source: chapter06/shadow.xml@ 49ae4c6

10.0 10.0-rc1 10.1 10.1-rc1 11.0 11.0-rc1 11.0-rc2 11.0-rc3 11.1 11.1-rc1 11.2 11.2-rc1 11.3 11.3-rc1 12.0 12.0-rc1 12.1 12.1-rc1 6.3 6.4 6.5 6.6 6.7 6.8 7.0 7.1 7.2 7.3 7.4 7.5 7.5-systemd 7.6 7.6-systemd 7.7 7.7-systemd 7.8 7.8-systemd 7.9 7.9-systemd 8.0 8.1 8.2 8.3 8.4 9.0 9.1 arm bdubbs/gcc13 ml-11.0 multilib renodr/libudev-from-systemd s6-init trunk xry111/arm64 xry111/arm64-12.0 xry111/clfs-ng xry111/lfs-next xry111/loongarch xry111/loongarch-12.0 xry111/loongarch-12.1 xry111/mips64el xry111/pip3 xry111/rust-wip-20221008 xry111/update-glibc
Last change on this file since 49ae4c6 was 040ba8e, checked in by Matthew Burgess <matthew@…>, 18 years ago

Upgrade to shadow-4.0.17

git-svn-id: ​http://svn.linuxfromscratch.org/LFS/trunk/BOOK@7736 4aa44e1e-78dd-0310-a6d2-fbcd4c07a689
  • Property mode set to 100644
File size: 18.2 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../general.ent">
5 %general-entities;
6]>
7
8<sect1 id="ch-system-shadow" role="wrap">
9 <?dbhtml filename="shadow.html"?>
10
11 <title>Shadow-&shadow-version;</title>
12
13 <indexterm zone="ch-system-shadow">
14 <primary sortas="a-Shadow">Shadow</primary>
15 </indexterm>
16
17 <sect2 role="package">
18 <title/>
19
20 <para>The Shadow package contains programs for handling passwords in a secure
21 way.</para>
22
23 <segmentedlist>
24 <segtitle>&buildtime;</segtitle>
25 <segtitle>&diskspace;</segtitle>
26
27 <seglistitem>
28 <seg>&shadow-ch6-sbu;</seg>
29 <seg>&shadow-ch6-du;</seg>
30 </seglistitem>
31 </segmentedlist>
32
33 </sect2>
34
35 <sect2 role="installation">
36 <title>Installation of Shadow</title>
37
38 <note>
39 <para>If you would like to enforce the use of strong passwords, refer to
40 <ulink url="&blfs-root;view/svn/postlfs/cracklib.html"/> for installing
41 Cracklib prior to building Shadow. Then add
42 <parameter>--with-libcrack</parameter> to the <command>configure</command>
43 command below.</para>
44 </note>
45
46 <para>Prepare Shadow for compilation:</para>
47
48<screen><userinput>./configure --libdir=/lib --sysconfdir=/etc --enable-shared --without-selinux</userinput></screen>
49
50 <variablelist>
51 <title>The meaning of the configure options:</title>
52
53 <varlistentry>
54 <term><parameter>--without-selinux</parameter></term>
55 <listitem>
56 <para>Support for selinux is enabled by default, but selinux is not
57 built in a base LFS system. The <command>configure</command> script
58 will fail if this option is not used.</para>
59 </listitem>
60 </varlistentry>
61
62 </variablelist>
63
64 <para>Disable the installation of the <command>groups</command> program
65 and its man pages, as Coreutils provides a better version:</para>
66
67<screen><userinput>sed -i 's/groups$(EXEEXT) //' src/Makefile
68find man -name Makefile -exec sed -i '/groups/d' {} \;</userinput></screen>
69
70 <para>Disable the installation of Chinese and Korean manual pages, since
71 Man-DB cannot format them properly:</para>
72
73<screen><userinput>sed -i -e 's/ ko//' -e 's/ zh_CN zh_TW//' man/Makefile</userinput></screen>
74
75 <para>Shadow supplies other manual pages in a UTF-8 encoding. Man-DB
76 can display these in the recommended encodings by using the
77 <command>convert-mans</command> script which we installed.</para>
78
79<screen><userinput> for i in de es fi fr id it pt_BR; do
80 convert-mans UTF-8 ISO-8859-1 man/${i}/*.?
