shadow-4.0.14

[markh@…]

shadow 4.0.0 is completely borken... closing the bug - it can be reopened once 4.0.1 comes out.

[gimli@…]

Building as a shared library isn't fixed yet, I tried it. I guess we'll have to wait some more :( The non-PAM issues don't seem to be fixed either (at least, that's what I understand from the ChangeLog).

(from lfs-book, if you didn't read it yet)

Unless we come up with a real good solution, this bug can be marked WONTFIX as well.

[gerard@…]

Waiting for next release

[gerard@…]

reoening, forgot to assign it to myself when WONTFIX'ed it

[markh@…]

agreed to leave shadow with the current version. closing

[markh@…]

for after LFS-3.2 release.

evaluate shadow-4.0.2 and see if it's fixed to work properly

[gerard@…]

This release reportedly compiles fine without PAM as long as you don't try to create shared libraries. Under the circumstances (being that the currently used shadow package is getting quite old) that may not be such a bad idea. We'll have to test though if packages that use libshadow (kde comes to mind) can use the static library that (if at all) is installed in /usr/lib

[gerard@…]

I got word that the current CVS tree of shadow would work creating shared libraries. Let's keep an eye on it's progress and see if we can do anything with this (probably not, CVS isn't really suitable for use in the lfs-book )

[gerard@…]

I got word a new shadow may be released in a few days so we'll see what happens then.

[gerard@…]

updated in book

[markh@…]

shadow-4.0.3 seems to install ok *with* shared libraries :-) Closing

[Matthew Burgess]

Version increment (4.0.4.1). For all the gory details see ​ftp://ftp.pld.org.pl/software/shadow/NEWS

[tushar@…]

FYI, I have uploaded a patch to fix the broken symlinks.

Also FYI, shadow does not require --prefix=/usr option to configure (it is the default). The --libdir=/usr/lib option is required though.

[greg@…]

FYI, I have uploaded a patch to fix the broken symlinks.

Thanks for that (and for submitting it upstream). However, I think we'll skip this one. I'm about to commit some changes that do a simple:

mv /bin/sg /usr/bin mv /bin/vigr /usr/sbin

which achieves the same thing. I hate the shadow pkg :-/ For software that plays such an important role, the packaging sure is crap..

[Matthew Burgess]

Version increment (4.0.5), loads of changes, see ​ftp://ftp.pld.org.pl/software/shadow/NEWS.

[Matthew Burgess]

Verion increment (4.0.6)

[jeremy@…]

Upgraded in Unstable

[Matthew Burgess]

Version increment (4.0.7)

[Matthew Burgess]

Version increment (4.0.8). Loads of stuff in NEWS including:

"- login: fixed create lastlog entry fo users never loged in on non-PAM

variant of login"

Lastlog patch is no longer required.

[j@…]

shadow 4.0.8 introduced two major problems. The first one affects encryption: at least using chpasswd results in non-encrypted (and therefore non-working) passwords in /etc/shadow. The other one affects login.defs configuration: most keys won't be read (but produce many warnings).

Reported both problems upstream, patches available from ​http://www.paldo.org/index.php?section=packages&page=main&releaseid=19723

[steve.crosby@…]

The getdefs patch in the URL shown fixes the problem, but is not correct. Although the actual problem (the list of config items is not sorted alpanumerically as it should be) is resolved, the patch also strips out all the USE_PAM and USE_SYSLOG ifdef's - thats bad.

I'm rebuilding now using what should be correct, and if it works okay I'll upload a more correct patch.

[steve.crosby@…]

here is a more correct patch - If I was less pressed for time, I'd format it and submit to the patches project, and send upstream - but I'm sure someone can do that ;)

diff -Naur shadow-4.0.8.orig/lib/getdef.c shadow-4.0.8/lib/getdef.c --- shadow-4.0.8.orig/lib/getdef.c 2005-04-02 10:52:03.000000000 +1200 +++ shadow-4.0.8/lib/getdef.c 2005-05-01 17:13:05.104217344 +1200 @@ -51,30 +51,59 @@

#define NUMDEFS (sizeof(def_table)/sizeof(def_table[0])) static struct itemdef def_table[] = {

+#ifndef USE_PAM + {"CHFN_AUTH", NULL}, +#endif

{"CHFN_RESTRICT", NULL},

• {"DEFAULT_HOME", NULL},
• {"FAIL_DELAY", NULL},
• {"PASS_MAX_DAYS", NULL},
• {"PASS_MIN_DAYS", NULL},
• {"PASS_WARN_AGE", NULL},
• {"USERDEL_CMD", NULL},

