source: chapter06/shadow.xml@ edbeeb5

10.0 10.0-rc1 10.1 10.1-rc1 11.0 11.0-rc1 11.0-rc2 11.0-rc3 7.10 7.10-rc1 7.9 7.9-rc1 7.9-rc2 8.0 8.0-rc1 8.1 8.1-rc1 8.1-rc2 8.2 8.2-rc1 8.3 8.3-rc1 8.3-rc2 8.4 8.4-rc1 9.0 9.0-rc1 9.1 9.1-rc1 BOOK.old cross-chap5 ml-11.0 multilib nosym old-trunk trunk xry111/git-transition xry111/glibc-2.34 xry111/tester-nohack xry111/usr-move
Last change on this file since edbeeb5 was edbeeb5, checked in by Bruce Dubbs <bdubbs@…>, 6 years ago

Spelling and other typos -- from Craig Garner

git-svn-id: http://svn.linuxfromscratch.org/LFS/trunk/BOOK@10969 4aa44e1e-78dd-0310-a6d2-fbcd4c07a689

  • Property mode set to 100644
File size: 21.1 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../general.ent">
5 %general-entities;
6]>
7
8<sect1 id="ch-system-shadow" role="wrap">
9 <?dbhtml filename="shadow.html"?>
10
11 <sect1info condition="script">
12 <productname>shadow</productname>
13 <productnumber>&shadow-version;</productnumber>
14 <address>&shadow-url;</address>
15 </sect1info>
16
17 <title>Shadow-&shadow-version;</title>
18
19 <indexterm zone="ch-system-shadow">
20 <primary sortas="a-Shadow">Shadow</primary>
21 </indexterm>
22
23 <sect2 role="package">
24 <title/>
25
26 <para>The Shadow package contains programs for handling passwords in a secure
27 way.</para>
28
29 <segmentedlist>
30 <segtitle>&buildtime;</segtitle>
31 <segtitle>&diskspace;</segtitle>
32
33 <seglistitem>
34 <seg>&shadow-ch6-sbu;</seg>
35 <seg>&shadow-ch6-du;</seg>
36 </seglistitem>
37 </segmentedlist>
38
39 </sect2>
40
41 <sect2 role="installation">
42 <title>Installation of Shadow</title>
43
44 <note>
45 <para>If you would like to enforce the use of strong passwords, refer to
46 <ulink url="&blfs-book;postlfs/cracklib.html"/> for installing
47 CrackLib prior to building Shadow. Then add
48 <parameter>--with-libcrack</parameter> to the <command>configure</command>
49 command below.</para>
50 </note>
51
52 <para>Disable the installation of the <command>groups</command> program
53 and its man pages, as Coreutils provides a better version:</para>
54
55<screen><userinput remap="pre">sed -i 's/groups$(EXEEXT) //' src/Makefile.in
56find man -name Makefile.in -exec sed -i 's/groups\.1 / /' {} \;</userinput></screen>
57
58 <para id="shadow-login_defs">Instead of using the default
59 <emphasis>crypt</emphasis> method, use the more secure
60 <emphasis>SHA-512</emphasis> method of password encryption, which also
61 allows passwords longer than 8 characters. It is also necessary to change
62 the obsolete <filename class="directory">/var/spool/mail</filename> location
63 for user mailboxes that Shadow uses by default to the <filename
64 class="directory">/var/mail</filename> location used currently:</para>
65
66<screen><userinput remap="configure">sed -i -e 's@#ENCRYPT_METHOD DES@ENCRYPT_METHOD SHA512@' \
67 -e 's@/var/spool/mail@/var/mail@' etc/login.defs</userinput></screen>
68
69 <note>
70 <para>If you chose to build Shadow with Cracklib support, run the following:</para>
71
72<screen role="nodump"><userinput>sed -i 's@DICTPATH.*@DICTPATH\t/lib/cracklib/pw_dict@' etc/login.defs</userinput></screen>
73 </note>
74
75 <para>Make a minor change to make the default useradd consistent with the LFS
76 groups file:</para>
77
78<screen><userinput remap="pre">sed -i 's/1000/999/' etc/useradd</userinput></screen>
79
80 <para>Prepare Shadow for compilation:</para>
81
82<screen><userinput remap="configure">./configure --sysconfdir=/etc --with-group-name-max-length=32</userinput></screen>
83
84 <variablelist>
85 <title>The meaning of the configure option:</title>
86
87 <varlistentry>
88 <term><parameter>--with-group-name-max-length=32</parameter></term>
89 <listitem>
90 <para>The maximum user name is 32 characters. Make the maximum
91 group name the same.</para>
92 </listitem>
93 </varlistentry>
94
95 </variablelist>
96
97 <para>Compile the package:</para>
98
99<screen><userinput remap="make">make</userinput></screen>
100
101 <para>This package does not come with a test suite.</para>
102
103 <para>Install the package:</para>
104
105<screen><userinput remap="install">make install</userinput></screen>
