Ignore:
Timestamp:
09/25/2010 05:32:25 AM (14 years ago)
Author:
DJ Lucas <dj@…>
Branches:
10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 12.1, 7.10, 7.4, 7.5, 7.6, 7.6-blfs, 7.6-systemd, 7.7, 7.8, 7.9, 8.0, 8.1, 8.2, 8.3, 8.4, 9.0, 9.1, basic, bdubbs/svn, elogind, gnome, kde5-13430, kde5-14269, kde5-14686, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, krejzi/svn, lazarus, lxqt, nosym, perl-modules, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, systemd-11177, systemd-13485, trunk, upgradedb, xry111/intltool, xry111/llvm18, xry111/soup3, xry111/test-20220226, xry111/xf86-video-removal
Children:
e059c43
Parents:
45857592
Message:

Added /etc/pam.d/system-* configuration files.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@8607 af4574ff-66df-0310-9fd7-8a98e5e911e0

File:
1 edited

Legend:

Unmodified
Added
Removed

  • postlfs/security/shadow.xml

    r45857592 r3e8fb4c  
    233233      <listitem>
    234234        <para><ulink
    235         url="http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam-6.html#ss6.3"/></para>
     235        url="http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_cracklib.html"/></para>
    236236      </listitem>
    237237      <listitem>
    … …  
    297297
    298298      <sect4>
    299         <title>'login' (with CrackLib)</title>
    300 
    301 <screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
    302 <literal># Begin /etc/pam.d/login
    303 
    304 auth        requisite      pam_nologin.so
    305 auth        required       pam_securetty.so
    306 auth        required       pam_unix.so
    307 account     required       pam_access.so
    308 account     required       pam_unix.so
    309 session     required       pam_env.so
    310 session     required       pam_motd.so
    311 session     required       pam_limits.so
    312 session     optional       pam_mail.so      dir=/var/mail standard
    313 session     optional       pam_lastlog.so
    314 session     required       pam_unix.so
    315 password    required       pam_cracklib.so  retry=3
    316 password    required       pam_unix.so      md5 shadow use_authtok
    317 
    318 # End /etc/pam.d/login</literal>
    319 EOF</userinput></screen>
    320 
    321       </sect4>
    322 
    323       <sect4>
    324         <title>'login' (without CrackLib)</title>
    325 
    326 <screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
    327 <literal># Begin /etc/pam.d/login
    328 
    329 auth        requisite      pam_nologin.so
    330 auth        required       pam_securetty.so
    331 auth        required       pam_env.so
    332 auth        required       pam_unix.so
    333 account     required       pam_access.so
    334 account     required       pam_unix.so
    335 session     required       pam_motd.so
    336 session     required       pam_limits.so
    337 session     optional       pam_mail.so      dir=/var/mail standard
    338 session     optional       pam_lastlog.so
    339 session     required       pam_unix.so
    340 password    required       pam_unix.so      md5 shadow
    341 
    342 # End /etc/pam.d/login</literal>
    343 EOF</userinput></screen>
    344 
    345       </sect4>
    346 
    347       <sect4>
    348         <title>'passwd' (with CrackLib)</title>
    349 
    350 <screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
    351 <literal># Begin /etc/pam.d/passwd
    352 
    353 password    required       pam_cracklib.so  type=Linux retry=1 \
    354                                             difok=5 diffignore=23 minlen=9 \
    355                                             dcredit=1 ucredit=1 lcredit=1 \
    356                                             ocredit=1 \
    357                                             dictpath=/lib/cracklib/pw_dict
    358 password    required       pam_unix.so      md5 shadow use_authtok
    359 
    360 # End /etc/pam.d/passwd</literal>
     299        <title>'system-account'</title>
     300
     301<screen role="root"><userinput>cat &gt; /etc/pam.d/system-account &lt;&lt; "EOF"
     302<literal># Begin /etc/pam.d/system-account
     303
     304account   required    pam_unix.so
     305
     306# End /etc/pam.d/system-account</literal>
     307EOF</userinput></screen>
     308
     309      </sect4>
     310
     311      <sect4>
     312        <title>'system-auth'</title>
     313
     314<screen role="root"><userinput>cat &gt; /etc/pam.d/system-auth &lt;&lt; "EOF"
     315<literal># Begin /etc/pam.d/system-auth
     316
     317auth      required    pam_unix.so
     318
     319# End /etc/pam.d/system-auth</literal>
     320EOF</userinput></screen>
     321
     322      </sect4>
     323
     324      <sect4>
     325        <title>'system-passwd' (with cracklib)</title>
     326
     327<screen role="root"><userinput>cat &gt; /etc/pam.d/system-password &lt;&lt; "EOF"
     328<literal># Begin /etc/pam.d/system-password
     329
     330# check new passwords for strength (man pam_cracklib)
     331password  required    pam_cracklib.so   type=Linux retry=3 difok=5 \
     332                                        difignore=23 minlen=9 dcredit=1 \
     333                                        ucredit=1 lcredit=1 ocredit=1 \
     334                                        dictpath=/lib/cracklib/pw_dict
     335# use sha512 hash for encryption, use shadow, and use the
     336# authentication token (chosen password) set by pam_cracklib
     337# above (or any previous modules)
     338password  required    pam_unix.so       sha512 shadow use_authtok
     339
     340# End /etc/pam.d/system-password</literal>
    361341EOF</userinput></screen>
    362342
    … …  
    369349
    370350      </sect4>
    371 
    372       <sect4>
    373         <title>'passwd' (without CrackLib)</title>
     351     
     352      <sect4>
