source: chapter06/shadow.xml@ 3202348

10.0 10.0-rc1 10.1 10.1-rc1 11.0 11.0-rc1 11.0-rc2 11.0-rc3 11.1 11.1-rc1 11.2 11.2-rc1 11.3 11.3-rc1 12.0 12.0-rc1 12.1 12.1-rc1 6.3 6.4 6.5 6.6 6.7 6.8 7.0 7.1 7.2 7.3 7.4 7.5 7.5-systemd 7.6 7.6-systemd 7.7 7.7-systemd 7.8 7.8-systemd 7.9 7.9-systemd 8.0 8.1 8.2 8.3 8.4 9.0 9.1 arm bdubbs/gcc13 ml-11.0 multilib renodr/libudev-from-systemd s6-init trunk xry111/arm64 xry111/arm64-12.0 xry111/clfs-ng xry111/lfs-next xry111/loongarch xry111/loongarch-12.0 xry111/loongarch-12.1 xry111/mips64el xry111/pip3 xry111/rust-wip-20221008 xry111/update-glibc
Last change on this file since 3202348 was f2e18a8, checked in by Jim Gifford <jim@…>, 18 years ago

r7702@server: jim | 2006-05-22 00:56:58 -0700
Fixed a support issue with Shadow's cracklib sed command.

git-svn-id: ​http://svn.linuxfromscratch.org/LFS/trunk/BOOK@7625 4aa44e1e-78dd-0310-a6d2-fbcd4c07a689
  • Property mode set to 100644
File size: 19.1 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../general.ent">
5 %general-entities;
6]>
7
8<sect1 id="ch-system-shadow" role="wrap">
9 <?dbhtml filename="shadow.html"?>
10
11 <title>Shadow-&shadow-version;</title>
12
13 <indexterm zone="ch-system-shadow">
14 <primary sortas="a-Shadow">Shadow</primary>
15 </indexterm>
16
17 <sect2 role="package">
18 <title/>
19
20 <para>The Shadow package contains programs for handling passwords in a secure
21 way.</para>
22
23 <segmentedlist>
24 <segtitle>&buildtime;</segtitle>
25 <segtitle>&diskspace;</segtitle>
26
27 <seglistitem>
28 <seg>&shadow-ch6-sbu;</seg>
29 <seg>&shadow-ch6-du;</seg>
30 </seglistitem>
31 </segmentedlist>
32
33 </sect2>
34
35 <sect2 role="installation">
36 <title>Installation of Shadow</title>
37
38 <note>
39 <para>If you would like to enforce the use of strong passwords, refer to
40 <ulink url="&blfs-root;view/svn/postlfs/cracklib.html"/> for installing
41 Cracklib prior to building Shadow. Then add
42 <parameter>--with-libcrack</parameter> to the <command>configure</command>
43 command below.</para>
44 </note>
45
46 <para>Prepare Shadow for compilation:</para>
47
48<screen><userinput>./configure --libdir=/lib --enable-shared --without-selinux</userinput></screen>
49
50 <variablelist>
51 <title>The meaning of the configure options:</title>
52
53 <varlistentry>
54 <term><parameter>--without-selinux</parameter></term>
55 <listitem>
56 <para>Support for selinux is enabled by default, but selinux is not
57 built in a base LFS system. The <command>configure</command> script
58 will fail if this option is not used.</para>
59 </listitem>
60 </varlistentry>
61
62 </variablelist>
63
64 <para>Disable the installation of the <command>groups</command> program
65 and its man page, as Coreutils provides a better version:</para>
66
67<screen><userinput>sed -i 's/groups$(EXEEXT) //' src/Makefile
68find man -name Makefile -exec sed -i '/groups/d' {} \;</userinput></screen>
69
70 <para>Disable the installation of Chinese and Korean manual pages, since
71 Man-DB cannot format them properly:</para>
72
73<screen><userinput>sed -i -e 's/ ko//' -e 's/ zh_CN zh_TW//' man/Makefile</userinput></screen>
74
75 <para>Shadow supplies other manual pages in a UTF-8 encoding. Man-DB
76 can display these in the recommended encodings by using the
77 <command>convert-mans</command> script which we installed.</para>
78
79<screen><userinput> for i in de es fi fr id it pt_BR; do
80 convert-mans UTF-8 ISO-8859-1 man/${i}/*.?
