source: chapter06/shadow.xml@ 86d2775

10.0 10.0-rc1 10.1 10.1-rc1 11.0 11.0-rc1 11.0-rc2 11.0-rc3 11.1 11.1-rc1 11.2 11.2-rc1 11.3 11.3-rc1 12.0 12.0-rc1 12.1 12.1-rc1 6.3 6.4 6.5 6.6 6.7 6.8 7.0 7.1 7.2 7.3 7.4 7.5 7.5-systemd 7.6 7.6-systemd 7.7 7.7-systemd 7.8 7.8-systemd 7.9 7.9-systemd 8.0 8.1 8.2 8.3 8.4 9.0 9.1 arm bdubbs/gcc13 ml-11.0 multilib renodr/libudev-from-systemd s6-init trunk xry111/arm64 xry111/arm64-12.0 xry111/clfs-ng xry111/lfs-next xry111/loongarch xry111/loongarch-12.0 xry111/loongarch-12.1 xry111/mips64el xry111/pip3 xry111/rust-wip-20221008 xry111/update-glibc
Last change on this file since 86d2775 was ddd5542, checked in by Manuel Canales Esparcia <manuel@…>, 18 years ago

Finished the XML indentation plus few tags changes.

git-svn-id: ​http://svn.linuxfromscratch.org/LFS/trunk/BOOK@7369 4aa44e1e-78dd-0310-a6d2-fbcd4c07a689
  • Property mode set to 100644
File size: 18.5 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../general.ent">
5 %general-entities;
6]>
7
8<sect1 id="ch-system-shadow" role="wrap">
9 <?dbhtml filename="shadow.html"?>
10
11 <title>Shadow-&shadow-version;</title>
12
13 <indexterm zone="ch-system-shadow">
14 <primary sortas="a-Shadow">Shadow</primary>
15 </indexterm>
16
17 <sect2 role="package">
18 <title/>
19
20 <para>The Shadow package contains programs for handling passwords in a secure
21 way.</para>
22
23 <segmentedlist>
24 <segtitle>&buildtime;</segtitle>
25 <segtitle>&diskspace;</segtitle>
26
27 <seglistitem>
28 <seg>0.4 SBU</seg>
29 <seg>14.7 MB</seg>
30 </seglistitem>
31 </segmentedlist>
32
33 <segmentedlist>
34 <segtitle>&dependencies;</segtitle>
35
36 <seglistitem>
37 <seg>Bash, Binutils, Bison, Coreutils, Diffutils, GCC, Gettext,
38 Glibc, Grep, Make, and Sed</seg>
39 </seglistitem>
40 </segmentedlist>
41
42 </sect2>
43
44 <sect2 role="installation">
45 <title>Installation of Shadow</title>
46
47 <note>
48 <para>If you would like to enforce the use of strong passwords, refer to
49 <ulink url="&blfs-root;view/svn/postlfs/cracklib.html"/> for installing
50 Cracklib prior to building Shadow. Then add
51 <parameter>--with-libcrack</parameter> to the <command>configure</command>
52 command below.</para>
53 </note>
54
55 <para>Prepare Shadow for compilation:</para>
56
57<screen><userinput>./configure --libdir=/lib --enable-shared --without-selinux</userinput></screen>
58
59 <variablelist>
60 <title>The meaning of the configure options:</title>
61
62 <varlistentry>
63 <term><parameter>--without-selinux</parameter></term>
64 <listitem>
65 <para>Support for selinux is enabled by default, but selinux is not
66 built in a base LFS system. The <command>configure</command> script
67 will fail if this option is not used.</para>
68 </listitem>
69 </varlistentry>
70
71 </variablelist>
72
73 <para>Disable the installation of the <command>groups</command> program
74 and its man page, as Coreutils provides a better version:</para>
75
76<screen><userinput>sed -i 's/groups$(EXEEXT) //' src/Makefile
77find man -name Makefile -exec sed -i '/groups/d' {} \;</userinput></screen>
78
79 <para>Disable the installation of Chinese and Korean manual pages, since
80 Man-DB cannot format them properly:</para>
81
82<screen><userinput>sed -i -e 's/ ko//' -e 's/ zh_CN zh_TW//' man/Makefile</userinput></screen>
83
