Shadow-4.0.15 (will update when LFS moves to this version)

[Randy McMurchy]

Version increment to 4.0.14

LFS has already moved to this version

[dnicholson@…]

shadow-4.0.14 is pretty buggy (no su -c support, etc.) 4.0.15 should be better as they're slowly bringing in patches from debian. There's a devloper snapshot out if anyone wants to test. I'll be happy to make the update when 4.0.15 is released. Might need some help with the PAM stuff, though.

[Randy McMurchy]

I would like to take over ownership of this bug. I use cracklib and PAM and have already been testing 4.0.15. I feel LFS will move to this version soon and I'll be ready to immediately update BLFS.

Dan, if you see this, please reassign the bug to me. Thanks, Randy

By the way, the --enable-libpam and --without-libcrack parameters do not need to be passed as these are the defaults.

[dnicholson@…]

OK, I can do that. However, I might throw a few comments here. When I built shadow with pam but without cracklib following the books instructions, it didn't work correctly for all the "If you don't have cracklib, do this." Particularly, this section:

for FUNCTION in OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
                PASS_CHANGE_TRIES PASS_ALWAYS_WARN
do
    sed -i "s/^$FUNCTION/# &/" /etc/login.defs
done

I had to have those defined or there were a lot of complaints at login. This was quite a while back, so I thought I'd made a mistake and moved on.

Anyway, I'll be building it again with PAM but without Cracklib in the next couple days, so I'll try to see what the issue is. I might steal a couple things from Paldo that look promising:

​http://www.paldo.org/index.php?section=packages&page=main&releaseid=27822

[Randy McMurchy]

This would be good to know, Dan. I always have cracklib installed (actually, why would anyone install PAM and not Cracklib?) if I install PAM so I've never seen the situation. It would be nice if you could confirm that crazy scenario of installing PAM to increase system security through controlling access to applications, but not providing strong password support on your system. (Though I realize there may be ways to provide strong password support without CrackLib, BLFS provides no mechanism for such)

[dnicholson@…]

Come on, Randy. This conversation has been had before. Not everyone wants Cracklib installed, including me. I see it as a completely separate issue than PAM.

[Randy McMurchy]

I do not remember any discussions about not installing CrackLib when Linux-PAM is installed. CrackLib is a recommended dependency. The discussions about this subject were installing CrackLib with LFS. Applies ----> Oranges.

As a courtesy, we try to provide instructions for Shadow in case CrackLib may not be installed, but the primary focus is not that situation, as it is recommeneded to have Cracklib installed.

And, my sincere apologies for saying something you took personal. That was not my intentions. Hopefully, you now see the huge difference between *all* previous discussions and this situation.

[Randy McMurchy]

Updated BLFS to Shadow-4.0.15

If there are issues (such as the issue above about the Cracklib stuff in the login.defs file), let's open a new ticket. This ticket was for a Shadow update, if there's a problem with the BLFS Shadow instructions, it is not related to this update.