81done
82
83for i in cs hu pl; do
84 convert-mans UTF-8 ISO-8859-2 man/${i}/*.?
85done
86
87convert-mans UTF-8 EUC-JP man/ja/*.?
88convert-mans UTF-8 KOI8-R man/ru/*.?
89convert-mans UTF-8 ISO-8859-9 man/tr/*.?</userinput></screen>
90
91 <para>Compile the package:</para>
92
93<screen><userinput>make</userinput></screen>
94
95 <para>This package does not come with a test suite.</para>
96
97 <para>Install the package:</para>
98
99<screen><userinput>make install</userinput></screen>
100
101 <para id="shadow-limits-login_access">Shadow uses two files to configure
102 authentication settings for the system. Install these two configuration
103 files:</para>
104
105 <indexterm zone="shadow-limits-login_access">
106 <primary sortas="e-/etc/limits">/etc/limits</primary>
107 </indexterm>
108
109 <indexterm zone="shadow-limits-login_access">
110 <primary sortas="e-/etc/login.access">/etc/login.access</primary>
111 </indexterm>
112
113<screen><userinput>cp -v etc/{limits,login.access} /etc</userinput></screen>
114
115 <para id="shadow-login_defs">Instead of using the default
116 <emphasis>crypt</emphasis> method, use the more secure
117 <emphasis>MD5</emphasis> method of password encryption, which also allows
118 passwords longer than 8 characters. It is also necessary to change the
119 obsolete <filename class="directory">/var/spool/mail</filename> location
120 for user mailboxes that Shadow uses by default to the <filename
121 class="directory">/var/mail</filename> location used currently. Both of
122 these can be accomplished by changing the relevant configuration file
123 while copying it to its destination:</para>
124
125 <indexterm zone="shadow-login_defs">
126 <primary sortas="e-/etc/login.defs">/etc/login.defs</primary>
127 </indexterm>
128
129<screen><userinput>sed -e's@#MD5_CRYPT_ENAB.no@MD5_CRYPT_ENAB yes@' \
130 -e 's@/var/spool/mail@/var/mail@' \
131 etc/login.defs &gt; /etc/login.defs</userinput></screen>
132
133 <note>
134 <para>If you built Shadow with Cracklib support, insert the following into
135 the <command>sed</command> given below:</para>
136
137<screen><literal>sed -i 's@DICTPATH.*@DICTPATH\t/lib/cracklib/pw_dict@' /etc/login.defs</literal></screen>
138 </note>
139
140 <para>Move a misplaced program to its proper location:</para>
141
142<screen><userinput>mv -v /usr/bin/passwd /bin</userinput></screen>
143
144 <para>Move Shadow's libraries to more appropriate locations:</para>
145
146<screen><userinput>mv -v /lib/libshadow.*a /usr/lib
147rm -v /lib/libshadow.so
148ln -sfv ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
149
150 <para>The <parameter>-D</parameter> option of the
151 <command>useradd</command> program requires the <filename
152 class="directory">/etc/default</filename> directory for it to work
153 properly:</para>
154
155<screen><userinput>mkdir -v /etc/default</userinput></screen>
156
157 </sect2>
158
159 <sect2 id="conf-shadow" role="configuration">
160 <title>Configuring Shadow</title>
161
162 <indexterm zone="conf-shadow">
163 <primary sortas="a-Shadow">Shadow</primary>
164 <secondary>configuring</secondary>
165 </indexterm>
166
167 <para>This package contains utilities to add, modify, and delete users and
168 groups; set and change their passwords; and perform other administrative
169 tasks. For a full explanation of what <emphasis>password shadowing</emphasis>
170 means, see the <filename>doc/HOWTO</filename> file within the unpacked
171 source tree. If using Shadow support, keep in mind that programs which need
172 to verify passwords (display managers, FTP programs, pop3 daemons, etc.)