106
107 <para>Move a misplaced program to its proper location:</para>
108
109<screen><userinput remap="install">mv -v /usr/bin/passwd /bin</userinput></screen>
110
111 <!-- <para>Move Shadow's libraries to more appropriate locations:</para>
112
113<screen><userinput remap="install">mv -v /lib/libshadow.*a /usr/lib
114rm -v /lib/libshadow.so
115ln -sfv ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen> -->
116
117 </sect2>
118
119 <sect2 id="conf-shadow" role="configuration">
120 <title>Configuring Shadow</title>
121
122 <indexterm zone="conf-shadow">
123 <primary sortas="a-Shadow">Shadow</primary>
124 <secondary>configuring</secondary>
125 </indexterm>
126
127 <para>This package contains utilities to add, modify, and delete users and
128 groups; set and change their passwords; and perform other administrative
129 tasks. For a full explanation of what <emphasis>password shadowing</emphasis>
130 means, see the <filename>doc/HOWTO</filename> file within the unpacked
131 source tree. If using Shadow support, keep in mind that programs which need
132 to verify passwords (display managers, FTP programs, pop3 daemons, etc.)
133 must be Shadow-compliant. That is, they need to be able to work with
134 shadowed passwords.</para>
135
136 <para>To enable shadowed passwords, run the following command:</para>
137
138<screen><userinput>pwconv</userinput></screen>
139
140 <para>To enable shadowed group passwords, run:</para>
141
142<screen><userinput>grpconv</userinput></screen>
143
144 <para>Shadow's stock configuration for the <command>useradd</command>
145 utility has a few caveats that need some explanation. First, the default
146 action for the <command>useradd</command> utility is to create the user and
147 a group of the same name as the user. By default the user ID (UID) and
148 group ID (GID) numbers will begin with 1000. This means if you don't pass
149 parameters to <command>useradd</command>, each user will be a member of a
150 unique group on the system. If this behavior is undesirable, you'll need
151 to pass the <parameter>-g</parameter> parameter to
152 <command>useradd</command>. The default parameters are stored in the
153 <filename>/etc/default/useradd</filename> file. You may need to modify two
154 parameters in this file to suit your particular needs.</para>
155
156 <variablelist>
157 <title><filename>/etc/default/useradd</filename> Parameter Explanations</title>
158
159 <varlistentry>
160 <term><parameter>GROUP=1000</parameter></term>
161 <listitem>
162 <para>This parameter sets the beginning of the group numbers used in
163 the /etc/group file. You can modify it to anything you desire. Note
164 that <command>useradd</command> will never reuse a UID or GID. If the
165 number identified in this parameter is used, it will use the next
166 available number after this. Note also that if you don't have a group
167 1000 on your system the first time you use <command>useradd</command>
168 without the <parameter>-g</parameter> parameter, you'll get a message
169 displayed on the terminal that says:
170 <computeroutput>useradd: unknown GID 1000</computeroutput>. You may
171 disregard this message and group number 1000 will be used.</para>
172 </listitem>
173 </varlistentry>
174 <varlistentry>
175 <term><parameter>CREATE_MAIL_SPOOL=yes</parameter></term>
176 <listitem>
177 <para>This parameter causes <command>useradd</command> to create a
178 mailbox file for the newly created user. <command>useradd</command>
179 will make the group ownership of this file to the
180 <systemitem class="groupname">mail</systemitem> group with 0660
181 permissions. If you would prefer that these mailbox files are not
182 created by <command>useradd</command>, issue the following
183 command:</para>
184
185<screen><userinput>sed -i 's/yes/no/' /etc/default/useradd</userinput></screen>
186 </listitem>
187 </varlistentry>
188
189 </variablelist>
190
191
192 </sect2>
193
194 <sect2 role="configuration">
195 <title>Setting the root password</title>
196
197 <para>Choose a password for user <emphasis>root</emphasis> and set it
198 by running:</para>
199