81done
82
83for i in cs hu pl; do
84 convert-mans UTF-8 ISO-8859-2 man/${i}/*.?
85done
86
87convert-mans UTF-8 EUC-JP man/ja/*.?
88convert-mans UTF-8 KOI8-R man/ru/*.?
89convert-mans UTF-8 ISO-8859-9 man/tr/*.?</userinput></screen>
90
91 <para id="shadow-login_defs">Instead of using the default
92 <emphasis>crypt</emphasis> method, use the more secure
93 <emphasis>MD5</emphasis> method of password encryption, which also allows
94 passwords longer than 8 characters. It is also necessary to change the
95 obsolete <filename class="directory">/var/spool/mail</filename> location
96 for user mailboxes that Shadow uses by default to the <filename
97 class="directory">/var/mail</filename> location used currently.</para>
98
99<screen><userinput>sed -i -e 's@#MD5_CRYPT_ENAB.no@MD5_CRYPT_ENAB yes@' \
100 -e 's@/var/spool/mail@/var/mail@' etc/login.defs</userinput></screen>
101
102 <note>
103 <para>If you built Shadow with Cracklib support, run the following:</para>
104
105<screen role="nodump"><userinput>sed -i 's@DICTPATH.*@DICTPATH\t/lib/cracklib/pw_dict@' etc/login.defs</userinput></screen>
106 </note>
107
108 <para>Compile the package:</para>
109
110<screen><userinput>make</userinput></screen>
111
112 <para>This package does not come with a test suite.</para>
113
114 <para>Install the package:</para>
115
116<screen><userinput>make install</userinput></screen>
117
118 <para>Move a misplaced program to its proper location:</para>
119
120<screen><userinput>mv -v /usr/bin/passwd /bin</userinput></screen>
121
122 <para>Move Shadow's libraries to more appropriate locations:</para>
123
124<screen><userinput>mv -v /lib/libshadow.*a /usr/lib
125rm -v /lib/libshadow.so
126ln -sfv ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
127
128 </sect2>
129
130 <sect2 id="conf-shadow" role="configuration">
131 <title>Configuring Shadow</title>
132
133 <indexterm zone="conf-shadow">
134 <primary sortas="a-Shadow">Shadow</primary>
135 <secondary>configuring</secondary>
136 </indexterm>
137
138 <para>This package contains utilities to add, modify, and delete users and
139 groups; set and change their passwords; and perform other administrative
140 tasks. For a full explanation of what <emphasis>password shadowing</emphasis>
141 means, see the <filename>doc/HOWTO</filename> file within the unpacked
142 source tree. If using Shadow support, keep in mind that programs which need
143 to verify passwords (display managers, FTP programs, pop3 daemons, etc.)
144 must be Shadow-compliant. That is, they need to be able to work with
145 shadowed passwords.</para>
146
147 <para>To enable shadowed passwords, run the following command:</para>
148
149<screen><userinput>pwconv</userinput></screen>
150
151 <para>To enable shadowed group passwords, run:</para>
152
153<screen><userinput>grpconv</userinput></screen>
154
155 </sect2>
156
157 <sect2 role="configuration">
158 <title>Setting the root password</title>
159
160 <para>Choose a password for user <emphasis>root</emphasis> and set it
161 by running:</para>
162
163<screen role="nodump"><userinput>passwd root</userinput></screen>
164
165 </sect2>
166
167 <sect2 id="contents-shadow" role="content">
168 <title>Contents of Shadow</title>
169
170 <segmentedlist>
171 <segtitle>Installed programs</segtitle>
172 <segtitle>Installed libraries</segtitle>
173
174 <seglistitem>
175 <seg>chage, chfn, chgpasswd, chpasswd, chsh, expiry, faillog, gpasswd,
176 groupadd, groupdel, groupmod, grpck, grpconv, grpunconv, lastlog, login,
177 logoutd, newgrp, newusers, nologin, passwd, pwck, pwconv, pwunconv, sg (link to
178 newgrp), su, useradd, userdel, usermod, vigr (link to vipw), and
179 vipw</seg>
180 <seg>libshadow.{a,so}</seg>
