Changeset c21999c6


Ignore:
Timestamp:
02/07/2004 10:48:44 AM (20 years ago)
Author:
Alex Gronenwoud <alex@…>
Branches:
10.0, 10.0-rc1, 10.1, 10.1-rc1, 11.0, 11.0-rc1, 11.0-rc2, 11.0-rc3, 11.1, 11.1-rc1, 11.2, 11.2-rc1, 11.3, 11.3-rc1, 12.0, 12.0-rc1, 12.1, 12.1-rc1, 6.0, 6.1, 6.1.1, 6.3, 6.4, 6.5, 6.6, 6.7, 6.8, 7.0, 7.1, 7.2, 7.3, 7.4, 7.5, 7.5-systemd, 7.6, 7.6-systemd, 7.7, 7.7-systemd, 7.8, 7.8-systemd, 7.9, 7.9-systemd, 8.0, 8.1, 8.2, 8.3, 8.4, 9.0, 9.1, arm, bdubbs/gcc13, ml-11.0, multilib, renodr/libudev-from-systemd, s6-init, trunk, v5_1, v5_1_1, xry111/arm64, xry111/arm64-12.0, xry111/clfs-ng, xry111/lfs-next, xry111/loongarch, xry111/loongarch-12.0, xry111/loongarch-12.1, xry111/mips64el, xry111/pip3, xry111/rust-wip-20221008, xry111/update-glibc
Children:
8a5f906
Parents:
5b0dd3a
Message:

Brushing up the Shadow page.

git-svn-id: ​http://svn.linuxfromscratch.org/LFS/trunk/BOOK@3233 4aa44e1e-78dd-0310-a6d2-fbcd4c07a689

File:
1 edited

Legend:

Unmodified
Added
Removed

  • chapter06/shadow.xml

    r5b0dd3a rc21999c6  
    1717<title>Installation of Shadow</title>
    1818
    19 <para>Shadow hard-wires the path to the <command>passwd</command> binary
    20 within the binary itself, but does this the wrong way. If a
    21 <command>passwd</command> binary is not present before installing Shadow,
    22 the package incorrectly assumes it is going to be located at
    23 <filename>/bin/passwd</filename>, but then installs it in
    24 <filename>/usr/bin/passwd</filename>. This will lead to errors about not finding
    25 <filename>/bin/passwd</filename>. To work around this bug, create a dummy
    26 <filename>passwd</filename> file, so that it gets hard-wired properly:</para>
     19<para>Shadow hard-wires the path to the <command>passwd</command> binary within
     20the binary itself, but does this the wrong way. If a <command>passwd</command>
     21binary is not present before installing Shadow, the package incorrectly assumes
     22it is going to be located at <filename>/bin/passwd</filename>, but then
     23installs it as <filename>/usr/bin/passwd</filename>. This will lead to errors
     24about not finding <filename>/bin/passwd</filename>. To work around this bug,
     25create a dummy <filename>passwd</filename> file, so that it gets hard-wired
     26properly:</para>
    2727
    2828<screen><userinput>touch /usr/bin/passwd</userinput></screen>
    … …  
    5050<screen><userinput>cp etc/{limits,login.access} /etc</userinput></screen>
    5151
    52 <para>We want to change the password method to enable MD5 passwords which are
    53 theoretically more secure than the default crypt method and also allow
    54 password lengths greater than 8 characters. We also need to change the old
    55 <filename class="directory">/var/spool/mail</filename> location for user
    56 mailboxes to the current location at
    57 <filename class="directory">/var/mail</filename>. We do this by changing the
    58 relevant configuration file while copying it to its destination:</para>
     52<para>Instead of using the default <emphasis>crypt</emphasis> method, we want
     53to use the more secure <emphasis>MD5</emphasis> method of password encryption,
     54which in addition allows passwords longer than 8 characters. We also need to
     55change the obsolete <filename class="directory">/var/spool/mail</filename>
     56location for user mailboxes that Shadow uses by default to the <filename
     57class="directory">/var/mail</filename> location used nowadays. We accomplish
     58both these things by changing the relevant configuration file while copying it
     59to its destination (it's probably better to cut-and-paste this rather than try
     60and type it all in):</para>
    5961
    60 <screen><userinput>sed -e 's%/var/spool/mail%/var/mail%' \
    61 &nbsp;&nbsp;&nbsp;&nbsp;-e 's%#MD5_CRYPT_ENAB.no%MD5_CRYPT_ENAB yes%' \
     62<screen><userinput>sed -e 's%#MD5_CRYPT_ENAB.no%MD5_CRYPT_ENAB yes%' \
     63&nbsp;&nbsp;&nbsp;&nbsp;-e 's%/var/spool/mail%/var/mail%' \
    6264&nbsp;&nbsp;&nbsp;&nbsp;etc/login.defs.linux &gt; /etc/login.defs</userinput></screen>
    63 
    64 <note><para>Be extra careful when typing all of the above. It is probably safer
    65 to cut-and-paste it rather than try and type it all in.</para></note>
    6665
    6766<para>Move some misplaced symlinks to their proper locations:</para>
    … …  
    8685
    8786<para>Coreutils has already installed a better <command>groups</command>
    88 program in <filename>/usr/bin</filename>. Remove the one installed by
    89 Shadow:</para>
     87program in <filename class="directory">/usr/bin</filename>. Remove the one
     88installed by Shadow:</para>
    9089
    9190<screen><userinput>rm /bin/groups</userinput></screen>
    … …  
    9796<sect2><title>Configuring Shadow</title>
    9897
    99 <para>This package contains utilities to modify users' passwords, add
    100 or delete users and groups, and the like. We're not going to explain what
    101 'password shadowing' means. A full explanation can be found in the
    102 <filename>doc/HOWTO</filename>
    103 file within the unpacked Shadow source tree. There's one
    104 thing to keep in mind if you decide to use Shadow support: programs that
    105 need to verify passwords (for example xdm, ftp daemons, pop3 daemons) need
    106 to be 'shadow-compliant', that is they need to be able to work with
    107 shadowed passwords.</para>
     98<para>This package contains utilities to add, modify and delete users and
     99groups, set and change their passwords, and other such administrative tasks.
     100For a full explanation of what <emphasis>password shadowing</emphasis> means,
     101see the <filename>doc/HOWTO</filename> file within the unpacked source tree.
     102There's one thing to keep in mind if you decide to use Shadow support: programs
     103that need to verify passwords (display managers, ftp programs, pop3 daemons,
     104and the like) need to be <emphasis>shadow-compliant</emphasis>, that is they
     105need to be able to work with shadowed passwords.</para>
    108106
    109107<para>To enable shadowed passwords, run the following command:</para>
    … …  
    111109<screen><userinput>/usr/sbin/pwconv</userinput></screen>
    112110
    113 <para>And to enable shadowed group passwords, run the following
    114 command:</para>
     111<para>And to enable shadowed group passwords, run:</para>
    115112
    116113<screen><userinput>/usr/sbin/grpconv</userinput></screen>
    117114
    118115<para>Under normal circumstances, you won't have created any passwords yet.
    119 However, if returning to this section to enable shadowing, you should reset any
    120 current user passwords with the <command>passwd</command> command or any
    121 group passwords with the <command>gpasswd</command> command.</para>
     116However, if returning to this section later to enable shadowing, you should
     117reset any current user passwords with the <command>passwd</command> command or
     118any group passwords with the <command>gpasswd</command> command.</para>
     119
    122120</sect2>
     121
     122<sect2><title>&nbsp;</title><para>&nbsp;</para></sect2>
    123123
    124124<sect2>
Note: See TracChangeset for help on using the changeset viewer.