source: chapter06/shadow.xml@ a75f3f8

10.0 10.0-rc1 10.1 10.1-rc1 11.0 11.0-rc1 11.0-rc2 11.0-rc3 11.1 11.1-rc1 11.2 11.2-rc1 11.3 11.3-rc1 12.0 12.0-rc1 12.1 12.1-rc1 12.2 12.2-rc1 6.3 6.4 6.5 6.6 6.7 6.8 7.0 7.1 7.2 7.3 7.4 7.5 7.5-systemd 7.6 7.6-systemd 7.7 7.7-systemd 7.8 7.8-systemd 7.9 7.9-systemd 8.0 8.1 8.2 8.3 8.4 9.0 9.1 arm bdubbs/gcc13 ml-11.0 multilib renodr/libudev-from-systemd s6-init trunk xry111/arm64 xry111/arm64-12.0 xry111/clfs-ng xry111/lfs-next xry111/loongarch xry111/loongarch-12.0 xry111/loongarch-12.1 xry111/loongarch-12.2 xry111/mips64el xry111/multilib xry111/pip3 xry111/rust-wip-20221008 xry111/update-glibc
Last change on this file since a75f3f8 was a75f3f8, checked in by Archaic <archaic@…>, 19 years ago

Added note in Shadow regarding building Cracklib from BLFS first.

git-svn-id: http://svn.linuxfromscratch.org/LFS/trunk/BOOK@6629 4aa44e1e-78dd-0310-a6d2-fbcd4c07a689

  • Property mode set to 100644
File size: 14.7 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN" "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
3 <!ENTITY % general-entities SYSTEM "../general.ent">
4 <!ENTITY % patches-entities SYSTEM "../patches.ent">
5 %general-entities;
6 %patches-entities;
7]>
8<sect1 id="ch-system-shadow" role="wrap">
9<title>Shadow-&shadow-version;</title>
10<?dbhtml filename="shadow.html"?>
11
12<indexterm zone="ch-system-shadow"><primary sortas="a-Shadow">Shadow</primary></indexterm>
13
14<sect2 role="package"><title/>
15<para>The Shadow package contains programs for handling passwords in a secure
16way.</para>
17
18<segmentedlist>
19<segtitle>&buildtime;</segtitle>
20<segtitle>&diskspace;</segtitle>
21<seglistitem><seg>0.4 SBU</seg><seg>13.7 MB</seg></seglistitem>
22</segmentedlist>
23
24<segmentedlist>
25<segtitle>&dependencies;</segtitle>
26<seglistitem><seg>Bash, Binutils, Bison, Coreutils,
27Diffutils, GCC, Gettext, Glibc, Grep, Make, and Sed</seg></seglistitem>
28</segmentedlist>
29</sect2>
30
31<sect2 role="installation">
32<title>Installation of Shadow</title>
33
34<note><para>If you would like to enforce the use of strong passwords, refer to
35<ulink url="&blfs-root;view/svn/postlfs/cracklib.html"/> for installing Cracklib
36prior to building Shadow. Then add <parameter>--with-libcrack</parameter> to the
37<command>configure</command> command below.</para></note>
38
39<para>Prepare Shadow for compilation:</para>
40
41<screen><userinput>./configure --libdir=/lib --enable-shared</userinput></screen>
42
43<para>Disable the installation of the <command>groups</command> program and its man page, as Coreutils provides a better version:</para>
44
45<screen><userinput>sed -i 's/groups$(EXEEXT) //' src/Makefile
46sed -i '/groups/d' man/Makefile</userinput></screen>
47
48<para>Compile the package:</para>
49
50<screen><userinput>make</userinput></screen>
51
52<para>Install the package:</para>
53
54<screen><userinput>make install</userinput></screen>
55
56<para id="shadow-limits-login_access">Shadow uses two files to configure
57authentication settings for the system. Install these two configuration
58files:</para>
59
60<indexterm zone="shadow-limits-login_access"><primary sortas="e-/etc/limits">/etc/limits</primary></indexterm>
61<indexterm zone="shadow-limits-login_access"><primary sortas="e-/etc/login.access">/etc/login.access</primary></indexterm>
62
63<screen><userinput>cp etc/{limits,login.access} /etc</userinput></screen>
64
65<para id="shadow-login_defs">Instead of using the default <emphasis>crypt</emphasis> method,
66use the more secure <emphasis>MD5</emphasis> method of password
67encryption, which also allows passwords longer than 8 characters. It
68is also necessary to change the obsolete <filename
69class="directory">/var/spool/mail</filename> location for user
70mailboxes that Shadow uses by default to the <filename
71class="directory">/var/mail</filename> location used currently. Both
72of these can be accomplished by changing the relevant configuration
73file while copying it to its destination:</para>
74
75<indexterm zone="shadow-login_defs"><primary sortas="e-/etc/login.defs">/etc/login.defs</primary></indexterm>
76
77<screen><userinput>sed -e's@#MD5_CRYPT_ENAB.no@MD5_CRYPT_ENAB yes@' \
78 -e 's@/var/spool/mail@/var/mail@' \
79 etc/login.defs.linux &gt; /etc/login.defs</userinput></screen>