200<screen role="nodump"><userinput>passwd root</userinput></screen>
201
202 </sect2>
203
204 <sect2 id="contents-shadow" role="content">
205 <title>Contents of Shadow</title>
206
207 <segmentedlist>
208 <segtitle>Installed programs</segtitle>
209 <segtitle>Installed directory</segtitle>
210
211 <seglistitem>
212 <seg>chage, chfn, chgpasswd, chpasswd, chsh, expiry, faillog, gpasswd,
213 groupadd, groupdel, groupmems, groupmod, grpck, grpconv, grpunconv,
214 lastlog, login, logoutd, newgidmap, newgrp, newuidmap, newusers,
215 nologin, passwd, pwck, pwconv, pwunconv, sg (link to newgrp), su,
216 useradd, userdel, usermod, vigr (link to vipw), and vipw</seg>
217 <seg>/etc/default</seg>
218 </seglistitem>
219 </segmentedlist>
220
221 <variablelist>
222 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
223 <?dbfo list-presentation="list"?>
224 <?dbhtml list-presentation="table"?>
225
226 <varlistentry id="chage">
227 <term><command>chage</command></term>
228 <listitem>
229 <para>Used to change the maximum number of days between obligatory
230 password changes</para>
231 <indexterm zone="ch-system-shadow chage">
232 <primary sortas="b-chage">chage</primary>
233 </indexterm>
234 </listitem>
235 </varlistentry>
236
237 <varlistentry id="chfn">
238 <term><command>chfn</command></term>
239 <listitem>
240 <para>Used to change a user's full name and other information</para>
241 <indexterm zone="ch-system-shadow chfn">
242 <primary sortas="b-chfn">chfn</primary>
243 </indexterm>
244 </listitem>
245 </varlistentry>
246
247 <varlistentry id="chgpasswd">
248 <term><command>chgpasswd</command></term>
249 <listitem>
250 <para>Used to update group passwords in batch mode</para>
251 <indexterm zone="ch-system-shadow chgpasswd">
252 <primary sortas="b-chgpasswd">chgpasswd</primary>
253 </indexterm>
254 </listitem>
255 </varlistentry>
256
257 <varlistentry id="chpasswd">
258 <term><command>chpasswd</command></term>
259 <listitem>
260 <para>Used to update user passwords in batch mode</para>
261 <indexterm zone="ch-system-shadow chpasswd">
262 <primary sortas="b-chpasswd">chpasswd</primary>
263 </indexterm>
264 </listitem>
265 </varlistentry>
266
267 <varlistentry id="chsh">
268 <term><command>chsh</command></term>
269 <listitem>
270 <para>Used to change a user's default login shell</para>
271 <indexterm zone="ch-system-shadow chsh">
272 <primary sortas="b-chsh">chsh</primary>
273 </indexterm>
274 </listitem>
275 </varlistentry>
276
277 <varlistentry id="expiry">
278 <term><command>expiry</command></term>
279 <listitem>
280 <para>Checks and enforces the current password expiration policy</para>
281 <indexterm zone="ch-system-shadow expiry">
282 <primary sortas="b-expiry">expiry</primary>
283 </indexterm>
284 </listitem>
285 </varlistentry>
286
287 <varlistentry id="faillog">
288 <term><command>faillog</command></term>
289 <listitem>
290 <para>Is used to examine the log of login failures, to set a maximum
291 number of failures before an account is blocked, or to reset the
292 failure count</para>
293 <indexterm zone="ch-system-shadow faillog">
294 <primary sortas="b-faillog">faillog</primary>
295 </indexterm>
296 </listitem>
297 </varlistentry>
298
299 <varlistentry id="gpasswd">
300 <term><command>gpasswd</command></term>
301 <listitem>
302 <para>Is used to add and delete members and administrators to
303 groups</para>
304 <indexterm zone="ch-system-shadow gpasswd">
305 <primary sortas="b-gpasswd">gpasswd</primary>
306 </indexterm>
307 </listitem>
308 </varlistentry>
309
310 <varlistentry id="groupadd">
311 <term><command>groupadd</command></term>
312 <listitem>
313 <para>Creates a group with the given name</para>
314 <indexterm zone="ch-system-shadow groupadd">
315 <primary sortas="b-groupadd">groupadd</primary>
316 </indexterm>
317 </listitem>
318 </varlistentry>
319
320 <varlistentry id="groupdel">
321 <term><command>groupdel</command></term>
322 <listitem>
323 <para>Deletes the group with the given name</para>
324 <indexterm zone="ch-system-shadow groupdel">
325 <primary sortas="b-groupdel">groupdel</primary>
326 </indexterm>
327 </listitem>
328 </varlistentry>
329
330 <varlistentry id="groupmems">