84 <para>Compile the package:</para>
85
86<screen><userinput>make</userinput></screen>
87
88 <para>This package does not come with a test suite.</para>
89
90 <para>Install the package:</para>
91
92<screen><userinput>make install</userinput></screen>
93
94 <para id="shadow-limits-login_access">Shadow uses two files to configure
95 authentication settings for the system. Install these two configuration
96 files:</para>
97
98 <indexterm zone="shadow-limits-login_access">
99 <primary sortas="e-/etc/limits">/etc/limits</primary>
100 </indexterm>
101
102 <indexterm zone="shadow-limits-login_access">
103 <primary sortas="e-/etc/login.access">/etc/login.access</primary>
104 </indexterm>
105
106<screen><userinput>cp -v etc/{limits,login.access} /etc</userinput></screen>
107
108 <para id="shadow-login_defs">Instead of using the default
109 <emphasis>crypt</emphasis> method, use the more secure
110 <emphasis>MD5</emphasis> method of password encryption, which also allows
111 passwords longer than 8 characters. It is also necessary to change the
112 obsolete <filename class="directory">/var/spool/mail</filename> location
113 for user mailboxes that Shadow uses by default to the <filename
114 class="directory">/var/mail</filename> location used currently. Both of
115 these can be accomplished by changing the relevant configuration file
116 while copying it to its destination:</para>
117
118 <indexterm zone="shadow-login_defs">
119 <primary sortas="e-/etc/login.defs">/etc/login.defs</primary>
120 </indexterm>
121
122 <note>
123 <para>If you built Shadow with Cracklib support, insert the following into
124 the <command>sed</command> given below:</para>
125
126<screen><literal>-e 's@DICTPATH.*@DICTPATH\t/lib/cracklib/pw_dict@'</literal></screen>
127 </note>
128
129<screen><userinput>sed -e's@#MD5_CRYPT_ENAB.no@MD5_CRYPT_ENAB yes@' \
130 -e 's@/var/spool/mail@/var/mail@' \
131 etc/login.defs &gt; /etc/login.defs</userinput></screen>
132
133 <para>Move a misplaced program to its proper location:</para>
134
135<screen><userinput>mv -v /usr/bin/passwd /bin</userinput></screen>
136
137 <para>Move Shadow's libraries to more appropriate locations:</para>
138
139<screen><userinput>mv -v /lib/libshadow.*a /usr/lib
140rm -v /lib/libshadow.so
141ln -sfv ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
142
143 <para>The <parameter>-D</parameter> option of the
144 <command>useradd</command> program requires the <filename
145 class="directory">/etc/default</filename> directory for it to work
146 properly:</para>
147
148<screen><userinput>mkdir -v /etc/default</userinput></screen>
149
150 </sect2>
151
152 <sect2 id="conf-shadow" role="configuration">
153 <title>Configuring Shadow</title>
154
155 <indexterm zone="conf-shadow">
156 <primary sortas="a-Shadow">Shadow</primary>
157 <secondary>configuring</secondary>
158 </indexterm>
159
160 <para>This package contains utilities to add, modify, and delete users and
161 groups; set and change their passwords; and perform other administrative
162 tasks. For a full explanation of what <emphasis>password shadowing</emphasis>
163 means, see the <filename>doc/HOWTO</filename> file within the unpacked
164 source tree. If using Shadow support, keep in mind that programs which need
165 to verify passwords (display managers, FTP programs, pop3 daemons, etc.)
