source: chapter08/shadow.xml@ f23960a

11.0 11.0-rc1 11.0-rc2 11.0-rc3 11.1 11.1-rc1 arm ml-11.0 multilib trunk xry111/clfs-ng xry111/glibc-2.34 xry111/lfs-next xry111/tester-nohack
Last change on this file since f23960a was f23960a, checked in by Xi Ruoyao <xry111@…>, 12 months ago

shadow: adjust for merged /usr

  • Property mode set to 100644
File size: 22.0 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../general.ent">
5 %general-entities;
6]>
7
8<sect1 id="ch-system-shadow" role="wrap">
9 <?dbhtml filename="shadow.html"?>
10
11 <sect1info condition="script">
12 <productname>shadow</productname>
13 <productnumber>&shadow-version;</productnumber>
14 <address>&shadow-url;</address>
15 </sect1info>
16
17 <title>Shadow-&shadow-version;</title>
18
19 <indexterm zone="ch-system-shadow">
20 <primary sortas="a-Shadow">Shadow</primary>
21 </indexterm>
22
23 <sect2 role="package">
24 <title/>
25
26 <para>The Shadow package contains programs for handling passwords in a secure
27 way.</para>
28
29 <segmentedlist>
30 <segtitle>&buildtime;</segtitle>
31 <segtitle>&diskspace;</segtitle>
32
33 <seglistitem>
34 <seg>&shadow-fin-sbu;</seg>
35 <seg>&shadow-fin-du;</seg>
36 </seglistitem>
37 </segmentedlist>
38
39 </sect2>
40
41 <sect2 role="installation">
42 <title>Installation of Shadow</title>
43
44 <note>
45 <para>If you would like to enforce the use of strong passwords, refer to
46 <ulink url="&blfs-book;postlfs/cracklib.html"/> for installing
47 CrackLib prior to building Shadow. Then add
48 <parameter>--with-libcrack</parameter> to the <command>configure</command>
49 command below.</para>
50 </note>
51
52 <para>Disable the installation of the <command>groups</command> program
53 and its man pages, as Coreutils provides a better version. Also,
54 prevent the installation of manual pages that were already installed in
55 <xref linkend="ch-system-man-pages"/>:</para>
56
57<screen><userinput remap="pre">sed -i 's/groups$(EXEEXT) //' src/Makefile.in
58find man -name Makefile.in -exec sed -i 's/groups\.1 / /' {} \;
59find man -name Makefile.in -exec sed -i 's/getspnam\.3 / /' {} \;
60find man -name Makefile.in -exec sed -i 's/passwd\.5 / /' {} \;</userinput></screen>
61
62 <para id="shadow-login_defs">Instead of using the default
63 <emphasis>crypt</emphasis> method, use the more secure
64 <emphasis>SHA-512</emphasis> method of password encryption, which also
65 allows passwords longer than 8 characters. It is also necessary to change
66 the obsolete <filename class="directory">/var/spool/mail</filename> location
67 for user mailboxes that Shadow uses by default to the <filename
68 class="directory">/var/mail</filename> location used currently. And,
69 get rid of <filename class="directory">/bin</filename> and
70 <filename class="directory">/sbin</filename> from <envar>PATH</envar>,
71 since they are simply symlinks to their counterpart in
72 <filename class="directory">/usr</filename>.</para>
73
74 <note>
75 <para>If <filename class="directory">/bin</filename> and/or
76 <filename class="directory">/sbin</filename> are preferred to be
77 left over in <envar>PATH</envar> for some reason, modify
78 <envar>PATH</envar> in <filename>.bashrc</filename> after LFS is
79 built.</para>
80 </note>
81
82<screen><userinput remap="pre">sed -e 's:#ENCRYPT_METHOD DES:ENCRYPT_METHOD SHA512:' \
83 -e 's:/var/spool/mail:/var/mail:' \
84 -e '/PATH=/{s@/sbin:@@;s@/bin:@@}' \
85 -i etc/login.defs</userinput></screen>
86
87 <note>
88 <para>If you chose to build Shadow with Cracklib support, run the following:</para>
89
90<screen role="nodump"><userinput>sed -i 's:DICTPATH.*:DICTPATH\t/lib/cracklib/pw_dict:' etc/login.defs</userinput></screen>
91 </note>
92
93 <para>Make a minor change to make the first group number generated
94 by useradd 1000:</para>
95
96<screen><userinput remap="pre">sed -i 's/1000/999/' etc/useradd</userinput></screen>
97
98 <para>Prepare Shadow for compilation:</para>
99
100<screen><userinput remap="configure">touch /usr/bin/passwd
101./configure --sysconfdir=/etc \
102 --with-group-name-max-length=32</userinput></screen>
103
104 <variablelist>
105 <title>The meaning of the configure option:</title>
106
107 <varlistentry>
108 <term><command>touch /usr/bin/passwd</command></term>