331 <term><command>groupmems</command></term>
332 <listitem>
333 <para>Allows a user to administer his/her own group membership list
334 without the requirement of super user privileges.</para>
335 <indexterm zone="ch-system-shadow groupmems">
336 <primary sortas="b-groupmems">groupmems</primary>
337 </indexterm>
338 </listitem>
339 </varlistentry>
340
341 <varlistentry id="groupmod">
342 <term><command>groupmod</command></term>
343 <listitem>
344 <para>Is used to modify the given group's name or GID</para>
345 <indexterm zone="ch-system-shadow groupmod">
346 <primary sortas="b-groupmod">groupmod</primary>
347 </indexterm>
348 </listitem>
349 </varlistentry>
350
351 <varlistentry id="grpck">
352 <term><command>grpck</command></term>
353 <listitem>
354 <para>Verifies the integrity of the group files
355 <filename>/etc/group</filename> and
356 <filename>/etc/gshadow</filename></para>
357 <indexterm zone="ch-system-shadow grpck">
358 <primary sortas="b-grpck">grpck</primary>
359 </indexterm>
360 </listitem>
361 </varlistentry>
362
363 <varlistentry id="grpconv">
364 <term><command>grpconv</command></term>
365 <listitem>
366 <para>Creates or updates the shadow group file from the normal
367 group file</para>
368 <indexterm zone="ch-system-shadow grpconv">
369 <primary sortas="b-grpconv">grpconv</primary>
370 </indexterm>
371 </listitem>
372 </varlistentry>
373
374 <varlistentry id="grpunconv">
375 <term><command>grpunconv</command></term>
376 <listitem>
377 <para>Updates <filename>/etc/group</filename> from
378 <filename>/etc/gshadow</filename> and then deletes the latter</para>
379 <indexterm zone="ch-system-shadow grpunconv">
380 <primary sortas="b-grpunconv">grpunconv</primary>
381 </indexterm>
382 </listitem>
383 </varlistentry>
384
385 <varlistentry id="lastlog">
386 <term><command>lastlog</command></term>
387 <listitem>
388 <para>Reports the most recent login of all users or of a
389 given user</para>
390 <indexterm zone="ch-system-shadow lastlog">
391 <primary sortas="b-lastlog">lastlog</primary>
392 </indexterm>
393 </listitem>
394 </varlistentry>
395
396 <varlistentry id="login">
397 <term><command>login</command></term>
398 <listitem>
399 <para>Is used by the system to let users sign on</para>
400 <indexterm zone="ch-system-shadow login">
401 <primary sortas="b-login">login</primary>
402 </indexterm>
403 </listitem>
404 </varlistentry>
405
406 <varlistentry id="logoutd">
407 <term><command>logoutd</command></term>
408 <listitem>
409 <para>Is a daemon used to enforce restrictions on log-on time
410 and ports</para>
411 <indexterm zone="ch-system-shadow logoutd">
412 <primary sortas="b-logoutd">logoutd</primary>
413 </indexterm>
414 </listitem>
415 </varlistentry>
416
417 <varlistentry id="newgidmap">
418 <term><command>newgidmap</command></term>
419 <listitem>
420 <para>Is used to set the gid mapping of a user namespace</para>
421 <indexterm zone="ch-system-shadow newgidmap">
422 <primary sortas="b-newgidmap">newgidmap</primary>
423 </indexterm>
424 </listitem>
425 </varlistentry>
426
427 <varlistentry id="newgrp">
428 <term><command>newgrp</command></term>
429 <listitem>
430 <para>Is used to change the current GID during a login session</para>
431 <indexterm zone="ch-system-shadow newgrp">
432 <primary sortas="b-newgrp">newgrp</primary>
433 </indexterm>
434 </listitem>
435 </varlistentry>
436
437 <varlistentry id="newuidmap">
438 <term><command>newuidmap</command></term>
439 <listitem>
440 <para>Is used to set the uid mapping of a user namespace</para>
441 <indexterm zone="ch-system-shadow newuidmap">
442 <primary sortas="b-newuidmap">newuidmap</primary>
443 </indexterm>
444 </listitem>
445 </varlistentry>
446
447 <varlistentry id="newusers">
448 <term><command>newusers</command></term>
449 <listitem>
450 <para>Is used to create or update an entire series of user
451 accounts</para>
452 <indexterm zone="ch-system-shadow newusers">
453 <primary sortas="b-newusers">newusers</primary>
454 </indexterm>
455 </listitem>
456 </varlistentry>
457
458 <varlistentry id="nologin">
459 <term><command>nologin</command></term>
460 <listitem>
