source: chapter06/shadow.xml@ 4917d0c0

Last change on this file since 4917d0c0 was 4917d0c0, checked in by Jim Gifford <jim@…>, 19 years ago

Updates: Thanx Manuel

git-svn-id: http://svn.linuxfromscratch.org/LFS/branches/multi-arch/BOOK@4609 4aa44e1e-78dd-0310-a6d2-fbcd4c07a689

  • Property mode set to 100644
File size: 14.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN" "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
3 <!ENTITY % general-entities SYSTEM "../general.ent">
4 %general-entities;
5]>
6<sect1 id="ch-system-shadow" role="wrap">
7<title>Shadow-&shadow-version;</title>
8<?dbhtml filename="shadow.html"?>
9
10<indexterm zone="ch-system-shadow"><primary sortas="a-Shadow">Shadow</primary></indexterm>
11
12<sect2 role="package"><title/>
13<para>The Shadow package contains programs for handling passwords in a secure
14way.</para>
15
16<segmentedlist>
17<segtitle>&buildtime;</segtitle>
18<segtitle>&diskspace;</segtitle>
19<seglistitem><seg>0.4 SBU</seg><seg>11 MB</seg></seglistitem>
20</segmentedlist>
21
22<segmentedlist>
23<segtitle>Shadow installation depends on</segtitle>
24<seglistitem><seg>Bash, Binutils, Bison, Coreutils,
25Diffutils, GCC, Gettext, Glibc, Grep, Make, and Sed</seg></seglistitem>
26</segmentedlist>
27</sect2>
28
29<sect2 role="installation">
30<title>Installation of Shadow</title>
31
32<para>Prepare Shadow for compilation:</para>
33
34<screen><userinput>./configure --libdir=/usr/lib --enable-shared</userinput></screen>
35
36<para>Remove the installation of the groups program, and it's man page:</para>
37
38<screen><userinput>sed -i 's/groups$(EXEEXT) //' src/Makefile
39sed -i '/groups/d' man/Makefile</userinput></screen>
40
41<para>Compile the package:</para>
42
43<screen><userinput>make</userinput></screen>
44
45<para>Install the package:</para>
46
47<screen><userinput>make install</userinput></screen>
48
49<para id="shadow-limits-login_access">Shadow uses two files to configure
50authentication settings for the system. Install these two config files:</para>
51
52<indexterm zone="shadow-limits-login_access"><primary sortas="e-/etc/limits">/etc/limits</primary></indexterm>
53<indexterm zone="shadow-limits-login_access"><primary sortas="e-/etc/login.access">/etc/login.access</primary></indexterm>
54
55<screen><userinput>cp etc/{limits,login.access} /etc</userinput></screen>
56
57<beginpage/>
58<para id="shadow-login_defs">Instead of using the default <emphasis>crypt</emphasis> method,
59use the more secure <emphasis>MD5</emphasis> method of password
60encryption, which also allows passwords longer than 8 characters. It
61is also necessary to change the obsolete <filename
62class="directory">/var/spool/mail</filename> location for user
63mailboxes that Shadow uses by default to the <filename
64class="directory">/var/mail</filename> location used currently. Both
65of these can be accomplished by changing the relevant configuration
66file while copying it to its destination:</para>
67
68<indexterm zone="shadow-login_defs"><primary sortas="e-/etc/login.defs">/etc/login.defs</primary></indexterm>
69
70<screen><userinput>cp etc/login.defs.linux /etc/login.defs
71sed -i -e 's@#MD5_CRYPT_ENAB.no@MD5_CRYPT_ENAB yes@' \
72 -e 's@/var/spool/mail@/var/mail@' /etc/login.defs</userinput></screen>
73
74<para>Move a misplaced program to their proper
75location:</para>
76
77<screen><userinput>mv /usr/bin/passwd /bin</userinput></screen>
78
79<para>Move Shadow's dynamic libraries to a more appropriate
80location:</para>
81
82<screen><userinput>mv /usr/lib/libshadow.so.0* /lib</userinput></screen>
83
84<para>Because some packages expect to find the just-moved libraries in
85<filename class="directory">/usr/lib</filename>, create the following
86symlink:</para>
87
88<screen><userinput>ln -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
89
90<para>The <parameter>-D</parameter> option of the
91<command>useradd</command> program requires the <filename
92class="directory">/etc/default</filename> directory for it to work
93properly:</para>
94
95<screen><userinput>mkdir /etc/default</userinput></screen>
96
97</sect2>
98
99
100<sect2 id="conf-shadow" role="configuration"><title>Configuring Shadow</title>
101<indexterm zone="conf-shadow">
102<primary sortas="a-Shadow">Shadow</primary>
103<secondary>configuring</secondary></indexterm>
104
105<para>This package contains utilities to add, modify, and delete users
106and groups; set and change their passwords; and perform other
107administrative tasks. For a full explanation of what
108<emphasis>password shadowing</emphasis> means, see the
109<filename>doc/HOWTO</filename> file within the unpacked source tree.