80
81<para>Move a misplaced program to its proper location:</para>
82
83<screen><userinput>mv /usr/bin/passwd /bin</userinput></screen>
84
85<para>Move Shadow's libraries to more appropriate locations:</para>
86
87<screen><userinput>mv /lib/libshadow.*a /usr/lib
88rm /lib/libshadow.so
89ln -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
90
91<para>The <parameter>-D</parameter> option of the
92<command>useradd</command> program requires the <filename
93class="directory">/etc/default</filename> directory for it to work
94properly:</para>
95
96<screen><userinput>mkdir /etc/default</userinput></screen>
97
98</sect2>
99
100
101<sect2 id="conf-shadow" role="configuration"><title>Configuring Shadow</title>
102<indexterm zone="conf-shadow">
103<primary sortas="a-Shadow">Shadow</primary>
104<secondary>configuring</secondary></indexterm>
105
106<para>This package contains utilities to add, modify, and delete users
107and groups; set and change their passwords; and perform other
108administrative tasks. For a full explanation of what
109<emphasis>password shadowing</emphasis> means, see the
110<filename>doc/HOWTO</filename> file within the unpacked source tree.
111If using Shadow support, keep in mind that programs which need to
112verify passwords (display managers, FTP programs, pop3 daemons, etc.)
113must be Shadow-compliant. That is, they need to be able to work with
114shadowed passwords.</para>
115
116<para>To enable shadowed passwords, run the following command:</para>
117
118<screen><userinput>pwconv</userinput></screen>
119
120<para>To enable shadowed group passwords, run:</para>
121
122<screen><userinput>grpconv</userinput></screen>
123
124<para>Under normal circumstances, passwords will not have been created
125yet. However, if returning to this section later to enable shadowing,
126reset any current user passwords with the <command>passwd</command>
127command or any group passwords with the <command>gpasswd</command>
128command.</para>
129
130</sect2>
131
132
133<sect2 role="configuration">
134<title>Setting the root password</title>
135
136<para>Choose a password for user <emphasis>root</emphasis> and set it
137by running:</para>
138
139<screen><userinput>passwd root</userinput></screen>
140</sect2>
141
142
143<sect2 id="contents-shadow" role="content"><title>Contents of Shadow</title>
144
145<segmentedlist>
146<segtitle>Installed programs</segtitle>
147<segtitle>Installed libraries</segtitle>
148<seglistitem><seg>chage, chfn, chpasswd, chsh, expiry, faillog, gpasswd,
149groupadd, groupdel, groupmod, grpck, grpconv, grpunconv, lastlog, login,
150logoutd, mkpasswd, newgrp, newusers, passwd, pwck, pwconv, pwunconv, sg
151(link to newgrp), useradd, userdel, usermod, vigr (link to vipw), and vipw</seg>
152<seg>libshadow.[a,so]</seg>
153</seglistitem>
154</segmentedlist>
155
156<variablelist><bridgehead renderas="sect3">Short Descriptions</bridgehead>
157<?dbfo list-presentation="list"?>
158<?dbhtml list-presentation="table"?>
159
160<varlistentry id="chage">
161<term><command>chage</command></term>
162<listitem>
163<para>Used to change the maximum number of days between obligatory
164password changes</para>
165<indexterm zone="ch-system-shadow chage"><primary sortas="b-chage">chage</primary></indexterm>
166</listitem>
167</varlistentry>
168
169<varlistentry id="chfn">
170<term><command>chfn</command></term>
171<listitem>
172<para>Used to change a user's full name and other information</para>
173<indexterm zone="ch-system-shadow chfn"><primary sortas="b-chfn">chfn</primary></indexterm>
174</listitem>
175</varlistentry>
176
177<varlistentry id="chpasswd">
178<term><command>chpasswd</command></term>
179<listitem>
180<para>Used to update the passwords of an entire series of user
181accounts</para>
182<indexterm zone="ch-system-shadow chpasswd"><primary sortas="b-chpasswd">chpasswd</primary></indexterm>
183</listitem>
184</varlistentry>
185
186<varlistentry id="chsh">
187<term><command>chsh</command></term>
188<listitem>
189<para>Used to change a user's default login shell</para>
190<indexterm zone="ch-system-shadow chsh"><primary sortas="b-chsh">chsh</primary></indexterm>
191</listitem>
192</varlistentry>
193
194<varlistentry id="expiry">
195<term><command>expiry</command></term>
