source: chapter06/shadow.xml@ ce8ddac

10.0 10.0-rc1 10.1 10.1-rc1 11.0 11.0-rc1 11.0-rc2 11.0-rc3 11.1 11.1-rc1 11.2 11.2-rc1 11.3 11.3-rc1 12.0 12.0-rc1 12.1 12.1-rc1 8.0 8.1 8.2 8.3 8.4 9.0 9.1 arm bdubbs/gcc13 ml-11.0 multilib renodr/libudev-from-systemd s6-init trunk xry111/arm64 xry111/arm64-12.0 xry111/clfs-ng xry111/lfs-next xry111/loongarch xry111/loongarch-12.0 xry111/loongarch-12.1 xry111/mips64el xry111/pip3 xry111/rust-wip-20221008 xry111/update-glibc
Last change on this file since ce8ddac was 7e131ea, checked in by Bruce Dubbs <bdubbs@…>, 7 years ago

Update to glibc-2.25.
Revert gperf to version 3.0.4.
Update to linux-4.9.8.tar.xz.
Update to check-0.11.0.
Update to shadow-4.4.
Update to e2fsprogs-1.43.4.
Update to sed-4.4.

git-svn-id: ​http://svn.linuxfromscratch.org/LFS/trunk/BOOK@11174 4aa44e1e-78dd-0310-a6d2-fbcd4c07a689
  • Property mode set to 100644
File size: 21.5 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../general.ent">
5 %general-entities;
6]>
7
8<sect1 id="ch-system-shadow" role="wrap">
9 <?dbhtml filename="shadow.html"?>
10
11 <sect1info condition="script">
12 <productname>shadow</productname>
13 <productnumber>&shadow-version;</productnumber>
14 <address>&shadow-url;</address>
15 </sect1info>
16
17 <title>Shadow-&shadow-version;</title>
18
19 <indexterm zone="ch-system-shadow">
20 <primary sortas="a-Shadow">Shadow</primary>
21 </indexterm>
22
23 <sect2 role="package">
24 <title/>
25
26 <para>The Shadow package contains programs for handling passwords in a secure
27 way.</para>
28
29 <segmentedlist>
30 <segtitle>&buildtime;</segtitle>
31 <segtitle>&diskspace;</segtitle>
32
33 <seglistitem>
34 <seg>&shadow-ch6-sbu;</seg>
35 <seg>&shadow-ch6-du;</seg>
36 </seglistitem>
37 </segmentedlist>
38
39 </sect2>
40
41 <sect2 role="installation">
42 <title>Installation of Shadow</title>
43
44 <note>
45 <para>If you would like to enforce the use of strong passwords, refer to
46 <ulink url="&blfs-book;postlfs/cracklib.html"/> for installing
47 CrackLib prior to building Shadow. Then add
48 <parameter>--with-libcrack</parameter> to the <command>configure</command>
49 command below.</para>
50 </note>
51
52 <para>Disable the installation of the <command>groups</command> program
53 and its man pages, as Coreutils provides a better version. Also
54 Prevent the installation of manual pages that were already installed by the
55 <xref linkend="man-pages"/> package:</para>
56
57<screen><userinput remap="pre">sed -i 's/groups$(EXEEXT) //' src/Makefile.in
58find man -name Makefile.in -exec sed -i 's/groups\.1 / /' {} \;
59find man -name Makefile.in -exec sed -i 's/getspnam\.3 / /' {} \;
60find man -name Makefile.in -exec sed -i 's/passwd\.5 / /' {} \;</userinput></screen>
61
62 <para id="shadow-login_defs">Instead of using the default
63 <emphasis>crypt</emphasis> method, use the more secure
64 <emphasis>SHA-512</emphasis> method of password encryption, which also
65 allows passwords longer than 8 characters. It is also necessary to change