166 must be Shadow-compliant. That is, they need to be able to work with
167 shadowed passwords.</para>
168
169 <para>To enable shadowed passwords, run the following command:</para>
170
171<screen><userinput>pwconv</userinput></screen>
172
173 <para>To enable shadowed group passwords, run:</para>
174
175<screen><userinput>grpconv</userinput></screen>
176
177 <para>Under normal circumstances, passwords will not have been created
178 yet. However, if returning to this section later to enable shadowing,
179 reset any current user passwords with the <command>passwd</command>
180 command or any group passwords with the <command>gpasswd</command>
181 command.</para>
182
183 </sect2>
184
185 <sect2 role="configuration">
186 <title>Setting the root password</title>
187
188 <para>Choose a password for user <emphasis>root</emphasis> and set it
189 by running:</para>
190
191<screen role="nodump"><userinput>passwd root</userinput></screen>
192
193 </sect2>
194
195 <sect2 id="contents-shadow" role="content">
196 <title>Contents of Shadow</title>
197
198 <segmentedlist>
199 <segtitle>Installed programs</segtitle>
200 <segtitle>Installed libraries</segtitle>
201
202 <seglistitem>
203 <seg>chage, chfn, chpasswd, chsh, expiry, faillog, gpasswd, groupadd,
204 groupdel, groupmod, grpck, grpconv, grpunconv, lastlog, login, logoutd,
205 newgrp, newusers, passwd, pwck, pwconv, pwunconv, sg (link to newgrp),
206 su, useradd, userdel, usermod, vigr (link to vipw), and vipw</seg>
207 <seg>libshadow.[a,so]</seg>
208 </seglistitem>
209 </segmentedlist>
210
211 <variablelist>
212 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
213 <?dbfo list-presentation="list"?>
214 <?dbhtml list-presentation="table"?>
215
216 <varlistentry id="chage">
217 <term><command>chage</command></term>
218 <listitem>
219 <para>Used to change the maximum number of days between obligatory
220 password changes</para>
221 <indexterm zone="ch-system-shadow chage">
222 <primary sortas="b-chage">chage</primary>
223 </indexterm>
224 </listitem>
225 </varlistentry>
226
227 <varlistentry id="chfn">
228 <term><command>chfn</command></term>
229 <listitem>
230 <para>Used to change a user's full name and other information</para>
231 <indexterm zone="ch-system-shadow chfn">
232 <primary sortas="b-chfn">chfn</primary>
233 </indexterm>
234 </listitem>
235 </varlistentry>
236
237 <varlistentry id="chpasswd">
238 <term><command>chpasswd</command></term>
239 <listitem>
240 <para>Used to update the passwords of an entire series of user
241 accounts</para>
242 <indexterm zone="ch-system-shadow chpasswd">
243 <primary sortas="b-chpasswd">chpasswd</primary>
244 </indexterm>
245 </listitem>
246 </varlistentry>
247
248 <varlistentry id="chsh">
249 <term><command>chsh</command></term>
250 <listitem>
251 <para>Used to change a user's default login shell</para>
252 <indexterm zone="ch-system-shadow chsh">
253 <primary sortas="b-chsh">chsh</primary>
254 </indexterm>
255 </listitem>
256 </varlistentry>
257
258 <varlistentry id="expiry">
259 <term><command>expiry</command></term>
260 <listitem>
261 <para>Checks and enforces the current password expiration policy</para>
262 <indexterm zone="ch-system-shadow expiry">
263 <primary sortas="b-expiry">expiry</primary>
264 </indexterm>
265 </listitem>
266 </varlistentry>
267
268 <varlistentry id="faillog">
269 <term><command>faillog</command></term>
270 <listitem>
271 <para>Is used to examine the log of login failures, to set a maximum
272 number of failures before an account is blocked, or to reset the
273 failure count</para>
274 <indexterm zone="ch-system-shadow faillog">
275 <primary sortas="b-faillog">faillog</primary>
276 </indexterm>
277 </listitem>
278 </varlistentry>
279
280 <varlistentry id="gpasswd">
281 <term><command>gpasswd</command></term>
282 <listitem>
283 <para>Is used to add and delete members and administrators to
284 groups</para>
285 <indexterm zone="ch-system-shadow gpasswd">