461 <para>Displays a message that an account is not available; it is designed
462 to be used as the default shell for accounts that have been
463 disabled</para>
464 <indexterm zone="ch-system-shadow nologin">
465 <primary sortas="b-nologin">nologin</primary>
466 </indexterm>
467 </listitem>
468 </varlistentry>
469
470 <varlistentry id="passwd">
471 <term><command>passwd</command></term>
472 <listitem>
473 <para>Is used to change the password for a user or group account</para>
474 <indexterm zone="ch-system-shadow passwd">
475 <primary sortas="b-passwd">passwd</primary>
476 </indexterm>
477 </listitem>
478 </varlistentry>
479
480 <varlistentry id="pwck">
481 <term><command>pwck</command></term>
482 <listitem>
483 <para>Verifies the integrity of the password files
484 <filename>/etc/passwd</filename> and
485 <filename>/etc/shadow</filename></para>
486 <indexterm zone="ch-system-shadow pwck">
487 <primary sortas="b-pwck">pwck</primary>
488 </indexterm>
489 </listitem>
490 </varlistentry>
491
492 <varlistentry id="pwconv">
493 <term><command>pwconv</command></term>
494 <listitem>
495 <para>Creates or updates the shadow password file from the normal
496 password file</para>
497 <indexterm zone="ch-system-shadow pwconv">
498 <primary sortas="b-pwconv">pwconv</primary>
499 </indexterm>
500 </listitem>
501 </varlistentry>
502
503 <varlistentry id="pwunconv">
504 <term><command>pwunconv</command></term>
505 <listitem>
506 <para>Updates <filename>/etc/passwd</filename> from
507 <filename>/etc/shadow</filename> and then deletes the latter</para>
508 <indexterm zone="ch-system-shadow pwunconv">
509 <primary sortas="b-pwunconv">pwunconv</primary>
510 </indexterm>
511 </listitem>
512 </varlistentry>
513
514 <varlistentry id="sg">
515 <term><command>sg</command></term>
516 <listitem>
517 <para>Executes a given command while the user's GID
518 is set to that of the given group</para>
519 <indexterm zone="ch-system-shadow sg">
520 <primary sortas="b-sg">sg</primary>
521 </indexterm>
522 </listitem>
523 </varlistentry>
524
525 <varlistentry id="su">
526 <term><command>su</command></term>
527 <listitem>
528 <para>Runs a shell with substitute user and group IDs</para>
529 <indexterm zone="ch-system-shadow su">
530 <primary sortas="b-su">su</primary>
531 </indexterm>
532 </listitem>
533 </varlistentry>
534
535 <varlistentry id="useradd">
536 <term><command>useradd</command></term>
537 <listitem>
538 <para>Creates a new user with the given name, or updates the default
539 new-user information</para>
540 <indexterm zone="ch-system-shadow useradd">
541 <primary sortas="b-useradd">useradd</primary>
542 </indexterm>
543 </listitem>
544 </varlistentry>
545
546 <varlistentry id="userdel">
547 <term><command>userdel</command></term>
548 <listitem>
549 <para>Deletes the given user account</para>
550 <indexterm zone="ch-system-shadow userdel">
551 <primary sortas="b-userdel">userdel</primary>
552 </indexterm>
553 </listitem>
554 </varlistentry>
555
556 <varlistentry id="usermod">
557 <term><command>usermod</command></term>
558 <listitem>
559 <para>Is used to modify the given user's login name, User
560 Identification (UID), shell, initial group, home directory, etc.</para>
561 <indexterm zone="ch-system-shadow usermod">
562 <primary sortas="b-usermod">usermod</primary>
563 </indexterm>
564 </listitem>
565 </varlistentry>
566
567 <varlistentry id="vigr">
568 <term><command>vigr</command></term>
569 <listitem>
570 <para>Edits the <filename>/etc/group</filename> or
571 <filename>/etc/gshadow</filename> files</para>
572 <indexterm zone="ch-system-shadow vigr">
573 <primary sortas="b-vigr">vigr</primary>
574 </indexterm>
575 </listitem>
576 </varlistentry>
577
578 <varlistentry id="vipw">
579 <term><command>vipw</command></term>
580 <listitem>
581 <para>Edits the <filename>/etc/passwd</filename> or
582 <filename>/etc/shadow</filename> files</para>
583 <indexterm zone="ch-system-shadow vipw">
584 <primary sortas="b-vipw">vipw</primary>
585 </indexterm>
586 </listitem>
587 </varlistentry>
588
589 </variablelist>
590
591 </sect2>
592
593</sect1>
Note: See TracBrowser for help on using the repository browser.