173 must be Shadow-compliant. That is, they need to be able to work with
174 shadowed passwords.</para>
175
176 <para>To enable shadowed passwords, run the following command:</para>
177
178<screen><userinput>pwconv</userinput></screen>
179
180 <para>To enable shadowed group passwords, run:</para>
181
182<screen><userinput>grpconv</userinput></screen>
183
184 <para>Under normal circumstances, passwords will not have been created
185 yet. However, if returning to this section later to enable shadowing,
186 reset any current user passwords with the <command>passwd</command>
187 command or any group passwords with the <command>gpasswd</command>
188 command.</para>
189
190 </sect2>
191
192 <sect2 role="configuration">
193 <title>Setting the root password</title>
194
195 <para>Choose a password for user <emphasis>root</emphasis> and set it
196 by running:</para>
197
198<screen role="nodump"><userinput>passwd root</userinput></screen>
199
200 </sect2>
201
202 <sect2 id="contents-shadow" role="content">
203 <title>Contents of Shadow</title>
204
205 <segmentedlist>
206 <segtitle>Installed programs</segtitle>
207 <segtitle>Installed libraries</segtitle>
208
209 <seglistitem>
210 <seg>chage, chfn, chgpasswd, chpasswd, chsh, expiry, faillog, gpasswd,
211 groupadd, groupdel, groupmod, grpck, grpconv, grpunconv, lastlog, login,
212 logoutd, newgrp, newusers, passwd, pwck, pwconv, pwunconv, sg (link to
213 newgrp), su, useradd, userdel, usermod, vigr (link to vipw), and
214 vipw</seg>
215 <seg>libshadow.{a,so}</seg>
216 </seglistitem>
217 </segmentedlist>
218
219 <variablelist>
220 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
221 <?dbfo list-presentation="list"?>
222 <?dbhtml list-presentation="table"?>
223
224 <varlistentry id="chage">
225 <term><command>chage</command></term>
226 <listitem>
227 <para>Used to change the maximum number of days between obligatory
228 password changes</para>
229 <indexterm zone="ch-system-shadow chage">
230 <primary sortas="b-chage">chage</primary>
231 </indexterm>
232 </listitem>
233 </varlistentry>
234
235 <varlistentry id="chfn">
236 <term><command>chfn</command></term>
237 <listitem>
238 <para>Used to change a user's full name and other information</para>
239 <indexterm zone="ch-system-shadow chfn">
240 <primary sortas="b-chfn">chfn</primary>
241 </indexterm>
242 </listitem>
243 </varlistentry>
244
245 <varlistentry id="chgpasswd">
246 <term><command>chgpasswd</command></term>
247 <listitem>
248 <para>Used to update group passwords in batch mode</para>
249 <indexterm zone="ch-system-shadow chgpasswd">
250 <primary sortas="b-chgpasswd">chgpasswd</primary>
251 </indexterm>
252 </listitem>
253 </varlistentry>
254
255 <varlistentry id="chpasswd">
256 <term><command>chpasswd</command></term>
257 <listitem>
258 <para>Used to update user passwords in batch mode</para>
259 <indexterm zone="ch-system-shadow chpasswd">
260 <primary sortas="b-chpasswd">chpasswd</primary>
261 </indexterm>
262 </listitem>
263 </varlistentry>
264
265 <varlistentry id="chsh">
266 <term><command>chsh</command></term>
267 <listitem>
268 <para>Used to change a user's default login shell</para>
269 <indexterm zone="ch-system-shadow chsh">
270 <primary sortas="b-chsh">chsh</primary>
271 </indexterm>
272 </listitem>
273 </varlistentry>
274
275 <varlistentry id="expiry">
276 <term><command>expiry</command></term>
277 <listitem>
278 <para>Checks and enforces the current password expiration policy</para>
279 <indexterm zone="ch-system-shadow expiry">
280 <primary sortas="b-expiry">expiry</primary>
281 </indexterm>
282 </listitem>
283 </varlistentry>
284
285 <varlistentry id="faillog">
286 <term><command>faillog</command></term>
287 <listitem>
288 <para>Is used to examine the log of login failures, to set a maximum
289 number of failures before an account is blocked, or to reset the
290 failure count</para>
291 <indexterm zone="ch-system-shadow faillog">
292 <primary sortas="b-faillog">faillog</primary>
293 </indexterm>
294 </listitem>
295 </varlistentry>
296
297 <varlistentry id="gpasswd">