109 <listitem>
110 <para>The file <filename>/usr/bin/passwd</filename> needs
111 to exist because its location is harcoded in some programs, and
112 the default location if it does not exist is not right.</para>
113 </listitem>
114 </varlistentry>
115 <varlistentry>
116 <term><parameter>--with-group-name-max-length=32</parameter></term>
117 <listitem>
118 <para>The maximum user name is 32 characters. Make the maximum
119 group name the same.</para>
120 </listitem>
121 </varlistentry>
122
123 </variablelist>
124
125 <para>Compile the package:</para>
126
127<screen><userinput remap="make">make</userinput></screen>
128
129 <para>This package does not come with a test suite.</para>
130
131 <para>Install the package:</para>
132
133<screen><userinput remap="install">make exec_prefix=/usr install</userinput></screen>
134
135 </sect2>
136
137 <sect2 id="conf-shadow" role="configuration">
138 <title>Configuring Shadow</title>
139
140 <indexterm zone="conf-shadow">
141 <primary sortas="a-Shadow">Shadow</primary>
142 <secondary>configuring</secondary>
143 </indexterm>
144
145 <para>This package contains utilities to add, modify, and delete users and
146 groups; set and change their passwords; and perform other administrative
147 tasks. For a full explanation of what <emphasis>password shadowing</emphasis>
148 means, see the <filename>doc/HOWTO</filename> file within the unpacked
149 source tree. If using Shadow support, keep in mind that programs which need
150 to verify passwords (display managers, FTP programs, pop3 daemons, etc.)
151 must be Shadow-compliant. That is, they need to be able to work with
152 shadowed passwords.</para>
153
154 <para>To enable shadowed passwords, run the following command:</para>
155
156<screen><userinput>pwconv</userinput></screen>
157
158 <para>To enable shadowed group passwords, run:</para>
159
160<screen><userinput>grpconv</userinput></screen>
161
162 <para>Shadow's stock configuration for the <command>useradd</command>
163 utility has a few caveats that need some explanation. First, the default
164 action for the <command>useradd</command> utility is to create the user and
165 a group of the same name as the user. By default the user ID (UID) and
166 group ID (GID) numbers will begin with 1000. This means if you don't pass
167 parameters to <command>useradd</command>, each user will be a member of a
168 unique group on the system. If this behavior is undesirable, you'll need
169 to pass the <parameter>-g</parameter> parameter to
170 <command>useradd</command>. The default parameters are stored in the
171 <filename>/etc/default/useradd</filename> file. You may need to modify two
172 parameters in this file to suit your particular needs.</para>
173
174 <variablelist>
175 <title><filename>/etc/default/useradd</filename> Parameter Explanations</title>
176
177 <varlistentry>
178 <term><parameter>GROUP=1000</parameter></term>
179 <listitem>
180 <para>This parameter sets the beginning of the group numbers used in
181 the /etc/group file. You can modify it to anything you desire. Note
182 that <command>useradd</command> will never reuse a UID or GID. If the
183 number identified in this parameter is used, it will use the next
184 available number after this. Note also that if you don't have a group
185 1000 on your system the first time you use <command>useradd</command>
186 without the <parameter>-g</parameter> parameter, you'll get a message
187 displayed on the terminal that says:
188 <computeroutput>useradd: unknown GID 1000</computeroutput>. You may
189 disregard this message and group number 1000 will be used.</para>
190 </listitem>
191 </varlistentry>
192 <varlistentry>
193 <term><parameter>CREATE_MAIL_SPOOL=yes</parameter></term>
194 <listitem>
195 <para>This parameter causes <command>useradd</command> to create a
196 mailbox file for the newly created user. <command>useradd</command>
197 will make the group ownership of this file to the
198 <systemitem class="groupname">mail</systemitem> group with 0660
199 permissions. If you would prefer that these mailbox files are not
200 created by <command>useradd</command>, issue the following
201 command:</para>
202
203<screen><userinput>sed -i 's/yes/no/' /etc/default/useradd</userinput></screen>