66 the obsolete <filename class="directory">/var/spool/mail</filename> location
67 for user mailboxes that Shadow uses by default to the <filename
68 class="directory">/var/mail</filename> location used currently:</para>
69
70<screen><userinput remap="configure">sed -i -e 's@#ENCRYPT_METHOD DES@ENCRYPT_METHOD SHA512@' \
71 -e 's@/var/spool/mail@/var/mail@' etc/login.defs</userinput></screen>
72
73 <note>
74 <para>If you chose to build Shadow with Cracklib support, run the following:</para>
75
76<screen role="nodump"><userinput>sed -i 's@DICTPATH.*@DICTPATH\t/lib/cracklib/pw_dict@' etc/login.defs</userinput></screen>
77 </note>
78
79 <para>Make a minor change to make the default useradd consistent with the LFS
80 groups file:</para>
81
82<screen><userinput remap="pre">sed -i 's/1000/999/' etc/useradd</userinput></screen>
83
84 <para>Fix a security issue identified upstream:</para>
85
86<screen><userinput remap="pre">sed -i -e '47 d' -e '60,65 d' libmisc/myname.c</userinput></screen>
87
88 <para>Prepare Shadow for compilation:</para>
89
90<screen><userinput remap="configure">./configure --sysconfdir=/etc --with-group-name-max-length=32</userinput></screen>
91
92 <variablelist>
93 <title>The meaning of the configure option:</title>
94
95 <varlistentry>
96 <term><parameter>--with-group-name-max-length=32</parameter></term>
97 <listitem>
98 <para>The maximum user name is 32 characters. Make the maximum
99 group name the same.</para>
100 </listitem>
101 </varlistentry>
102
103 </variablelist>
104
105 <para>Compile the package:</para>
106
107<screen><userinput remap="make">make</userinput></screen>
108
109 <para>This package does not come with a test suite.</para>
110
111 <para>Install the package:</para>
112
113<screen><userinput remap="install">make install</userinput></screen>
114
115 <para>Move a misplaced program to its proper location:</para>
116
117<screen><userinput remap="install">mv -v /usr/bin/passwd /bin</userinput></screen>
118
119 <!-- <para>Move Shadow's libraries to more appropriate locations:</para>
120
121<screen><userinput remap="install">mv -v /lib/libshadow.*a /usr/lib
122rm -v /lib/libshadow.so
123ln -sfv ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen> -->
124
125 </sect2>
126
127 <sect2 id="conf-shadow" role="configuration">
128 <title>Configuring Shadow</title>
129
130 <indexterm zone="conf-shadow">
131 <primary sortas="a-Shadow">Shadow</primary>
132 <secondary>configuring</secondary>
133 </indexterm>
134
135 <para>This package contains utilities to add, modify, and delete users and
136 groups; set and change their passwords; and perform other administrative
137 tasks. For a full explanation of what <emphasis>password shadowing</emphasis>
138 means, see the <filename>doc/HOWTO</filename> file within the unpacked
139 source tree. If using Shadow support, keep in mind that programs which need
140 to verify passwords (display managers, FTP programs, pop3 daemons, etc.)
