam.d/useradd
63
64auth sufficient pam_rootok.so
65auth required pam_unix.so
66account required pam_unix.so
67session required pam_unix.so
68password required pam_permit.so
69
70# End /etc/pam.d/useradd
71<userinput>EOF
72cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"</userinput>
73# Begin /etc/pam.d/chage
74
75auth sufficient pam_rootok.so
76auth required pam_unix.so
77account required pam_unix.so
78session required pam_unix.so
79password required pam_permit.so
80
81# End /etc/pam.d/chage
82<userinput>EOF</userinput></screen>
83
84<para>Currently, <filename>/etc/pam.d/other</filename> is configured to
85allow anyone with an account on the machine to use programs
86that do not specifically have a configuration file of their own. After
87testing PAM for proper configuration, it can be changed to the
88following:</para>
89
90<screen><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"</userinput>
91# Begin /etc/pam.d/other
92
93auth required pam_deny.so
94auth required pam_warn.so
95account required pam_deny.so
96session required pam_deny.so
97password required pam_deny.so
98password required pam_warn.so
99
100# End /etc/pam.d/other
101<userinput>EOF</userinput></screen>
102
103<para>Finally, edit <filename>/etc/login.defs</filename> by adding '#'
104to the beginning of the following lines:</para>
105<screen>DIALUPS_CHECK_ENAB
106LASTLOG_ENAB
107MAIL_CHECK_ENAB
108PORTTIME_CHECKS_ENAB
109CONSOLE
110MOTD_FILE
111NOLOGINS_FILE
112PASS_MIN_LEN
113SU_WHEEL_ONLY
114MD5_CRYPT_ENAB
115CONSOLE_GROUPS
116ENVIRON_FILE</screen>
117
118<para>This stops login from performing these functions, as they will now
119be performed by PAM modules.</para>
120
121</sect3>
122
123</sect2>
124
Note: See TracBrowser for help on using the repository browser.