204 </listitem>
205 </varlistentry>
206
207 </variablelist>
208
209
210 </sect2>
211
212 <sect2 role="configuration">
213 <title>Setting the root password</title>
214
215 <para>Choose a password for user <emphasis>root</emphasis> and set it
216 by running:</para>
217
218<screen role="nodump"><userinput>passwd root</userinput></screen>
219
220 </sect2>
221
222 <sect2 id="contents-shadow" role="content">
223 <title>Contents of Shadow</title>
224
225 <segmentedlist>
226 <segtitle>Installed programs</segtitle>
227 <segtitle>Installed directory</segtitle>
228
229 <seglistitem>
230 <seg>chage, chfn, chgpasswd, chpasswd, chsh, expiry, faillog, gpasswd,
231 groupadd, groupdel, groupmems, groupmod, grpck, grpconv, grpunconv,
232 lastlog, login, logoutd, newgidmap, newgrp, newuidmap, newusers,
233 nologin, passwd, pwck, pwconv, pwunconv, sg (link to newgrp), su,
234 useradd, userdel, usermod, vigr (link to vipw), and vipw</seg>
235 <seg>/etc/default</seg>
236 </seglistitem>
237 </segmentedlist>
238
239 <variablelist>
240 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
241 <?dbfo list-presentation="list"?>
242 <?dbhtml list-presentation="table"?>
243
244 <varlistentry id="chage">
245 <term><command>chage</command></term>
246 <listitem>
247 <para>Used to change the maximum number of days between obligatory
248 password changes</para>
249 <indexterm zone="ch-system-shadow chage">
250 <primary sortas="b-chage">chage</primary>
251 </indexterm>
252 </listitem>
253 </varlistentry>
254
255 <varlistentry id="chfn">
256 <term><command>chfn</command></term>
257 <listitem>
258 <para>Used to change a user's full name and other information</para>
259 <indexterm zone="ch-system-shadow chfn">
260 <primary sortas="b-chfn">chfn</primary>
261 </indexterm>
262 </listitem>
263 </varlistentry>
264
265 <varlistentry id="chgpasswd">
266 <term><command>chgpasswd</command></term>
267 <listitem>
268 <para>Used to update group passwords in batch mode</para>
269 <indexterm zone="ch-system-shadow chgpasswd">
270 <primary sortas="b-chgpasswd">chgpasswd</primary>
271 </indexterm>
272 </listitem>
273 </varlistentry>
274
275 <varlistentry id="chpasswd">
276 <term><command>chpasswd</command></term>
277 <listitem>
278 <para>Used to update user passwords in batch mode</para>
279 <indexterm zone="ch-system-shadow chpasswd">
280 <primary sortas="b-chpasswd">chpasswd</primary>
281 </indexterm>
282 </listitem>
283 </varlistentry>
284
285 <varlistentry id="chsh">
286 <term><command>chsh</command></term>
287 <listitem>
288 <para>Used to change a user's default login shell</para>
289 <indexterm zone="ch-system-shadow chsh">
290 <primary sortas="b-chsh">chsh</primary>
291 </indexterm>
292 </listitem>
293 </varlistentry>
294
295 <varlistentry id="expiry">
296 <term><command>expiry</command></term>
297 <listitem>
298 <para>Checks and enforces the current password expiration policy</para>
299 <indexterm zone="ch-system-shadow expiry">
300 <primary sortas="b-expiry">expiry</primary>
301 </indexterm>
302 </listitem>
303 </varlistentry>
304
305 <varlistentry id="faillog">
306 <term><command>faillog</command></term>
307 <listitem>
308 <para>Is used to examine the log of login failures, to set a maximum
309 number of failures before an account is blocked, or to reset the
310 failure count</para>
311 <indexterm zone="ch-system-shadow faillog">
312 <primary sortas="b-faillog">faillog</primary>
313 </indexterm>
314 </listitem>
315 </varlistentry>
316
317 <varlistentry id="gpasswd">
318 <term><command>gpasswd</command></term>
319 <listitem>
320 <para>Is used to add and delete members and administrators to
321 groups</para>
322 <indexterm zone="ch-system-shadow gpasswd">
323 <primary sortas="b-gpasswd">gpasswd</primary>
324 </indexterm>
325 </listitem>
326 </varlistentry>
327
328 <varlistentry id="groupadd">
329 <term><command>groupadd</command></term>
330 <listitem>
331 <para>Creates a group with the given name</para>
332 <indexterm zone="ch-system-shadow groupadd">
333 <primary sortas="b-groupadd">groupadd</primary>
334 </indexterm>
335 </listitem>
336 </varlistentry>
337
338 <varlistentry id="groupdel">
339 <term><command>groupdel</command></term>
340 <listitem>
341 <para>Deletes the group with the given name</para>