141 must be Shadow-compliant. That is, they need to be able to work with
142 shadowed passwords.</para>
143
144 <para>To enable shadowed passwords, run the following command:</para>
145
146<screen><userinput>pwconv</userinput></screen>
147
148 <para>To enable shadowed group passwords, run:</para>
149
150<screen><userinput>grpconv</userinput></screen>
151
152 <para>Shadow's stock configuration for the <command>useradd</command>
153 utility has a few caveats that need some explanation. First, the default
154 action for the <command>useradd</command> utility is to create the user and
155 a group of the same name as the user. By default the user ID (UID) and
156 group ID (GID) numbers will begin with 1000. This means if you don't pass
157 parameters to <command>useradd</command>, each user will be a member of a
158 unique group on the system. If this behavior is undesirable, you'll need
159 to pass the <parameter>-g</parameter> parameter to
160 <command>useradd</command>. The default parameters are stored in the
161 <filename>/etc/default/useradd</filename> file. You may need to modify two
162 parameters in this file to suit your particular needs.</para>
163
164 <variablelist>
165 <title><filename>/etc/default/useradd</filename> Parameter Explanations</title>
166
167 <varlistentry>
168 <term><parameter>GROUP=1000</parameter></term>
169 <listitem>
170 <para>This parameter sets the beginning of the group numbers used in
171 the /etc/group file. You can modify it to anything you desire. Note
172 that <command>useradd</command> will never reuse a UID or GID. If the
173 number identified in this parameter is used, it will use the next
174 available number after this. Note also that if you don't have a group
175 1000 on your system the first time you use <command>useradd</command>
176 without the <parameter>-g</parameter> parameter, you'll get a message
177 displayed on the terminal that says:
178 <computeroutput>useradd: unknown GID 1000</computeroutput>. You may
179 disregard this message and group number 1000 will be used.</para>
180 </listitem>
181 </varlistentry>
182 <varlistentry>
183 <term><parameter>CREATE_MAIL_SPOOL=yes</parameter></term>
184 <listitem>
185 <para>This parameter causes <command>useradd</command> to create a
186 mailbox file for the newly created user. <command>useradd</command>
187 will make the group ownership of this file to the
188 <systemitem class="groupname">mail</systemitem> group with 0660
189 permissions. If you would prefer that these mailbox files are not
190 created by <command>useradd</command>, issue the following
191 command:</para>
192
193<screen><userinput>sed -i 's/yes/no/' /etc/default/useradd</userinput></screen>
194 </listitem>
195 </varlistentry>
196
197 </variablelist>
198
199
200 </sect2>
201
202 <sect2 role="configuration">
203 <title>Setting the root password</title>
204
205 <para>Choose a password for user <emphasis>root</emphasis> and set it
206 by running:</para>
207
208<screen role="nodump"><userinput>passwd root</userinput></screen>
209
210 </sect2>
211
212 <sect2 id="contents-shadow" role="content">
213 <title>Contents of Shadow</title>
214
215 <segmentedlist>
216 <segtitle>Installed programs</segtitle>
217 <segtitle>Installed directory</segtitle>
218
219 <seglistitem>
220 <seg>chage, chfn, chgpasswd, chpasswd, chsh, expiry, faillog, gpasswd,
221 groupadd, groupdel, groupmems, groupmod, grpck, grpconv, grpunconv,
222 lastlog, login, logoutd, newgidmap, newgrp, newuidmap, newusers,
223 nologin, passwd, pwck, pwconv, pwunconv, sg (link to newgrp), su,
224 useradd, userdel, usermod, vigr (link to vipw), and vipw</seg>
225 <seg>/etc/default</seg>
226 </seglistitem>
227 </segmentedlist>
228
229 <variablelist>
230 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
231 <?dbfo list-presentation="list"?>
232 <?dbhtml list-presentation="table"?>