110If using Shadow support, keep in mind that programs which need to
111verify passwords (display managers, FTP programs, pop3 daemons, etc.)
112must be shadow-compliant. That is, they need to be able to work with
113shadowed passwords.</para>
114
115<para>To enable shadowed passwords, run the following command:</para>
116
117<screen><userinput>pwconv</userinput></screen>
118
119<para>To enable shadowed group passwords, run:</para>
120
121<screen><userinput>grpconv</userinput></screen>
122
123<para>Under normal circumstances, passwords will not have been created
124yet. However, if returning to this section later to enable shadowing,
125reset any current user passwords with the <command>passwd</command>
126command or any group passwords with the <command>gpasswd</command>
127command.</para>
128
129</sect2>
130
131
132<sect2 role="configuration">
133<title>Setting the root password</title>
134
135<para>Choose a password for user <emphasis>root</emphasis> and set it
136by running:</para>
137
138<screen><userinput>passwd root</userinput></screen>
139<beginpage/>
140</sect2>
141
142
143<sect2 id="contents-shadow" role="content"><title>Contents of Shadow</title>
144
145<segmentedlist>
146<segtitle>Installed programs</segtitle>
147<segtitle>Installed libraries</segtitle>
148<seglistitem><seg>chage, chfn, chpasswd, chsh, expiry, faillog, gpasswd,
149groupadd, groupdel, groupmod, groups, grpck, grpconv, grpunconv, lastlog, login,
150logoutd, mkpasswd, newgrp, newusers, passwd, pwck, pwconv, pwunconv, sg
151(link to newgrp), useradd, userdel, usermod, vigr (link to vipw), and vipw</seg>
152<seg>libshadow[.a,so]</seg>
153</seglistitem>
154</segmentedlist>
155
156<variablelist><bridgehead renderas="sect3">Short Descriptions</bridgehead>
157<?dbfo list-presentation="list"?>
158
159<varlistentry id="chage">
160<term><command>chage</command></term>
161<listitem>
162<para>Used to change the maximum number of days between obligatory
163password changes</para>
164<indexterm zone="ch-system-shadow chage"><primary sortas="b-chage">chage</primary></indexterm>
165</listitem>
166</varlistentry>
167
168<varlistentry id="chfn">
169<term><command>chfn</command></term>
170<listitem>
171<para>Used to change a user's full name and other info</para>
172<indexterm zone="ch-system-shadow chfn"><primary sortas="b-chfn">chfn</primary></indexterm>
173</listitem>
174</varlistentry>
175
176<varlistentry id="chpasswd">
177<term><command>chpasswd</command></term>
178<listitem>
179<para>Used to update the passwords of an entire series of user
180accounts</para>
181<indexterm zone="ch-system-shadow chpasswd"><primary sortas="b-chpasswd">chpasswd</primary></indexterm>
182</listitem>
183</varlistentry>
184
185<varlistentry id="chsh">
186<term><command>chsh</command></term>
187<listitem>
188<para>Used to change a user's default login shell</para>
189<indexterm zone="ch-system-shadow chsh"><primary sortas="b-chsh">chsh</primary></indexterm>
190</listitem>
191</varlistentry>
192
193<varlistentry id="expiry">
194<term><command>expiry</command></term>
195<listitem>
196<para>Checks and enforces the current password expiration policy</para>
197<indexterm zone="ch-system-shadow expiry"><primary sortas="b-expiry">expiry</primary></indexterm>
198</listitem>
199</varlistentry>
200
201<varlistentry id="faillog">
202<term><command>faillog</command></term>
203<listitem>
204<para>Is used to examine the log of login failures, to set a maximum number of
205failures before an account is blocked, or to reset the failure count</para>
206<indexterm zone="ch-system-shadow faillog"><primary sortas="b-faillog">faillog</primary></indexterm>
207</listitem>
208</varlistentry>
209
210<varlistentry id="gpasswd">
211<term><command>gpasswd</command></term>
212<listitem>
213<para>Is used to add and delete members and administrators to groups</para>
214<indexterm zone="ch-system-shadow gpasswd"><primary sortas="b-gpasswd">gpasswd</primary></indexterm>
215</listitem>
216</varlistentry>