286 <primary sortas="b-gpasswd">gpasswd</primary>
287 </indexterm>
288 </listitem>
289 </varlistentry>
290
291 <varlistentry id="groupadd">
292 <term><command>groupadd</command></term>
293 <listitem>
294 <para>Creates a group with the given name</para>
295 <indexterm zone="ch-system-shadow groupadd">
296 <primary sortas="b-groupadd">groupadd</primary>
297 </indexterm>
298 </listitem>
299 </varlistentry>
300
301 <varlistentry id="groupdel">
302 <term><command>groupdel</command></term>
303 <listitem>
304 <para>Deletes the group with the given name</para>
305 <indexterm zone="ch-system-shadow groupdel">
306 <primary sortas="b-groupdel">groupdel</primary>
307 </indexterm>
308 </listitem>
309 </varlistentry>
310
311 <varlistentry id="groupmod">
312 <term><command>groupmod</command></term>
313 <listitem>
314 <para>Is used to modify the given group's name or GID</para>
315 <indexterm zone="ch-system-shadow groupmod">
316 <primary sortas="b-groupmod">groupmod</primary>
317 </indexterm>
318 </listitem>
319 </varlistentry>
320
321 <varlistentry id="grpck">
322 <term><command>grpck</command></term>
323 <listitem>
324 <para>Verifies the integrity of the group files
325 <filename>/etc/group</filename> and
326 <filename>/etc/gshadow</filename></para>
327 <indexterm zone="ch-system-shadow grpck">
328 <primary sortas="b-grpck">grpck</primary>
329 </indexterm>
330 </listitem>
331 </varlistentry>
332
333 <varlistentry id="grpconv">
334 <term><command>grpconv</command></term>
335 <listitem>
336 <para>Creates or updates the shadow group file from the normal
337 group file</para>
338 <indexterm zone="ch-system-shadow grpconv">
339 <primary sortas="b-grpconv">grpconv</primary>
340 </indexterm>
341 </listitem>
342 </varlistentry>
343
344 <varlistentry id="grpunconv">
345 <term><command>grpunconv</command></term>
346 <listitem>
347 <para>Updates <filename>/etc/group</filename> from
348 <filename>/etc/gshadow</filename> and then deletes the latter</para>
349 <indexterm zone="ch-system-shadow grpunconv">
350 <primary sortas="b-grpunconv">grpunconv</primary>
351 </indexterm>
352 </listitem>
353 </varlistentry>
354
355 <varlistentry id="lastlog">
356 <term><command>lastlog</command></term>
357 <listitem>
358 <para>Reports the most recent login of all users or of a
359 given user</para>
360 <indexterm zone="ch-system-shadow lastlog">
361 <primary sortas="b-lastlog">lastlog</primary>
362 </indexterm>
363 </listitem>
364 </varlistentry>
365
366 <varlistentry id="login">
367 <term><command>login</command></term>
368 <listitem>
369 <para>Is used by the system to let users sign on</para>
370 <indexterm zone="ch-system-shadow login">
371 <primary sortas="b-login">login</primary>
372 </indexterm>
373 </listitem>
374 </varlistentry>
375
376 <varlistentry id="logoutd">
377 <term><command>logoutd</command></term>
378 <listitem>
379 <para>Is a daemon used to enforce restrictions on log-on time
380 and ports</para>
381 <indexterm zone="ch-system-shadow logoutd">
382 <primary sortas="b-logoutd">logoutd</primary>
383 </indexterm>
384 </listitem>
385 </varlistentry>
386
387 <varlistentry id="newgrp">
388 <term><command>newgrp</command></term>
389 <listitem>
390 <para>Is used to change the current GID during a login session</para>
391 <indexterm zone="ch-system-shadow newgrp">
392 <primary sortas="b-newgrp">newgrp</primary>
393 </indexterm>
394 </listitem>
395 </varlistentry>
396
397 <varlistentry id="newusers">
398 <term><command>newusers</command></term>
399 <listitem>
400 <para>Is used to create or update an entire series of user
401 accounts</para>
402 <indexterm zone="ch-system-shadow newusers">
403 <primary sortas="b-newusers">newusers</primary>
404 </indexterm>
405 </listitem>
406 </varlistentry>
407
408 <varlistentry id="passwd">
409 <term><command>passwd</command></term>
410 <listitem>
411 <para>Is used to change the password for a user or group account</para>
412 <indexterm zone="ch-system-shadow passwd">