233
234 <varlistentry id="chage">
235 <term><command>chage</command></term>
236 <listitem>
237 <para>Used to change the maximum number of days between obligatory
238 password changes</para>
239 <indexterm zone="ch-system-shadow chage">
240 <primary sortas="b-chage">chage</primary>
241 </indexterm>
242 </listitem>
243 </varlistentry>
244
245 <varlistentry id="chfn">
246 <term><command>chfn</command></term>
247 <listitem>
248 <para>Used to change a user's full name and other information</para>
249 <indexterm zone="ch-system-shadow chfn">
250 <primary sortas="b-chfn">chfn</primary>
251 </indexterm>
252 </listitem>
253 </varlistentry>
254
255 <varlistentry id="chgpasswd">
256 <term><command>chgpasswd</command></term>
257 <listitem>
258 <para>Used to update group passwords in batch mode</para>
259 <indexterm zone="ch-system-shadow chgpasswd">
260 <primary sortas="b-chgpasswd">chgpasswd</primary>
261 </indexterm>
262 </listitem>
263 </varlistentry>
264
265 <varlistentry id="chpasswd">
266 <term><command>chpasswd</command></term>
267 <listitem>
268 <para>Used to update user passwords in batch mode</para>
269 <indexterm zone="ch-system-shadow chpasswd">
270 <primary sortas="b-chpasswd">chpasswd</primary>
271 </indexterm>
272 </listitem>
273 </varlistentry>
274
275 <varlistentry id="chsh">
276 <term><command>chsh</command></term>
277 <listitem>
278 <para>Used to change a user's default login shell</para>
279 <indexterm zone="ch-system-shadow chsh">
280 <primary sortas="b-chsh">chsh</primary>
281 </indexterm>
282 </listitem>
283 </varlistentry>
284
285 <varlistentry id="expiry">
286 <term><command>expiry</command></term>
287 <listitem>
288 <para>Checks and enforces the current password expiration policy</para>
289 <indexterm zone="ch-system-shadow expiry">
290 <primary sortas="b-expiry">expiry</primary>
291 </indexterm>
292 </listitem>
293 </varlistentry>
294
295 <varlistentry id="faillog">
296 <term><command>faillog</command></term>
297 <listitem>
298 <para>Is used to examine the log of login failures, to set a maximum
299 number of failures before an account is blocked, or to reset the
300 failure count</para>
301 <indexterm zone="ch-system-shadow faillog">
302 <primary sortas="b-faillog">faillog</primary>
303 </indexterm>
304 </listitem>
305 </varlistentry>
306
307 <varlistentry id="gpasswd">
308 <term><command>gpasswd</command></term>
309 <listitem>
310 <para>Is used to add and delete members and administrators to
311 groups</para>
312 <indexterm zone="ch-system-shadow gpasswd">
313 <primary sortas="b-gpasswd">gpasswd</primary>
314 </indexterm>
315 </listitem>
316 </varlistentry>
317
318 <varlistentry id="groupadd">
319 <term><command>groupadd</command></term>
320 <listitem>
321 <para>Creates a group with the given name</para>
322 <indexterm zone="ch-system-shadow groupadd">
323 <primary sortas="b-groupadd">groupadd</primary>
324 </indexterm>
325 </listitem>
326 </varlistentry>
327
328 <varlistentry id="groupdel">
329 <term><command>groupdel</command></term>
330 <listitem>
331 <para>Deletes the group with the given name</para>
332 <indexterm zone="ch-system-shadow groupdel">
333 <primary sortas="b-groupdel">groupdel</primary>
334 </indexterm>
335 </listitem>
336 </varlistentry>
337
338 <varlistentry id="groupmems">
339 <term><command>groupmems</command></term>
340 <listitem>
341 <para>Allows a user to administer his/her own group membership list
342 without the requirement of super user privileges.</para>
343 <indexterm zone="ch-system-shadow groupmems">
344 <primary sortas="b-groupmems">groupmems</primary>
345 </indexterm>
346 </listitem>
347 </varlistentry>
348
349 <varlistentry id="groupmod">
350 <term><command>groupmod</command></term>
351 <listitem>
352 <para>Is used to modify the given group's name or GID</para>
353 <indexterm zone="ch-system-shadow groupmod">