217
218<varlistentry id="groupadd">
219<term><command>groupadd</command></term>
220<listitem>
221<para>Creates a group with the given name</para>
222<indexterm zone="ch-system-shadow groupadd"><primary sortas="b-groupadd">groupadd</primary></indexterm>
223</listitem>
224</varlistentry>
225
226<varlistentry id="groupdel">
227<term><command>groupdel</command></term>
228<listitem>
229<para>Deletes the group with the given name</para>
230<indexterm zone="ch-system-shadow groupdel"><primary sortas="b-groupdel">groupdel</primary></indexterm>
231</listitem>
232</varlistentry>
233
234<varlistentry id="groupmod">
235<term><command>groupmod</command></term>
236<listitem>
237<para>Is used to modify the given group's name or GID</para>
238<indexterm zone="ch-system-shadow groupmod"><primary sortas="b-groupmod">groupmod</primary></indexterm>
239</listitem>
240</varlistentry>
241
242<varlistentry id="groups">
243<term><command>groups</command></term>
244<listitem>
245<para>Reports the groups of which the given users are members</para>
246<indexterm zone="ch-system-shadow groups"><primary sortas="b-groups">groups</primary></indexterm>
247</listitem>
248</varlistentry>
249
250<varlistentry id="grpck">
251<term><command>grpck</command></term>
252<listitem>
253<para>Verifies the integrity of the group files <filename>/etc/group</filename>
254and <filename>/etc/gshadow</filename></para>
255<indexterm zone="ch-system-shadow grpck"><primary sortas="b-grpck">grpck</primary></indexterm>
256</listitem>
257</varlistentry>
258
259<varlistentry id="grpconv">
260<term><command>grpconv</command></term>
261<listitem>
262<para>Creates or updates the shadow group file from the normal group file</para>
263<indexterm zone="ch-system-shadow grpconv"><primary sortas="b-grpconv">grpconv</primary></indexterm>
264</listitem>
265</varlistentry>
266
267<varlistentry id="grpunconv">
268<term><command>grpunconv</command></term>
269<listitem>
270<para>Updates <filename>/etc/group</filename>
271from <filename>/etc/gshadow</filename> and then deletes the latter</para>
272<indexterm zone="ch-system-shadow grpunconv"><primary sortas="b-grpunconv">grpunconv</primary></indexterm>
273</listitem>
274</varlistentry>
275
276<varlistentry id="lastlog">
277<term><command>lastlog</command></term>
278<listitem>
279<para>Reports the most recent login of all users or of a given user</para>
280<indexterm zone="ch-system-shadow lastlog"><primary sortas="b-lastlog">lastlog</primary></indexterm>
281</listitem>
282</varlistentry>
283
284<varlistentry id="login">
285<term><command>login</command></term>
286<listitem>
287<para>Is used by the system to let users sign on</para>
288<indexterm zone="ch-system-shadow login"><primary sortas="b-login">login</primary></indexterm>
289</listitem>
290</varlistentry>
291
292<varlistentry id="logoutd">
293<term><command>logoutd</command></term>
294<listitem>
295<para>Is a daemon used to enforce restrictions on log-on time and ports</para>
296<indexterm zone="ch-system-shadow logoutd"><primary sortas="b-logoutd">logoutd</primary></indexterm>
297</listitem>
298</varlistentry>
299
300<varlistentry id="mkpasswd">
301<term><command>mkpasswd</command></term>
302<listitem>
303<para>Generates random passwords</para>
304<indexterm zone="ch-system-shadow mkpasswd"><primary sortas="b-mkpasswd">mkpasswd</primary></indexterm>
305</listitem>
306</varlistentry>
307
308<varlistentry id="newgrp">
309<term><command>newgrp</command></term>
310<listitem>
311<para>Is used to change the current GID during a login session</para>
312<indexterm zone="ch-system-shadow newgrp"><primary sortas="b-newgrp">newgrp</primary></indexterm>
313</listitem>
314</varlistentry>
315
316<varlistentry id="newusers">
317<term><command>newusers</command></term>
318<listitem>
319<para>Is used to create or update an entire series of user accounts</para>
320<indexterm zone="ch-system-shadow newusers"><primary sortas="b-newusers">newusers</primary></indexterm>
321</listitem>