196<listitem>
197<para>Checks and enforces the current password expiration policy</para>
198<indexterm zone="ch-system-shadow expiry"><primary sortas="b-expiry">expiry</primary></indexterm>
199</listitem>
200</varlistentry>
201
202<varlistentry id="faillog">
203<term><command>faillog</command></term>
204<listitem>
205<para>Is used to examine the log of login failures, to set a maximum number of
206failures before an account is blocked, or to reset the failure count</para>
207<indexterm zone="ch-system-shadow faillog"><primary sortas="b-faillog">faillog</primary></indexterm>
208</listitem>
209</varlistentry>
210
211<varlistentry id="gpasswd">
212<term><command>gpasswd</command></term>
213<listitem>
214<para>Is used to add and delete members and administrators to groups</para>
215<indexterm zone="ch-system-shadow gpasswd"><primary sortas="b-gpasswd">gpasswd</primary></indexterm>
216</listitem>
217</varlistentry>
218
219<varlistentry id="groupadd">
220<term><command>groupadd</command></term>
221<listitem>
222<para>Creates a group with the given name</para>
223<indexterm zone="ch-system-shadow groupadd"><primary sortas="b-groupadd">groupadd</primary></indexterm>
224</listitem>
225</varlistentry>
226
227<varlistentry id="groupdel">
228<term><command>groupdel</command></term>
229<listitem>
230<para>Deletes the group with the given name</para>
231<indexterm zone="ch-system-shadow groupdel"><primary sortas="b-groupdel">groupdel</primary></indexterm>
232</listitem>
233</varlistentry>
234
235<varlistentry id="groupmod">
236<term><command>groupmod</command></term>
237<listitem>
238<para>Is used to modify the given group's name or GID</para>
239<indexterm zone="ch-system-shadow groupmod"><primary sortas="b-groupmod">groupmod</primary></indexterm>
240</listitem>
241</varlistentry>
242
243<varlistentry id="grpck">
244<term><command>grpck</command></term>
245<listitem>
246<para>Verifies the integrity of the group files <filename>/etc/group</filename>
247and <filename>/etc/gshadow</filename></para>
248<indexterm zone="ch-system-shadow grpck"><primary sortas="b-grpck">grpck</primary></indexterm>
249</listitem>
250</varlistentry>
251
252<varlistentry id="grpconv">
253<term><command>grpconv</command></term>
254<listitem>
255<para>Creates or updates the shadow group file from the normal group file</para>
256<indexterm zone="ch-system-shadow grpconv"><primary sortas="b-grpconv">grpconv</primary></indexterm>
257</listitem>
258</varlistentry>
259
260<varlistentry id="grpunconv">
261<term><command>grpunconv</command></term>
262<listitem>
263<para>Updates <filename>/etc/group</filename>
264from <filename>/etc/gshadow</filename> and then deletes the latter</para>
265<indexterm zone="ch-system-shadow grpunconv"><primary sortas="b-grpunconv">grpunconv</primary></indexterm>
266</listitem>
267</varlistentry>
268
269<varlistentry id="lastlog">
270<term><command>lastlog</command></term>
271<listitem>
272<para>Reports the most recent login of all users or of a given user</para>
273<indexterm zone="ch-system-shadow lastlog"><primary sortas="b-lastlog">lastlog</primary></indexterm>
274</listitem>
275</varlistentry>
276
277<varlistentry id="login">
278<term><command>login</command></term>
279<listitem>
280<para>Is used by the system to let users sign on</para>
281<indexterm zone="ch-system-shadow login"><primary sortas="b-login">login</primary></indexterm>
282</listitem>
283</varlistentry>
284
285<varlistentry id="logoutd">
286<term><command>logoutd</command></term>
287<listitem>
288<para>Is a daemon used to enforce restrictions on log-on time and ports</para>
289<indexterm zone="ch-system-shadow logoutd"><primary sortas="b-logoutd">logoutd</primary></indexterm>
290</listitem>
291</varlistentry>
292
293<varlistentry id="mkpasswd">
294<term><command>mkpasswd</command></term>
295<listitem>
296<para>Generates random passwords</para>
297<indexterm zone="ch-system-shadow mkpasswd"><primary sortas="b-mkpasswd">mkpasswd</primary></indexterm>
298</listitem>
299</varlistentry>
300
301<varlistentry id="newgrp">
302<term><command>newgrp</command></term>
303<listitem>
304<para>Is used to change the current GID during a login session</para>
305<indexterm zone="ch-system-shadow newgrp"><primary sortas="b-newgrp">newgrp</primary></indexterm>
306</listitem>
307</varlistentry>