298 <term><command>gpasswd</command></term>
299 <listitem>
300 <para>Is used to add and delete members and administrators to
301 groups</para>
302 <indexterm zone="ch-system-shadow gpasswd">
303 <primary sortas="b-gpasswd">gpasswd</primary>
304 </indexterm>
305 </listitem>
306 </varlistentry>
307
308 <varlistentry id="groupadd">
309 <term><command>groupadd</command></term>
310 <listitem>
311 <para>Creates a group with the given name</para>
312 <indexterm zone="ch-system-shadow groupadd">
313 <primary sortas="b-groupadd">groupadd</primary>
314 </indexterm>
315 </listitem>
316 </varlistentry>
317
318 <varlistentry id="groupdel">
319 <term><command>groupdel</command></term>
320 <listitem>
321 <para>Deletes the group with the given name</para>
322 <indexterm zone="ch-system-shadow groupdel">
323 <primary sortas="b-groupdel">groupdel</primary>
324 </indexterm>
325 </listitem>
326 </varlistentry>
327
328 <varlistentry id="groupmod">
329 <term><command>groupmod</command></term>
330 <listitem>
331 <para>Is used to modify the given group's name or GID</para>
332 <indexterm zone="ch-system-shadow groupmod">
333 <primary sortas="b-groupmod">groupmod</primary>
334 </indexterm>
335 </listitem>
336 </varlistentry>
337
338 <varlistentry id="grpck">
339 <term><command>grpck</command></term>
340 <listitem>
341 <para>Verifies the integrity of the group files
342 <filename>/etc/group</filename> and
343 <filename>/etc/gshadow</filename></para>
344 <indexterm zone="ch-system-shadow grpck">
345 <primary sortas="b-grpck">grpck</primary>
346 </indexterm>
347 </listitem>
348 </varlistentry>
349
350 <varlistentry id="grpconv">
351 <term><command>grpconv</command></term>
352 <listitem>
353 <para>Creates or updates the shadow group file from the normal
354 group file</para>
355 <indexterm zone="ch-system-shadow grpconv">
356 <primary sortas="b-grpconv">grpconv</primary>
357 </indexterm>
358 </listitem>
359 </varlistentry>
360
361 <varlistentry id="grpunconv">
362 <term><command>grpunconv</command></term>
363 <listitem>
364 <para>Updates <filename>/etc/group</filename> from
365 <filename>/etc/gshadow</filename> and then deletes the latter</para>
366 <indexterm zone="ch-system-shadow grpunconv">
367 <primary sortas="b-grpunconv">grpunconv</primary>
368 </indexterm>
369 </listitem>
370 </varlistentry>
371
372 <varlistentry id="lastlog">
373 <term><command>lastlog</command></term>
374 <listitem>
375 <para>Reports the most recent login of all users or of a
376 given user</para>
377 <indexterm zone="ch-system-shadow lastlog">
378 <primary sortas="b-lastlog">lastlog</primary>
379 </indexterm>
380 </listitem>
381 </varlistentry>
382
383 <varlistentry id="login">
384 <term><command>login</command></term>
385 <listitem>
386 <para>Is used by the system to let users sign on</para>
387 <indexterm zone="ch-system-shadow login">
388 <primary sortas="b-login">login</primary>
389 </indexterm>
390 </listitem>
391 </varlistentry>
392
393 <varlistentry id="logoutd">
394 <term><command>logoutd</command></term>
395 <listitem>
396 <para>Is a daemon used to enforce restrictions on log-on time
397 and ports</para>
398 <indexterm zone="ch-system-shadow logoutd">
399 <primary sortas="b-logoutd">logoutd</primary>
400 </indexterm>
401 </listitem>
402 </varlistentry>
403
404 <varlistentry id="newgrp">
405 <term><command>newgrp</command></term>
406 <listitem>
407 <para>Is used to change the current GID during a login session</para>
408 <indexterm zone="ch-system-shadow newgrp">
409 <primary sortas="b-newgrp">newgrp</primary>
410 </indexterm>
411 </listitem>
412 </varlistentry>
413
414 <varlistentry id="newusers">
415 <term><command>newusers</command></term>
416 <listitem>
417 <para>Is used to create or update an entire series of user
418 accounts</para>
419 <indexterm zone="ch-system-shadow newusers">
420 <primary sortas="b-newusers">newusers</primary>
421 </indexterm>
422 </listitem>
423 </varlistentry>
424
425 <varlistentry id="passwd">
426 <term><command>passwd</command></term>
427 <listitem>
428 <para>Is used to change the password for a user or group account</para>