322</varlistentry>
323
324<varlistentry id="passwd">
325<term><command>passwd</command></term>
326<listitem>
327<para>Is used to change the password for a user or group account</para>
328<indexterm zone="ch-system-shadow passwd"><primary sortas="b-passwd">passwd</primary></indexterm>
329</listitem>
330</varlistentry>
331
332<varlistentry id="pwck">
333<term><command>pwck</command></term>
334<listitem>
335<para>Verifies the integrity of the password files
336<filename>/etc/passwd</filename> and <filename>/etc/shadow</filename></para>
337<indexterm zone="ch-system-shadow pwck"><primary sortas="b-pwck">pwck</primary></indexterm>
338</listitem>
339</varlistentry>
340
341<varlistentry id="pwconv">
342<term><command>pwconv</command></term>
343<listitem>
344<para>Creates or updates the shadow password file from the normal
345password file</para>
346<indexterm zone="ch-system-shadow pwconv"><primary sortas="b-pwconv">pwconv</primary></indexterm>
347</listitem>
348</varlistentry>
349
350<varlistentry id="pwunconv">
351<term><command>pwunconv</command></term>
352<listitem>
353<para>Updates <filename>/etc/passwd</filename>
354from <filename>/etc/shadow</filename> and then deletes the latter</para>
355<indexterm zone="ch-system-shadow pwunconv"><primary sortas="b-pwunconv">pwunconv</primary></indexterm>
356</listitem>
357</varlistentry>
358
359<varlistentry id="sg">
360<term><command>sg</command></term>
361<listitem>
362<para>Executes a given command while the user's GID
363is set to that of the given group</para>
364<indexterm zone="ch-system-shadow sg"><primary sortas="b-sg">sg</primary></indexterm>
365</listitem>
366</varlistentry>
367
368<varlistentry id="su">
369<term><command>su</command></term>
370<listitem>
371<indexterm zone="ch-system-shadow su"><primary sortas="b-su">su</primary></indexterm>
372<para>Runs a shell with substitute user and group IDs</para>
373</listitem>
374</varlistentry>
375
376<varlistentry id="useradd">
377<term><command>useradd</command></term>
378<listitem>
379<para>Creates a new user with the given name, or updates the default
380new-user information</para>
381<indexterm zone="ch-system-shadow useradd"><primary sortas="b-useradd">useradd</primary></indexterm>
382</listitem>
383</varlistentry>
384
385<varlistentry id="userdel">
386<term><command>userdel</command></term>
387<listitem>
388<para>Deletes the given user account</para>
389<indexterm zone="ch-system-shadow userdel"><primary sortas="b-userdel">userdel</primary></indexterm>
390</listitem>
391</varlistentry>
392
393<varlistentry id="usermod">
394<term><command>usermod</command></term>
395<listitem>
396<para>Is used to modify the given user's login name, User
397Identification (UID),
398shell, initial group, home directory, etc.</para>
399<indexterm zone="ch-system-shadow usermod"><primary sortas="b-usermod">usermod</primary></indexterm>
400</listitem>
401</varlistentry>
402
403<varlistentry id="vigr">
404<term><command>vigr</command></term>
405<listitem>
406<para>Edits the <filename>/etc/group</filename> or
407<filename>/etc/gshadow</filename> files</para>
408<indexterm zone="ch-system-shadow vigr"><primary sortas="b-vigr">vigr</primary></indexterm>
409</listitem>
410</varlistentry>
411
412<varlistentry id="vipw">
413<term><command>vipw</command></term>
414<listitem>
415<para>Edits the <filename>/etc/passwd</filename> or
416<filename>/etc/shadow</filename> files</para>
417<indexterm zone="ch-system-shadow vipw"><primary sortas="b-vipw">vipw</primary></indexterm>
418</listitem>
419</varlistentry>
420
421<varlistentry id="libshadow">
422<term><filename class="libraryfile">libshadow</filename></term>
423<listitem>
424<para>Contains functions used by most programs in this package</para>
425<indexterm zone="ch-system-shadow libshadow"><primary sortas="c-libshadow">libshadow</primary></indexterm>
426</listitem>
427</varlistentry>
428</variablelist>
429
430</sect2>
431
432</sect1>
433
Note: See TracBrowser for help on using the repository browser.