181 </seglistitem>
182 </segmentedlist>
183
184 <variablelist>
185 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
186 <?dbfo list-presentation="list"?>
187 <?dbhtml list-presentation="table"?>
188
189 <varlistentry id="chage">
190 <term><command>chage</command></term>
191 <listitem>
192 <para>Used to change the maximum number of days between obligatory
193 password changes</para>
194 <indexterm zone="ch-system-shadow chage">
195 <primary sortas="b-chage">chage</primary>
196 </indexterm>
197 </listitem>
198 </varlistentry>
199
200 <varlistentry id="chfn">
201 <term><command>chfn</command></term>
202 <listitem>
203 <para>Used to change a user's full name and other information</para>
204 <indexterm zone="ch-system-shadow chfn">
205 <primary sortas="b-chfn">chfn</primary>
206 </indexterm>
207 </listitem>
208 </varlistentry>
209
210 <varlistentry id="chgpasswd">
211 <term><command>chgpasswd</command></term>
212 <listitem>
213 <para>Used to update group passwords in batch mode</para>
214 <indexterm zone="ch-system-shadow chgpasswd">
215 <primary sortas="b-chgpasswd">chgpasswd</primary>
216 </indexterm>
217 </listitem>
218 </varlistentry>
219
220 <varlistentry id="chpasswd">
221 <term><command>chpasswd</command></term>
222 <listitem>
223 <para>Used to update user passwords in batch mode</para>
224 <indexterm zone="ch-system-shadow chpasswd">
225 <primary sortas="b-chpasswd">chpasswd</primary>
226 </indexterm>
227 </listitem>
228 </varlistentry>
229
230 <varlistentry id="chsh">
231 <term><command>chsh</command></term>
232 <listitem>
233 <para>Used to change a user's default login shell</para>
234 <indexterm zone="ch-system-shadow chsh">
235 <primary sortas="b-chsh">chsh</primary>
236 </indexterm>
237 </listitem>
238 </varlistentry>
239
240 <varlistentry id="expiry">
241 <term><command>expiry</command></term>
242 <listitem>
243 <para>Checks and enforces the current password expiration policy</para>
244 <indexterm zone="ch-system-shadow expiry">
245 <primary sortas="b-expiry">expiry</primary>
246 </indexterm>
247 </listitem>
248 </varlistentry>
249
250 <varlistentry id="faillog">
251 <term><command>faillog</command></term>
252 <listitem>
253 <para>Is used to examine the log of login failures, to set a maximum
254 number of failures before an account is blocked, or to reset the
255 failure count</para>
256 <indexterm zone="ch-system-shadow faillog">
257 <primary sortas="b-faillog">faillog</primary>
258 </indexterm>
259 </listitem>
260 </varlistentry>
261
262 <varlistentry id="gpasswd">
263 <term><command>gpasswd</command></term>
264 <listitem>
265 <para>Is used to add and delete members and administrators to
266 groups</para>
267 <indexterm zone="ch-system-shadow gpasswd">
268 <primary sortas="b-gpasswd">gpasswd</primary>
269 </indexterm>
270 </listitem>
271 </varlistentry>
272
273 <varlistentry id="groupadd">
274 <term><command>groupadd</command></term>
275 <listitem>
276 <para>Creates a group with the given name</para>
277 <indexterm zone="ch-system-shadow groupadd">
278 <primary sortas="b-groupadd">groupadd</primary>
279 </indexterm>
280 </listitem>
281 </varlistentry>
282
283 <varlistentry id="groupdel">
284 <term><command>groupdel</command></term>
285 <listitem>
286 <para>Deletes the group with the given name</para>
287 <indexterm zone="ch-system-shadow groupdel">
288 <primary sortas="b-groupdel">groupdel</primary>
289 </indexterm>
290 </listitem>
291 </varlistentry>
292
293 <varlistentry id="groupmod">
294 <term><command>groupmod</command></term>
295 <listitem>
296 <para>Is used to modify the given group's name or GID</para>
297 <indexterm zone="ch-system-shadow groupmod">
298 <primary sortas="b-groupmod">groupmod</primary>
