Changeset 3619a5b9

Timestamp:

11/16/2022 04:15:52 PM (18 months ago)

Author:

Pierre Labastie <pierre.labastie@…>

Branches:

11.3, 12.0, 12.1, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, lazarus, lxqt, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, trunk, xry111/llvm18, xry111/xf86-video-removal

Children:

7f27f7a

Parents:

ae27cdc

git-author:

Pierre Labastie <pierre.labastie@…> (11/16/2022 04:13:47 PM)

git-committer:

Pierre Labastie <pierre.labastie@…> (11/16/2022 04:15:52 PM)

Message:

Adjust the number of crypt rounds in PAM files

To match shadow's one.

Location:

postlfs/security

Files:

• libpwquality.xml (modified) (1 diff)
• linux-pam.xml (modified) (2 diffs)

postlfs/security/libpwquality.xml

@@ -169 +169 @@
 # use sha512 hash for encryption, use shadow, and use the
 # authentication token (chosen password) set by pam_pwquality
-# above (or any previous modules)
-password  required    pam_unix.so        sha512 shadow use_authtok
+# above (or any previous modules). Also set the number of crypt rounds
+# to the value used in shadow.
+password  required    pam_unix.so        sha512 shadow use_authtok \
+                                         rounds=5000000
 
 # End /etc/pam.d/system-password</literal>

postlfs/security/linux-pam.xml

@@ -348 +348 @@
 # use sha512 hash for encryption, use shadow, and try to use any previously
 # defined authentication token (chosen password) set by any prior module
-password  required    pam_unix.so       sha512 shadow try_first_pass
+# Use the same number of rounds as shadow.
+password  required    pam_unix.so       sha512 shadow try_first_pass \
+                                        rounds=5000000
 
 # End /etc/pam.d/system-password</literal>
@@ -368 +370 @@
      is built in, and the PAM module is built.
 -->
-<!--
+<!-- WARNING: If for any reason the instructions below are reinstated be
+     careful with the number of rounds, which should match the one in shadow.
       <para>
         The remaining generic file depends on whether <xref