     353        <title>'system-passwd' (without cracklib)</title>
     354
     355<screen role="root"><userinput>cat &gt; /etc/pam.d/system-password &lt;&lt; "EOF"
     356<literal># Begin /etc/pam.d/system-password
     357
     358# use sha512 hash for encryption, use shadow, and try to use any perviously
     359# defined authentication token (chosen password) set by any prior module
     360password  required    pam_unix.so       sha512 shadow try_first_pass
     361
     362# End /etc/pam.d/system-password</literal>
     363EOF</userinput></screen>
     364
     365      </sect4>
     366
     367      <sect4>
     368        <title>'system-session'</title>
     369
     370<screen role="root"><userinput>cat &gt; /etc/pam.d/system-session &lt;&lt; "EOF"
     371<literal># Begin /etc/pam.d/system-session
     372
     373session   required    pam_unix.so
     374
     375# End /etc/pam.d/system-session</literal>
     376EOF</userinput></screen>
     377
     378      </sect4>
     379
     380      <sect4>
     381        <title>'login'</title>
     382
     383<screen role="root"><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"
     384<literal># Begin /etc/pam.d/login
     385
     386# Set failure delay before next prompt to 3 seconds
     387auth      optional    pam_faildelay.so  delay=3000000
     388
     389# Check to make sure that the user is allowed to login
     390auth      requisite   pam_nologin.so
     391
     392# Check to make sure that root is allowed to login
     393auth      required    pam_securetty.so
     394
     395# Additional group memberships - disabled by default
     396#auth      optional    pam_group.so
     397
     398# include the default auth settings
     399auth      include     system-auth
     400
     401# check access for the user
     402account   required    pam_access.so
     403
     404# include the default account settings
     405account   include     system-account
     406
     407# Set default environment variables for the user
     408session   required    pam_env.so
     409
     410# Set resource limits for the user
     411session   required    pam_limits.so
     412
     413# Display date of last login - Disabled by default
     414#session   optional    pam_lastlog.so
     415
     416# Display the message of the day - Disabled by default
     417#session   optional    pam_motd.so
     418
     419# Check user's mail - Disabled by default
     420#session   optional    pam_mail.so      standard quiet
     421
     422# Use xauth keys (if available)
     423session   optional    pam_xauth.so
     424
     425# include the default session and password settings
     426session   include     system-session
     427password  include     system-password
     428
     429# End /etc/pam.d/login</literal>
     430EOF</userinput></screen>
     431
     432      </sect4>
     433
     434      <sect4>
     435        <title>'passwd'</title>
    374436
    375437<screen role="root"><userinput>cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"
    376438<literal># Begin /etc/pam.d/passwd
    377439
    378 password    required       pam_unix.so      md5 shadow
     440password  include     system-password
    379441
    380442# End /etc/pam.d/passwd</literal>
    … …  
    389451<literal># Begin /etc/pam.d/su
    390452
    391 auth        sufficient      pam_rootok.so
    392 auth        required        pam_unix.so
    393 account     required        pam_unix.so
    394 session     optional        pam_mail.so     dir=/var/mail standard
    395 session     optional        pam_xauth.so
    396 session     required        pam_env.so
    397 session     required        pam_unix.so
     453# always allow root
     454auth      sufficient  pam_rootok.so
     455
     456# include the default account settings
     457account   include     system-account
     458
     459# Use xauth keys (if available)
     460session   optional    pam_xauth.so
     461
     462# Set default environment variables for the service user
     463session   required    pam_env.so
     464
     465# include system session defaults
     466session   include     system-session
    398467
    399468# End /etc/pam.d/su</literal>
    … …  
    406475
    407476<screen role="root"><userinput>cat &gt; /etc/pam.d/chage &lt;&lt; "EOF"
    408 <literal># Begin /etc/pam.d/chage
    409 
    410 auth        sufficient      pam_rootok.so
    411 auth        required        pam_unix.so
    412 account     required        pam_unix.so
    413 session     required        pam_unix.so
    414 password    required        pam_permit.so
     477<literal>#Begin /etc/pam.d/chage
     478
     479# always allow root
     480auth      sufficient  pam_rootok.so
     481
     482# include system defaults for auth account and session
     483auth      include     system-auth
     484account   include     system-account
     485session   include     system-session
     486
     487# Always permit for authentication updates
     488password  required    pam_permit.so
    415489
    416490# End /etc/pam.d/chage</literal>
    … …  
    465539<literal># Begin /etc/pam.d/other
    466540
     541auth        required        pam_warn.so
    467542auth        required        pam_deny.so
    468 auth        required        pam_warn.so
     543account     required        pam_warn.so
    469544account     required        pam_deny.so
    470 account     required        pam_warn.so
     545password    required        pam_warn.so
    471546password    required        pam_deny.so
    472 password    required        pam_warn.so
     547session     required        pam_warn.so
    473548session     required        pam_deny.so
    474 session     required        pam_warn.so
    475549
    476550# End /etc/pam.d/other</literal>
Note: See TracChangeset for help on using the changeset viewer.