299 </indexterm>
300 </listitem>
301 </varlistentry>
302
303 <varlistentry id="grpck">
304 <term><command>grpck</command></term>
305 <listitem>
306 <para>Verifies the integrity of the group files
307 <filename>/etc/group</filename> and
308 <filename>/etc/gshadow</filename></para>
309 <indexterm zone="ch-system-shadow grpck">
310 <primary sortas="b-grpck">grpck</primary>
311 </indexterm>
312 </listitem>
313 </varlistentry>
314
315 <varlistentry id="grpconv">
316 <term><command>grpconv</command></term>
317 <listitem>
318 <para>Creates or updates the shadow group file from the normal
319 group file</para>
320 <indexterm zone="ch-system-shadow grpconv">
321 <primary sortas="b-grpconv">grpconv</primary>
322 </indexterm>
323 </listitem>
324 </varlistentry>
325
326 <varlistentry id="grpunconv">
327 <term><command>grpunconv</command></term>
328 <listitem>
329 <para>Updates <filename>/etc/group</filename> from
330 <filename>/etc/gshadow</filename> and then deletes the latter</para>
331 <indexterm zone="ch-system-shadow grpunconv">
332 <primary sortas="b-grpunconv">grpunconv</primary>
333 </indexterm>
334 </listitem>
335 </varlistentry>
336
337 <varlistentry id="lastlog">
338 <term><command>lastlog</command></term>
339 <listitem>
340 <para>Reports the most recent login of all users or of a
341 given user</para>
342 <indexterm zone="ch-system-shadow lastlog">
343 <primary sortas="b-lastlog">lastlog</primary>
344 </indexterm>
345 </listitem>
346 </varlistentry>
347
348 <varlistentry id="login">
349 <term><command>login</command></term>
350 <listitem>
351 <para>Is used by the system to let users sign on</para>
352 <indexterm zone="ch-system-shadow login">
353 <primary sortas="b-login">login</primary>
354 </indexterm>
355 </listitem>
356 </varlistentry>
357
358 <varlistentry id="logoutd">
359 <term><command>logoutd</command></term>
360 <listitem>
361 <para>Is a daemon used to enforce restrictions on log-on time
362 and ports</para>
363 <indexterm zone="ch-system-shadow logoutd">
364 <primary sortas="b-logoutd">logoutd</primary>
365 </indexterm>
366 </listitem>
367 </varlistentry>
368
369 <varlistentry id="newgrp">
370 <term><command>newgrp</command></term>
371 <listitem>
372 <para>Is used to change the current GID during a login session</para>
373 <indexterm zone="ch-system-shadow newgrp">
374 <primary sortas="b-newgrp">newgrp</primary>
375 </indexterm>
376 </listitem>
377 </varlistentry>
378
379 <varlistentry id="newusers">
380 <term><command>newusers</command></term>
381 <listitem>
382 <para>Is used to create or update an entire series of user
383 accounts</para>
384 <indexterm zone="ch-system-shadow newusers">
385 <primary sortas="b-newusers">newusers</primary>
386 </indexterm>
387 </listitem>
388 </varlistentry>
389
390 <varlistentry id="nologin">
391 <term><command>nologin</command></term>
392 <listitem>
393 <para>Displays a message that an account is not available. Designed
394 to be used as the default shell for accounts that have been
395 disabled</para>
396 <indexterm zone="ch-system-shadow nologin">
397 <primary sortas="b-nologin">nologin</primary>
398 </indexterm>
399 </listitem>
400 </varlistentry>
401
402 <varlistentry id="passwd">
403 <term><command>passwd</command></term>
404 <listitem>
405 <para>Is used to change the password for a user or group account</para>
406 <indexterm zone="ch-system-shadow passwd">
407 <primary sortas="b-passwd">passwd</primary>
408 </indexterm>
409 </listitem>
410 </varlistentry>
411
412 <varlistentry id="pwck">
413 <term><command>pwck</command></term>
414 <listitem>
415 <para>Verifies the integrity of the password files
416 <filename>/etc/passwd</filename> and
