Index: postlfs/postlfs.ent
===================================================================
--- postlfs/postlfs.ent	(revision bb8a3adf3d60751cc1b332a125b590b020ddd39a)
+++ postlfs/postlfs.ent	(revision 96e39952278705ecd365a1472556d46af83e813f)
@@ -13,5 +13,4 @@
 <!-- Post-LFS Security -->
 <!ENTITY postlfs-security SYSTEM "security/security.xml">
-<!ENTITY postlfs-security-shadow SYSTEM "security/shadow.xml">
 <!ENTITY % iptables SYSTEM "security/iptables/iptables.ent">
 %iptables;
@@ -22,4 +21,6 @@
 <!ENTITY % Linux_PAM SYSTEM "security/pam/linux_pam.ent">
 %Linux_PAM;
+<!ENTITY % shadow SYSTEM "security/shadow/shadow.ent">
+%shadow;
 <!ENTITY postlfs-security-syslog SYSTEM "security/syslog.xml">
 
Index: postlfs/security/security.xml
===================================================================
--- postlfs/security/security.xml	(revision bb8a3adf3d60751cc1b332a125b590b020ddd39a)
+++ postlfs/security/security.xml	(revision 96e39952278705ecd365a1472556d46af83e813f)
@@ -3,5 +3,5 @@
 <title>Security</title>
 
-&postlfs-security-shadow;
+&shadow;
 &iptables;
 &postlfs-security-fw;
Index: postlfs/security/shadow.xml
===================================================================
--- postlfs/security/shadow.xml	(revision bb8a3adf3d60751cc1b332a125b590b020ddd39a)
+++ postlfs/security/shadow.xml	(revision 96e39952278705ecd365a1472556d46af83e813f)
@@ -1,3 +1,3 @@
-<sect1 id="postlfs-security-shadow">
+<sect1 id="shadow">
 <?dbhtml filename="shadow.html" dir="postlfs"?>
 <title>Configuring shadow</title>
@@ -18,5 +18,7 @@
 instead of using DES encryption.</para>
 
-
+&shadow-inst;
+&shadow-exp;
+&shadow-config;
 