354 <primary sortas="b-groupmod">groupmod</primary>
355 </indexterm>
356 </listitem>
357 </varlistentry>
358
359 <varlistentry id="grpck">
360 <term><command>grpck</command></term>
361 <listitem>
362 <para>Verifies the integrity of the group files
363 <filename>/etc/group</filename> and
364 <filename>/etc/gshadow</filename></para>
365 <indexterm zone="ch-system-shadow grpck">
366 <primary sortas="b-grpck">grpck</primary>
367 </indexterm>
368 </listitem>
369 </varlistentry>
370
371 <varlistentry id="grpconv">
372 <term><command>grpconv</command></term>
373 <listitem>
374 <para>Creates or updates the shadow group file from the normal
375 group file</para>
376 <indexterm zone="ch-system-shadow grpconv">
377 <primary sortas="b-grpconv">grpconv</primary>
378 </indexterm>
379 </listitem>
380 </varlistentry>
381
382 <varlistentry id="grpunconv">
383 <term><command>grpunconv</command></term>
384 <listitem>
385 <para>Updates <filename>/etc/group</filename> from
386 <filename>/etc/gshadow</filename> and then deletes the latter</para>
387 <indexterm zone="ch-system-shadow grpunconv">
388 <primary sortas="b-grpunconv">grpunconv</primary>
389 </indexterm>
390 </listitem>
391 </varlistentry>
392
393 <varlistentry id="lastlog">
394 <term><command>lastlog</command></term>
395 <listitem>
396 <para>Reports the most recent login of all users or of a
397 given user</para>
398 <indexterm zone="ch-system-shadow lastlog">
399 <primary sortas="b-lastlog">lastlog</primary>
400 </indexterm>
401 </listitem>
402 </varlistentry>
403
404 <varlistentry id="login">
405 <term><command>login</command></term>
406 <listitem>
407 <para>Is used by the system to let users sign on</para>
408 <indexterm zone="ch-system-shadow login">
409 <primary sortas="b-login">login</primary>
410 </indexterm>
411 </listitem>
412 </varlistentry>
413
414 <varlistentry id="logoutd">
415 <term><command>logoutd</command></term>
416 <listitem>
417 <para>Is a daemon used to enforce restrictions on log-on time
418 and ports</para>
419 <indexterm zone="ch-system-shadow logoutd">
420 <primary sortas="b-logoutd">logoutd</primary>
421 </indexterm>
422 </listitem>
423 </varlistentry>
424
425 <varlistentry id="newgidmap">
426 <term><command>newgidmap</command></term>
427 <listitem>
428 <para>Is used to set the gid mapping of a user namespace</para>
429 <indexterm zone="ch-system-shadow newgidmap">
430 <primary sortas="b-newgidmap">newgidmap</primary>
431 </indexterm>
432 </listitem>
433 </varlistentry>
434
435 <varlistentry id="newgrp">
436 <term><command>newgrp</command></term>
437 <listitem>
438 <para>Is used to change the current GID during a login session</para>
439 <indexterm zone="ch-system-shadow newgrp">
440 <primary sortas="b-newgrp">newgrp</primary>
441 </indexterm>
442 </listitem>
443 </varlistentry>
444
445 <varlistentry id="newuidmap">
446 <term><command>newuidmap</command></term>
447 <listitem>
448 <para>Is used to set the uid mapping of a user namespace</para>
449 <indexterm zone="ch-system-shadow newuidmap">
450 <primary sortas="b-newuidmap">newuidmap</primary>
451 </indexterm>
452 </listitem>
453 </varlistentry>
454
455 <varlistentry id="newusers">
456 <term><command>newusers</command></term>
457 <listitem>
458 <para>Is used to create or update an entire series of user
459 accounts</para>
460 <indexterm zone="ch-system-shadow newusers">
461 <primary sortas="b-newusers">newusers</primary>
462 </indexterm>
463 </listitem>
464 </varlistentry>
465
466 <varlistentry id="nologin">
467 <term><command>nologin</command></term>
468 <listitem>
469 <para>Displays a message that an account is not available; it is designed
470 to be used as the default shell for accounts that have been
471 disabled</para>
472 <indexterm zone="ch-system-shadow nologin">
473 <primary sortas="b-nologin">nologin</primary>
474 </indexterm>
475 </listitem>