417 <filename>/etc/shadow</filename></para>
418 <indexterm zone="ch-system-shadow pwck">
419 <primary sortas="b-pwck">pwck</primary>
420 </indexterm>
421 </listitem>
422 </varlistentry>
423
424 <varlistentry id="pwconv">
425 <term><command>pwconv</command></term>
426 <listitem>
427 <para>Creates or updates the shadow password file from the normal
428 password file</para>
429 <indexterm zone="ch-system-shadow pwconv">
430 <primary sortas="b-pwconv">pwconv</primary>
431 </indexterm>
432 </listitem>
433 </varlistentry>
434
435 <varlistentry id="pwunconv">
436 <term><command>pwunconv</command></term>
437 <listitem>
438 <para>Updates <filename>/etc/passwd</filename> from
439 <filename>/etc/shadow</filename> and then deletes the latter</para>
440 <indexterm zone="ch-system-shadow pwunconv">
441 <primary sortas="b-pwunconv">pwunconv</primary>
442 </indexterm>
443 </listitem>
444 </varlistentry>
445
446 <varlistentry id="sg">
447 <term><command>sg</command></term>
448 <listitem>
449 <para>Executes a given command while the user's GID
450 is set to that of the given group</para>
451 <indexterm zone="ch-system-shadow sg">
452 <primary sortas="b-sg">sg</primary>
453 </indexterm>
454 </listitem>
455 </varlistentry>
456
457 <varlistentry id="su">
458 <term><command>su</command></term>
459 <listitem>
460 <para>Runs a shell with substitute user and group IDs</para>
461 <indexterm zone="ch-system-shadow su">
462 <primary sortas="b-su">su</primary>
463 </indexterm>
464 </listitem>
465 </varlistentry>
466
467 <varlistentry id="useradd">
468 <term><command>useradd</command></term>
469 <listitem>
470 <para>Creates a new user with the given name, or updates the default
471 new-user information</para>
472 <indexterm zone="ch-system-shadow useradd">
473 <primary sortas="b-useradd">useradd</primary>
474 </indexterm>
475 </listitem>
476 </varlistentry>
477
478 <varlistentry id="userdel">
479 <term><command>userdel</command></term>
480 <listitem>
481 <para>Deletes the given user account</para>
482 <indexterm zone="ch-system-shadow userdel">
483 <primary sortas="b-userdel">userdel</primary>
484 </indexterm>
485 </listitem>
486 </varlistentry>
487
488 <varlistentry id="usermod">
489 <term><command>usermod</command></term>
490 <listitem>
491 <para>Is used to modify the given user's login name, User
492 Identification (UID), shell, initial group, home directory, etc.</para>
493 <indexterm zone="ch-system-shadow usermod">
494 <primary sortas="b-usermod">usermod</primary>
495 </indexterm>
496 </listitem>
497 </varlistentry>
498
499 <varlistentry id="vigr">
500 <term><command>vigr</command></term>
501 <listitem>
502 <para>Edits the <filename>/etc/group</filename> or
503 <filename>/etc/gshadow</filename> files</para>
504 <indexterm zone="ch-system-shadow vigr">
505 <primary sortas="b-vigr">vigr</primary>
506 </indexterm>
507 </listitem>
508 </varlistentry>
509
510 <varlistentry id="vipw">
511 <term><command>vipw</command></term>
512 <listitem>
513 <para>Edits the <filename>/etc/passwd</filename> or
514 <filename>/etc/shadow</filename> files</para>
515 <indexterm zone="ch-system-shadow vipw">
516 <primary sortas="b-vipw">vipw</primary>
517 </indexterm>
518 </listitem>
519 </varlistentry>
520
521 <varlistentry id="libshadow">
522 <term><filename class="libraryfile">libshadow</filename></term>
523 <listitem>
524 <para>Contains functions used by most programs in this package</para>
525 <indexterm zone="ch-system-shadow libshadow">
526 <primary sortas="c-libshadow">libshadow</primary>
527 </indexterm>
528 </listitem>
529 </varlistentry>
530
531 </variablelist>
532
533 </sect2>
534
535</sect1>
Note: See TracBrowser for help on using the repository browser.