342 <indexterm zone="ch-system-shadow groupdel">
343 <primary sortas="b-groupdel">groupdel</primary>
344 </indexterm>
345 </listitem>
346 </varlistentry>
347
348 <varlistentry id="groupmems">
349 <term><command>groupmems</command></term>
350 <listitem>
351 <para>Allows a user to administer his/her own group membership list
352 without the requirement of super user privileges.</para>
353 <indexterm zone="ch-system-shadow groupmems">
354 <primary sortas="b-groupmems">groupmems</primary>
355 </indexterm>
356 </listitem>
357 </varlistentry>
358
359 <varlistentry id="groupmod">
360 <term><command>groupmod</command></term>
361 <listitem>
362 <para>Is used to modify the given group's name or GID</para>
363 <indexterm zone="ch-system-shadow groupmod">
364 <primary sortas="b-groupmod">groupmod</primary>
365 </indexterm>
366 </listitem>
367 </varlistentry>
368
369 <varlistentry id="grpck">
370 <term><command>grpck</command></term>
371 <listitem>
372 <para>Verifies the integrity of the group files
373 <filename>/etc/group</filename> and
374 <filename>/etc/gshadow</filename></para>
375 <indexterm zone="ch-system-shadow grpck">
376 <primary sortas="b-grpck">grpck</primary>
377 </indexterm>
378 </listitem>
379 </varlistentry>
380
381 <varlistentry id="grpconv">
382 <term><command>grpconv</command></term>
383 <listitem>
384 <para>Creates or updates the shadow group file from the normal
385 group file</para>
386 <indexterm zone="ch-system-shadow grpconv">
387 <primary sortas="b-grpconv">grpconv</primary>
388 </indexterm>
389 </listitem>
390 </varlistentry>
391
392 <varlistentry id="grpunconv">
393 <term><command>grpunconv</command></term>
394 <listitem>
395 <para>Updates <filename>/etc/group</filename> from
396 <filename>/etc/gshadow</filename> and then deletes the latter</para>
397 <indexterm zone="ch-system-shadow grpunconv">
398 <primary sortas="b-grpunconv">grpunconv</primary>
399 </indexterm>
400 </listitem>
401 </varlistentry>
402
403 <varlistentry id="lastlog">
404 <term><command>lastlog</command></term>
405 <listitem>
406 <para>Reports the most recent login of all users or of a
407 given user</para>
408 <indexterm zone="ch-system-shadow lastlog">
409 <primary sortas="b-lastlog">lastlog</primary>
410 </indexterm>
411 </listitem>
412 </varlistentry>
413
414 <varlistentry id="login">
415 <term><command>login</command></term>
416 <listitem>
417 <para>Is used by the system to let users sign on</para>
418 <indexterm zone="ch-system-shadow login">
419 <primary sortas="b-login">login</primary>
420 </indexterm>
421 </listitem>
422 </varlistentry>
423
424 <varlistentry id="logoutd">
425 <term><command>logoutd</command></term>
426 <listitem>
427 <para>Is a daemon used to enforce restrictions on log-on time
428 and ports</para>
429 <indexterm zone="ch-system-shadow logoutd">
430 <primary sortas="b-logoutd">logoutd</primary>
431 </indexterm>
432 </listitem>
433 </varlistentry>
434
435 <varlistentry id="newgidmap">
436 <term><command>newgidmap</command></term>
437 <listitem>
438 <para>Is used to set the gid mapping of a user namespace</para>
439 <indexterm zone="ch-system-shadow newgidmap">
440 <primary sortas="b-newgidmap">newgidmap</primary>
441 </indexterm>
442 </listitem>
443 </varlistentry>
444
445 <varlistentry id="newgrp">
446 <term><command>newgrp</command></term>
447 <listitem>
448 <para>Is used to change the current GID during a login session</para>
449 <indexterm zone="ch-system-shadow newgrp">
450 <primary sortas="b-newgrp">newgrp</primary>
451 </indexterm>
452 </listitem>
453 </varlistentry>
454
455 <varlistentry id="newuidmap">
456 <term><command>newuidmap</command></term>
457 <listitem>
458 <para>Is used to set the uid mapping of a user namespace</para>
459 <indexterm zone="ch-system-shadow newuidmap">
460 <primary sortas="b-newuidmap">newuidmap</primary>
461 </indexterm>
462 </listitem>
463 </varlistentry>
464
465 <varlistentry id="newusers">
466 <term><command>newusers</command></term>
467 <listitem>
468 <para>Is used to create or update an entire series of user
469 accounts</para>
470 <indexterm zone="ch-system-shadow newusers">
471 <primary sortas="b-newusers">newusers</primary>
472 </indexterm>
473 </listitem>
474 </varlistentry>
475