476 </varlistentry>
477
478 <varlistentry id="passwd">
479 <term><command>passwd</command></term>
480 <listitem>
481 <para>Is used to change the password for a user or group account</para>
482 <indexterm zone="ch-system-shadow passwd">
483 <primary sortas="b-passwd">passwd</primary>
484 </indexterm>
485 </listitem>
486 </varlistentry>
487
488 <varlistentry id="pwck">
489 <term><command>pwck</command></term>
490 <listitem>
491 <para>Verifies the integrity of the password files
492 <filename>/etc/passwd</filename> and
493 <filename>/etc/shadow</filename></para>
494 <indexterm zone="ch-system-shadow pwck">
495 <primary sortas="b-pwck">pwck</primary>
496 </indexterm>
497 </listitem>
498 </varlistentry>
499
500 <varlistentry id="pwconv">
501 <term><command>pwconv</command></term>
502 <listitem>
503 <para>Creates or updates the shadow password file from the normal
504 password file</para>
505 <indexterm zone="ch-system-shadow pwconv">
506 <primary sortas="b-pwconv">pwconv</primary>
507 </indexterm>
508 </listitem>
509 </varlistentry>
510
511 <varlistentry id="pwunconv">
512 <term><command>pwunconv</command></term>
513 <listitem>
514 <para>Updates <filename>/etc/passwd</filename> from
515 <filename>/etc/shadow</filename> and then deletes the latter</para>
516 <indexterm zone="ch-system-shadow pwunconv">
517 <primary sortas="b-pwunconv">pwunconv</primary>
518 </indexterm>
519 </listitem>
520 </varlistentry>
521
522 <varlistentry id="sg">
523 <term><command>sg</command></term>
524 <listitem>
525 <para>Executes a given command while the user's GID
526 is set to that of the given group</para>
527 <indexterm zone="ch-system-shadow sg">
528 <primary sortas="b-sg">sg</primary>
529 </indexterm>
530 </listitem>
531 </varlistentry>
532
533 <varlistentry id="su">
534 <term><command>su</command></term>
535 <listitem>
536 <para>Runs a shell with substitute user and group IDs</para>
537 <indexterm zone="ch-system-shadow su">
538 <primary sortas="b-su">su</primary>
539 </indexterm>
540 </listitem>
541 </varlistentry>
542
543 <varlistentry id="useradd">
544 <term><command>useradd</command></term>
545 <listitem>
546 <para>Creates a new user with the given name, or updates the default
547 new-user information</para>
548 <indexterm zone="ch-system-shadow useradd">
549 <primary sortas="b-useradd">useradd</primary>
550 </indexterm>
551 </listitem>
552 </varlistentry>
553
554 <varlistentry id="userdel">
555 <term><command>userdel</command></term>
556 <listitem>
557 <para>Deletes the given user account</para>
558 <indexterm zone="ch-system-shadow userdel">
559 <primary sortas="b-userdel">userdel</primary>
560 </indexterm>
561 </listitem>
562 </varlistentry>
563
564 <varlistentry id="usermod">
565 <term><command>usermod</command></term>
566 <listitem>
567 <para>Is used to modify the given user's login name, User
568 Identification (UID), shell, initial group, home directory, etc.</para>
569 <indexterm zone="ch-system-shadow usermod">
570 <primary sortas="b-usermod">usermod</primary>
571 </indexterm>
572 </listitem>
573 </varlistentry>
574
575 <varlistentry id="vigr">
576 <term><command>vigr</command></term>
577 <listitem>
578 <para>Edits the <filename>/etc/group</filename> or
579 <filename>/etc/gshadow</filename> files</para>
580 <indexterm zone="ch-system-shadow vigr">
581 <primary sortas="b-vigr">vigr</primary>
582 </indexterm>
583 </listitem>
584 </varlistentry>
585
586 <varlistentry id="vipw">
587 <term><command>vipw</command></term>
588 <listitem>
589 <para>Edits the <filename>/etc/passwd</filename> or
590 <filename>/etc/shadow</filename> files</para>
591 <indexterm zone="ch-system-shadow vipw">
592 <primary sortas="b-vipw">vipw</primary>
593 </indexterm>
594 </listitem>
595 </varlistentry>
596
597 </variablelist>
598
599 </sect2>
600
601</sect1>
Note: See TracBrowser for help on using the repository browser.