308
309<varlistentry id="newusers">
310<term><command>newusers</command></term>
311<listitem>
312<para>Is used to create or update an entire series of user accounts</para>
313<indexterm zone="ch-system-shadow newusers"><primary sortas="b-newusers">newusers</primary></indexterm>
314</listitem>
315</varlistentry>
316
317<varlistentry id="passwd">
318<term><command>passwd</command></term>
319<listitem>
320<para>Is used to change the password for a user or group account</para>
321<indexterm zone="ch-system-shadow passwd"><primary sortas="b-passwd">passwd</primary></indexterm>
322</listitem>
323</varlistentry>
324
325<varlistentry id="pwck">
326<term><command>pwck</command></term>
327<listitem>
328<para>Verifies the integrity of the password files
329<filename>/etc/passwd</filename> and <filename>/etc/shadow</filename></para>
330<indexterm zone="ch-system-shadow pwck"><primary sortas="b-pwck">pwck</primary></indexterm>
331</listitem>
332</varlistentry>
333
334<varlistentry id="pwconv">
335<term><command>pwconv</command></term>
336<listitem>
337<para>Creates or updates the shadow password file from the normal
338password file</para>
339<indexterm zone="ch-system-shadow pwconv"><primary sortas="b-pwconv">pwconv</primary></indexterm>
340</listitem>
341</varlistentry>
342
343<varlistentry id="pwunconv">
344<term><command>pwunconv</command></term>
345<listitem>
346<para>Updates <filename>/etc/passwd</filename>
347from <filename>/etc/shadow</filename> and then deletes the latter</para>
348<indexterm zone="ch-system-shadow pwunconv"><primary sortas="b-pwunconv">pwunconv</primary></indexterm>
349</listitem>
350</varlistentry>
351
352<varlistentry id="sg">
353<term><command>sg</command></term>
354<listitem>
355<para>Executes a given command while the user's GID
356is set to that of the given group</para>
357<indexterm zone="ch-system-shadow sg"><primary sortas="b-sg">sg</primary></indexterm>
358</listitem>
359</varlistentry>
360
361<varlistentry id="su">
362<term><command>su</command></term>
363<listitem>
364<indexterm zone="ch-system-shadow su"><primary sortas="b-su">su</primary></indexterm>
365<para>Runs a shell with substitute user and group IDs</para>
366</listitem>
367</varlistentry>
368
369<varlistentry id="useradd">
370<term><command>useradd</command></term>
371<listitem>
372<para>Creates a new user with the given name, or updates the default
373new-user information</para>
374<indexterm zone="ch-system-shadow useradd"><primary sortas="b-useradd">useradd</primary></indexterm>
375</listitem>
376</varlistentry>
377
378<varlistentry id="userdel">
379<term><command>userdel</command></term>
380<listitem>
381<para>Deletes the given user account</para>
382<indexterm zone="ch-system-shadow userdel"><primary sortas="b-userdel">userdel</primary></indexterm>
383</listitem>
384</varlistentry>
385
386<varlistentry id="usermod">
387<term><command>usermod</command></term>
388<listitem>
389<para>Is used to modify the given user's login name, User
390Identification (UID),
391shell, initial group, home directory, etc.</para>
392<indexterm zone="ch-system-shadow usermod"><primary sortas="b-usermod">usermod</primary></indexterm>
393</listitem>
394</varlistentry>
395
396<varlistentry id="vigr">
397<term><command>vigr</command></term>
398<listitem>
399<para>Edits the <filename>/etc/group</filename> or
400<filename>/etc/gshadow</filename> files</para>
401<indexterm zone="ch-system-shadow vigr"><primary sortas="b-vigr">vigr</primary></indexterm>
402</listitem>
403</varlistentry>
404
405<varlistentry id="vipw">
406<term><command>vipw</command></term>
407<listitem>
408<para>Edits the <filename>/etc/passwd</filename> or
409<filename>/etc/shadow</filename> files</para>
410<indexterm zone="ch-system-shadow vipw"><primary sortas="b-vipw">vipw</primary></indexterm>
411</listitem>
412</varlistentry>
413
414<varlistentry id="libshadow">
415<term><filename class="libraryfile">libshadow</filename></term>
416<listitem>
417<para>Contains functions used by most programs in this package</para>
418<indexterm zone="ch-system-shadow libshadow"><primary sortas="c-libshadow">libshadow</primary></indexterm>
419</listitem>
420</varlistentry>
421</variablelist>
422
423</sect2>
424
425</sect1>
426
Note: See TracBrowser for help on using the repository browser.