476 <varlistentry id="nologin">
477 <term><command>nologin</command></term>
478 <listitem>
479 <para>Displays a message that an account is not available; it is designed
480 to be used as the default shell for accounts that have been
481 disabled</para>
482 <indexterm zone="ch-system-shadow nologin">
483 <primary sortas="b-nologin">nologin</primary>
484 </indexterm>
485 </listitem>
486 </varlistentry>
487
488 <varlistentry id="passwd">
489 <term><command>passwd</command></term>
490 <listitem>
491 <para>Is used to change the password for a user or group account</para>
492 <indexterm zone="ch-system-shadow passwd">
493 <primary sortas="b-passwd">passwd</primary>
494 </indexterm>
495 </listitem>
496 </varlistentry>
497
498 <varlistentry id="pwck">
499 <term><command>pwck</command></term>
500 <listitem>
501 <para>Verifies the integrity of the password files
502 <filename>/etc/passwd</filename> and
503 <filename>/etc/shadow</filename></para>
504 <indexterm zone="ch-system-shadow pwck">
505 <primary sortas="b-pwck">pwck</primary>
506 </indexterm>
507 </listitem>
508 </varlistentry>
509
510 <varlistentry id="pwconv">
511 <term><command>pwconv</command></term>
512 <listitem>
513 <para>Creates or updates the shadow password file from the normal
514 password file</para>
515 <indexterm zone="ch-system-shadow pwconv">
516 <primary sortas="b-pwconv">pwconv</primary>
517 </indexterm>
518 </listitem>
519 </varlistentry>
520
521 <varlistentry id="pwunconv">
522 <term><command>pwunconv</command></term>
523 <listitem>
524 <para>Updates <filename>/etc/passwd</filename> from
525 <filename>/etc/shadow</filename> and then deletes the latter</para>
526 <indexterm zone="ch-system-shadow pwunconv">
527 <primary sortas="b-pwunconv">pwunconv</primary>
528 </indexterm>
529 </listitem>
530 </varlistentry>
531
532 <varlistentry id="sg">
533 <term><command>sg</command></term>
534 <listitem>
535 <para>Executes a given command while the user's GID
536 is set to that of the given group</para>
537 <indexterm zone="ch-system-shadow sg">
538 <primary sortas="b-sg">sg</primary>
539 </indexterm>
540 </listitem>
541 </varlistentry>
542
543 <varlistentry id="su">
544 <term><command>su</command></term>
545 <listitem>
546 <para>Runs a shell with substitute user and group IDs</para>
547 <indexterm zone="ch-system-shadow su">
548 <primary sortas="b-su">su</primary>
549 </indexterm>
550 </listitem>
551 </varlistentry>
552
553 <varlistentry id="useradd">
554 <term><command>useradd</command></term>
555 <listitem>
556 <para>Creates a new user with the given name, or updates the default
557 new-user information</para>
558 <indexterm zone="ch-system-shadow useradd">
559 <primary sortas="b-useradd">useradd</primary>
560 </indexterm>
561 </listitem>
562 </varlistentry>
563
564 <varlistentry id="userdel">
565 <term><command>userdel</command></term>
566 <listitem>
567 <para>Deletes the given user account</para>
568 <indexterm zone="ch-system-shadow userdel">
569 <primary sortas="b-userdel">userdel</primary>
570 </indexterm>
571 </listitem>
572 </varlistentry>
573
574 <varlistentry id="usermod">
575 <term><command>usermod</command></term>
576 <listitem>
577 <para>Is used to modify the given user's login name, User
578 Identification (UID), shell, initial group, home directory, etc.</para>
579 <indexterm zone="ch-system-shadow usermod">
580 <primary sortas="b-usermod">usermod</primary>
581 </indexterm>
582 </listitem>
583 </varlistentry>
584
585 <varlistentry id="vigr">
586 <term><command>vigr</command></term>
587 <listitem>
588 <para>Edits the <filename>/etc/group</filename> or
589 <filename>/etc/gshadow</filename> files</para>
590 <indexterm zone="ch-system-shadow vigr">
591 <primary sortas="b-vigr">vigr</primary>
592 </indexterm>
593 </listitem>
594 </varlistentry>
595
596 <varlistentry id="vipw">
597 <term><command>vipw</command></term>
598 <listitem>
599 <para>Edits the <filename>/etc/passwd</filename> or
600 <filename>/etc/shadow</filename> files</para>
601 <indexterm zone="ch-system-shadow vipw">
602 <primary sortas="b-vipw">vipw</primary>
603 </indexterm>
604 </listitem>
605 </varlistentry>
606
607 </variablelist>
608
609 </sect2>
610
611</sect1>
Note: See TracBrowser for help on using the repository browser.