413 <primary sortas="b-passwd">passwd</primary>
414 </indexterm>
415 </listitem>
416 </varlistentry>
417
418 <varlistentry id="pwck">
419 <term><command>pwck</command></term>
420 <listitem>
421 <para>Verifies the integrity of the password files
422 <filename>/etc/passwd</filename> and
423 <filename>/etc/shadow</filename></para>
424 <indexterm zone="ch-system-shadow pwck">
425 <primary sortas="b-pwck">pwck</primary>
426 </indexterm>
427 </listitem>
428 </varlistentry>
429
430 <varlistentry id="pwconv">
431 <term><command>pwconv</command></term>
432 <listitem>
433 <para>Creates or updates the shadow password file from the normal
434 password file</para>
435 <indexterm zone="ch-system-shadow pwconv">
436 <primary sortas="b-pwconv">pwconv</primary>
437 </indexterm>
438 </listitem>
439 </varlistentry>
440
441 <varlistentry id="pwunconv">
442 <term><command>pwunconv</command></term>
443 <listitem>
444 <para>Updates <filename>/etc/passwd</filename> from
445 <filename>/etc/shadow</filename> and then deletes the latter</para>
446 <indexterm zone="ch-system-shadow pwunconv">
447 <primary sortas="b-pwunconv">pwunconv</primary>
448 </indexterm>
449 </listitem>
450 </varlistentry>
451
452 <varlistentry id="sg">
453 <term><command>sg</command></term>
454 <listitem>
455 <para>Executes a given command while the user's GID
456 is set to that of the given group</para>
457 <indexterm zone="ch-system-shadow sg">
458 <primary sortas="b-sg">sg</primary>
459 </indexterm>
460 </listitem>
461 </varlistentry>
462
463 <varlistentry id="su">
464 <term><command>su</command></term>
465 <listitem>
466 <para>Runs a shell with substitute user and group IDs</para>
467 <indexterm zone="ch-system-shadow su">
468 <primary sortas="b-su">su</primary>
469 </indexterm>
470 </listitem>
471 </varlistentry>
472
473 <varlistentry id="useradd">
474 <term><command>useradd</command></term>
475 <listitem>
476 <para>Creates a new user with the given name, or updates the default
477 new-user information</para>
478 <indexterm zone="ch-system-shadow useradd">
479 <primary sortas="b-useradd">useradd</primary>
480 </indexterm>
481 </listitem>
482 </varlistentry>
483
484 <varlistentry id="userdel">
485 <term><command>userdel</command></term>
486 <listitem>
487 <para>Deletes the given user account</para>
488 <indexterm zone="ch-system-shadow userdel">
489 <primary sortas="b-userdel">userdel</primary>
490 </indexterm>
491 </listitem>
492 </varlistentry>
493
494 <varlistentry id="usermod">
495 <term><command>usermod</command></term>
496 <listitem>
497 <para>Is used to modify the given user's login name, User
498 Identification (UID), shell, initial group, home directory, etc.</para>
499 <indexterm zone="ch-system-shadow usermod">
500 <primary sortas="b-usermod">usermod</primary>
501 </indexterm>
502 </listitem>
503 </varlistentry>
504
505 <varlistentry id="vigr">
506 <term><command>vigr</command></term>
507 <listitem>
508 <para>Edits the <filename>/etc/group</filename> or
509 <filename>/etc/gshadow</filename> files</para>
510 <indexterm zone="ch-system-shadow vigr">
511 <primary sortas="b-vigr">vigr</primary>
512 </indexterm>
513 </listitem>
514 </varlistentry>
515
516 <varlistentry id="vipw">
517 <term><command>vipw</command></term>
518 <listitem>
519 <para>Edits the <filename>/etc/passwd</filename> or
520 <filename>/etc/shadow</filename> files</para>
521 <indexterm zone="ch-system-shadow vipw">
522 <primary sortas="b-vipw">vipw</primary>
523 </indexterm>
524 </listitem>
525 </varlistentry>
526
527 <varlistentry id="libshadow">
528 <term><filename class="libraryfile">libshadow</filename></term>
529 <listitem>
530 <para>Contains functions used by most programs in this package</para>
531 <indexterm zone="ch-system-shadow libshadow">
532 <primary sortas="c-libshadow">libshadow</primary>
533 </indexterm>
534 </listitem>
535 </varlistentry>
536
537 </variablelist>
538
539 </sect2>
540
541</sect1>
Note: See TracBrowser for help on using the repository browser.