+#ifndef USE_PAM + {"CHSH_AUTH", NULL}, +#endif

#ifdef USE_PAM

{"CLOSE_SESSIONS", NULL},

-#else

• {"CHFN_AUTH", NULL},
• {"CHSH_AUTH", NULL},

+#endif + {"CONSOLE", NULL}, + {"CONSOLE_GROUPS", NULL}, +#ifndef USE_PAM

{"CRACKLIB_DICTPATH", NULL},

+#endif + {"CREATE_HOME", NULL}, + {"DEFAULT_HOME", NULL}, +#ifndef USE_PAM + {"ENVIRON_FILE", NULL},

{"ENV_HZ", NULL}, {"ENV_PATH", NULL}, {"ENV_ROOTPATH", NULL}, /* SuSE compatibility? */ {"ENV_SUPATH", NULL}, {"ENV_TZ", NULL},

• {"ENVIRON_FILE", NULL},

+#endif + {"ERASECHAR", NULL}, +#ifndef USE_PAM

{"FAILLOG_ENAB", NULL},

+#endif + {"FAIL_DELAY", NULL}, + {"FAKE_SHELL", NULL}, +#ifndef USE_PAM

{"FTMP_FILE", NULL},

+#endif + {"GETPASS_ASTERISKS", NULL}, + {"GID_MAX", NULL}, + {"GID_MIN", NULL}, + {"HUSHLOGIN_FILE", NULL}, +#ifndef USE_PAM

{"ISSUE_FILE", NULL},

+#endif + {"KILLCHAR", NULL}, +#ifndef USE_PAM

{"LASTLOG_ENAB", NULL},

+#endif + {"LOGIN_RETRIES", NULL}, +#ifndef USE_PAM

{"LOGIN_STRING", NULL},

+#endif + {"LOGIN_TIMEOUT", NULL}, + {"LOG_OK_LOGINS", NULL}, + {"LOG_UNKFAIL_ENAB", NULL}, +#ifndef USE_PAM

{"MAIL_CHECK_ENAB", NULL}, {"MAIL_DIR", NULL}, {"MAIL_FILE", NULL},

@@ -84,30 +113,26 @@

{"OBSCURE_CHECKS_ENAB", NULL}, {"PASS_ALWAYS_WARN", NULL}, {"PASS_CHANGE_TRIES", NULL},

+#endif + {"PASS_MAX_DAYS", NULL}, +#ifndef USE_PAM

{"PASS_MAX_LEN", NULL},

+#endif + {"PASS_MIN_DAYS", NULL}, +#ifndef USE_PAM

{"PASS_MIN_LEN", NULL},

+#endif + {"PASS_WARN_AGE", NULL}, +#ifndef USE_PAM

{"PORTTIME_CHECKS_ENAB", NULL},

• {"SU_WHEEL_ONLY", NULL},

{"QMAIL_DIR", NULL}, {"QUOTAS_ENAB", NULL},

• {"ULIMIT", NULL}, #endif
• {"CONSOLE", NULL},
• {"CONSOLE_GROUPS", NULL},
• {"CREATE_HOME", NULL},
• {"ERASECHAR", NULL},
• {"FAKE_SHELL", NULL},
• {"GETPASS_ASTERISKS", NULL},
• {"GID_MAX", NULL},
• {"GID_MIN", NULL},
• {"HUSHLOGIN_FILE", NULL},
• {"KILLCHAR", NULL},
• {"LOGIN_RETRIES", NULL},
• {"LOGIN_TIMEOUT", NULL},
• {"LOG_OK_LOGINS", NULL},
• {"LOG_UNKFAIL_ENAB", NULL},

{"SULOG_FILE", NULL}, {"SU_NAME", NULL},

+#ifndef USE_PAM + {"SU_WHEEL_ONLY", NULL}, +#endif

#ifdef USE_SYSLOG

{"SYSLOG_SG_ENAB", NULL}, {"SYSLOG_SU_ENAB", NULL},

@@ -117,7 +142,11 @@

{"TTYTYPE_FILE", NULL}, {"UID_MAX", NULL}, {"UID_MIN", NULL},

+#ifndef USE_PAM + {"ULIMIT", NULL}, +#endif

{"UMASK", NULL},

+ {"USERDEL_CMD", NULL},

{"USERGROUPS_ENAB", NULL}

};

[jim@…]

I think we should hold off, there has been activity on the shadow list to get all these issues worked out, recommend staying with 4.0.7. 4.0.9 should be released very shortly.

[Matthew Burgess]

Agreed, we'll hold off on this release and give it another go when 4.0.9 comes out. Thanks for the patches though Jurg and Steve.