 </sect1>
Index: postlfs/security/shadow/shadow-config.xml
===================================================================
--- postlfs/security/shadow/shadow-config.xml	(revision 96e39952278705ecd365a1472556d46af83e813f)
+++ postlfs/security/shadow/shadow-config.xml	(revision 96e39952278705ecd365a1472556d46af83e813f)
@@ -0,0 +1,113 @@
+<sect2>
+<title>Configuring PAM to work with shadow</title>
+
+<sect3><title>Config files</title>
+<para><userinput>/etc/pam.d/login /etc/pam.d/passwd /etc/pam.d/su
+/etc/pam.d/shadow /etc/pam.d/useradd</userinput></para>
+</sect3>
+
+<sect3><title>Configuration Information</title>
+
+<para>Add the following PAM configuration files to
+<filename>/etc/pam.d</filename> (or add them to
+<filename>/etc/pam.conf</filename> with
+the additional field for the program).
+</para>
+<screen><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"</userinput>
+# Begin /etc/pam.d/login
+
+auth        requisite      pam_securetty.so
+auth        requisite      pam_nologin.so
+auth        required       pam_env.so
+auth        required       pam_unix.so
+account     required       pam_access.so
+account     required       pam_unix.so
+session     required       pam_motd.so
+session     required       pam_limits.so
+session     optional       pam_mail.so     dir=/var/mail standard
+session     optional       pam_lastlog.so
+session     required       pam_unix.so
+
+# End /etc/pam.d/login
+<userinput>EOF
+cat &gt; /etc/pam.d/other &lt;&lt; "EOF"</userinput>
+# Begin /etc/pam.d/passwd
+
+password    required       pam_unix.so     md5 shadow use_authtok
+
+# End /etc/pam.d/passwd
+<userinput>EOF
+cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"</userinput>
+# Begin /etc/pam.d/shadow
+
+auth        sufficient      pam_rootok.so
+auth        required        pam_unix.so
+account     required        pam_unix.so
+session     required        pam_unix.so
+password    required        pam_permit.so
+
+# End /etc/pam.d/shadow
+<userinput>EOF
+cat &gt; /etc/pam.d/su &lt;&lt; "EOF"</userinput>
+# Begin /etc/pam.d/su
+
+auth        sufficient      pam_rootok.so
+auth        required        pam_unix.so
+account     required        pam_unix.so
+session     required        pam_unix.so
+
+# End /etc/pam.d/su
+<userinput>EOF
+cat &gt; /etc/pam.d/useradd &lt;&lt; "EOF"</userinput>
+# Begin /etc/pam.d/useradd
+
+auth        sufficient      pam_rootok.so
+auth        required        pam_unix.so
+account     required        pam_unix.so
+session     required        pam_unix.so
+password    required        pam_permit.so
+
+# End /etc/pam.d/useradd
+<userinput>EOF</userinput></screen>
+
+<para>Currently, <filename>/etc/pam.d/other</filename> is configured to
+allow anyone with an account on the machine to use programs
+that do not specifically have a configuration file of their own. After
+testing PAM for proper configuration, it can be changed to the
+following:</para>
+
+<screen><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"</userinput>
+# Begin /etc/pam.d/other
+
+auth        required        pam_deny.so
+auth        required        pam_warn.so
+account     required        pam_deny.so
+session     required        pam_deny.so
+password    required        pam_deny.so
+password    required        pam_warn.so
+
+# End /etc/pam.d/other
+<userinput>EOF</userinput></screen>
+
+<para>Finally, edit <filename>/etc/login.defs</filename> by adding '#'
+to the beginning of the following lines:</para>
+<screen>DIALUPS_CHECK_ENAB
+LASTLOG_ENAB
+MAIL_CHECK_ENAB
+PORTTIME_CHECKS_ENAB
+CONSOLE
+MOTD_FILE
+NOLOGINS_FILE
+PASS_MIN_LEN
+SU_WHEEL_ONLY
+MD5_CRYPT_ENAB
+CONSOLE_GROUPS
+ENVIRON_FILE</screen>
+
+<para>This stops login from performing these functions, as they will now
+be performed by PAM modules.</para>
+
+</sect3>
+
+</sect2>
+
Index: postlfs/security/shadow/shadow-exp.xml
===================================================================
--- postlfs/security/shadow/shadow-exp.xml	(revision 96e39952278705ecd365a1472556d46af83e813f)
+++ postlfs/security/shadow/shadow-exp.xml	(revision 96e39952278705ecd365a1472556d46af83e813f)
@@ -0,0 +1,8 @@
+<sect2>
+<title>Command explanations</title>
+
+<para><userinput>cp debian/securetty /etc/securetty</userinput> : This
+command sets the tty's that allow logins through PAM.</para>
+
+</sect2>
+
Index: postlfs/security/shadow/shadow-inst.xml
===================================================================
--- postlfs/security/shadow/shadow-inst.xml	(revision 96e39952278705ecd365a1472556d46af83e813f)
+++ postlfs/security/shadow/shadow-inst.xml	(revision 96e39952278705ecd365a1472556d46af83e813f)
@@ -0,0 +1,16 @@
+<sect2>
+<title>Reinstallation of shadow to utilize PAM</title>
+
+<para>Reinstall shadow by running the following commands:</para>
+
+<para><screen><userinput>LDFLAGS="-lpam -lpam_misc" ./configure --prefix=/usr --enable-shared --with-libpam &amp;&amp;
+make &amp;&amp;
+make install &amp;&amp;
+rm /bin/vipw &amp;&amp;
+rm /bin/sg &amp;&amp;
+mv /lib/{libmisc.*a,libshadow.*a} /usr/lib &amp;&amp;
+cp debian/securetty /etc/securetty</userinput></screen></para>
+
+
+</sect2>
+
Index: postlfs/security/shadow/shadow.ent
===================================================================
--- postlfs/security/shadow/shadow.ent	(revision 96e39952278705ecd365a1472556d46af83e813f)
+++ postlfs/security/shadow/shadow.ent	(revision 96e39952278705ecd365a1472556d46af83e813f)
@@ -0,0 +1,6 @@
+<!ENTITY shadow SYSTEM "../shadow.xml">
+<!ENTITY shadow-intro SYSTEM "shadow-intro.xml">
+<!ENTITY shadow-inst SYSTEM "shadow-inst.xml">
+<!ENTITY shadow-exp SYSTEM "shadow-exp.xml">
+<!ENTITY shadow-desc SYSTEM "shadow-desc.xml">
+<!ENTITY shadow-config SYSTEM "shadow-config.xml">