429 <indexterm zone="ch-system-shadow passwd">
430 <primary sortas="b-passwd">passwd</primary>
431 </indexterm>
432 </listitem>
433 </varlistentry>
434
435 <varlistentry id="pwck">
436 <term><command>pwck</command></term>
437 <listitem>
438 <para>Verifies the integrity of the password files
439 <filename>/etc/passwd</filename> and
440 <filename>/etc/shadow</filename></para>
441 <indexterm zone="ch-system-shadow pwck">
442 <primary sortas="b-pwck">pwck</primary>
443 </indexterm>
444 </listitem>
445 </varlistentry>
446
447 <varlistentry id="pwconv">
448 <term><command>pwconv</command></term>
449 <listitem>
450 <para>Creates or updates the shadow password file from the normal
451 password file</para>
452 <indexterm zone="ch-system-shadow pwconv">
453 <primary sortas="b-pwconv">pwconv</primary>
454 </indexterm>
455 </listitem>
456 </varlistentry>
457
458 <varlistentry id="pwunconv">
459 <term><command>pwunconv</command></term>
460 <listitem>
461 <para>Updates <filename>/etc/passwd</filename> from
462 <filename>/etc/shadow</filename> and then deletes the latter</para>
463 <indexterm zone="ch-system-shadow pwunconv">
464 <primary sortas="b-pwunconv">pwunconv</primary>
465 </indexterm>
466 </listitem>
467 </varlistentry>
468
469 <varlistentry id="sg">
470 <term><command>sg</command></term>
471 <listitem>
472 <para>Executes a given command while the user's GID
473 is set to that of the given group</para>
474 <indexterm zone="ch-system-shadow sg">
475 <primary sortas="b-sg">sg</primary>
476 </indexterm>
477 </listitem>
478 </varlistentry>
479
480 <varlistentry id="su">
481 <term><command>su</command></term>
482 <listitem>
483 <para>Runs a shell with substitute user and group IDs</para>
484 <indexterm zone="ch-system-shadow su">
485 <primary sortas="b-su">su</primary>
486 </indexterm>
487 </listitem>
488 </varlistentry>
489
490 <varlistentry id="useradd">
491 <term><command>useradd</command></term>
492 <listitem>
493 <para>Creates a new user with the given name, or updates the default
494 new-user information</para>
495 <indexterm zone="ch-system-shadow useradd">
496 <primary sortas="b-useradd">useradd</primary>
497 </indexterm>
498 </listitem>
499 </varlistentry>
500
501 <varlistentry id="userdel">
502 <term><command>userdel</command></term>
503 <listitem>
504 <para>Deletes the given user account</para>
505 <indexterm zone="ch-system-shadow userdel">
506 <primary sortas="b-userdel">userdel</primary>
507 </indexterm>
508 </listitem>
509 </varlistentry>
510
511 <varlistentry id="usermod">
512 <term><command>usermod</command></term>
513 <listitem>
514 <para>Is used to modify the given user's login name, User
515 Identification (UID), shell, initial group, home directory, etc.</para>
516 <indexterm zone="ch-system-shadow usermod">
517 <primary sortas="b-usermod">usermod</primary>
518 </indexterm>
519 </listitem>
520 </varlistentry>
521
522 <varlistentry id="vigr">
523 <term><command>vigr</command></term>
524 <listitem>
525 <para>Edits the <filename>/etc/group</filename> or
526 <filename>/etc/gshadow</filename> files</para>
527 <indexterm zone="ch-system-shadow vigr">
528 <primary sortas="b-vigr">vigr</primary>
529 </indexterm>
530 </listitem>
531 </varlistentry>
532
533 <varlistentry id="vipw">
534 <term><command>vipw</command></term>
535 <listitem>
536 <para>Edits the <filename>/etc/passwd</filename> or
537 <filename>/etc/shadow</filename> files</para>
538 <indexterm zone="ch-system-shadow vipw">
539 <primary sortas="b-vipw">vipw</primary>
540 </indexterm>
541 </listitem>
542 </varlistentry>
543
544 <varlistentry id="libshadow">
545 <term><filename class="libraryfile">libshadow</filename></term>
546 <listitem>
547 <para>Contains functions used by most programs in this package</para>
548 <indexterm zone="ch-system-shadow libshadow">
549 <primary sortas="c-libshadow">libshadow</primary>
550 </indexterm>
551 </listitem>
552 </varlistentry>
553
554 </variablelist>
555
556 </sect2>
557
558</sect1>
Note: See TracBrowser for help on using the repository browser.