[jim@…]

shadow-4.0.8 -> shadow-4.0.9

* general:

• passwd: fixed segfault in non-PAM connfiguration (submited by Greg Schafer <gschafer@…>),
• newgrp: fixed NULL pointer dereference - getlogin() and ttyname() can return NULL which is not checked (​http://bugs.debian.org/162303),
• updated translations: ro, ru,
• added new translations: vi,
• lib/getdef.c: leaves the table as it is, and changes from the binary search to a sequential one (Lucas Correia Villa Real <lucasvr@…>),
• lastlog: fixed --help message (s,--login,--user,) ​http://bugs.debian.org/249611.

[jim@…]

Current list of changes: for Shadow 4.0.10 to be release on 6-27-2005

* general:

• mkpasswd: removed,
• userdel: now deletes user groups from /etc/gshdow as well as /etc/group. Fix by Nicolas François <nicolas.francois@…>. ​http://bugs.debian.org/99442
• usermod: when relocating a user's home directory, don't fail and remove the new home directory if we can't remove the old home directory for some reason; the results can be spectularly poort if, for instance, only the rmdir() fails. Patch prepared by Timo Lindfors <lindi-spamtrap@…>. ​http://bugs.debian.org/166369
• su: fix syslogs to be less ambiguous. Use old:new format instead of old-new because '-' can appear in usernames ​http://bugs.debian.org/213592
• removed not used now libmisc/setup.c,
• login: use also UTMPX API instead UTMP on failure (login was affected for this when shadow was builded without PAM support) patch by Nicolas François <nicolas.francois@…>
• login: the PAM session needs to be closed as root, thus before change_uid() ​http://bugs.debian.org/53570 ​http://bugs.debian.org/195048

​http://bugs.debian.org/211884

• login: made login's -f option also able to use the username after -- if none was passed as it's optarg ​http://bugs.debian.org/53702
• login: check for hushed login and pass PAM_SILENT if true, ​http://bugs.debian.org/48002
• login: fixed username on succesful login (was using the normal username, when it should have used pam_user) ​http://bugs.debian.org/47819
• remove using SHADOWPWD #define so now shadow is allways builded with shadow passwowd support,
• chage: rewrite for use getopt_long(),
• updated translations: ca, cs, da, fi, pl, ru, zh_TW.

* documentation:

• most of the man pages now are generated from XML files so in case submiting any chages to this resources please make diff to XML files,
• chfn: give more details about the influence of login.defs on what's allowed to users.

[Matthew Burgess]

Version increment (4.0.11). A fair number of changes in this one, notably including:

• su, sulogin, login: fixed erroneous warning messages when used with PAM about

some login.defs variables (fix by DJ Lucas <DJ Lucas>)

[Matthew Burgess]

Version increment (4.0.11.1)

[randy@…]

I can confirm that this package update works perfectly with the GCC4 branch

[randy@…]

Thanks for picking this one up, Ken. I was hoping that LFS would update as it makes the BLFS update so much easier.

[zarniwhoop@…]

Thanks, Randy. Actually, it was Matt who pointed me to this. Just don't hold your breath waiting, I'm doing the testing on my old duron, it will be some time before it gets to shadow.

[randy@…]

Well, just wanted to say thanks.

FWIW, lots of folks are using this version of Shadow, and nobody I can think of is having any problems. In fact, it has fixed lots of problems for us.

[ken@…]

/me is confused. I thought there was an issue with --enable-shadowgrp (supposed to be the default, but apparently wasn't). I've tried ignoring this option, adding --enable-shadowgrp, adding --disable-shadowgrp. The same things get installed, and the logs from configure and make are identical.

[Matthew Burgess]

Simple test case :)

Compile as per the current instructions. Then run 'grpconv', you'll get an error something like "support for shadowed groups not being compiled in" - at least this is what happened to me yesterday when I forgot to update my build scripts!

[DJ Lucas]

I'd suggest sitting on it till the 22nd of August-scheduled release date for 4.0.12. IIUC not accepting patches except for critical bugs and translations till after release. A snapshot is availible for testing at ​http://ftp.pld.org.pl/software/shadow/snapshot/shadow-4.0.12.tar.bz2

[ken@…]

Thanks, Matt. I don't normally run grpconv. Confirmed that there is a

difference in whether or not grpconv will work, even though the logs from configure and make appear identical. Back on the road again. Thanks for the suggestion, DJ - I've already got the snapshot to play with, but I'd like to get something concrete committed.

[zarniwhoop@…]

Assigning to myself so I can do the update. Ken

[zarniwhoop@…]

Upgraded to 4.0.11.1. Looks as if --enable-shadowgrp can come out again when 4.0.12 is released. Ken

[Matthew Burgess]

Version increment (4.0.12). From Changelog:

• realy enable shadow group support by default (pointed by Greg Schafer

<gschafer@…> and Peter Vrabec <pvrabec@…>).

[Matthew Burgess]

Randy, this compiled and worked fine for me without the --enable-shadowgrp configure flag. Would you mind testing it against PAM so upgrading here doesn't cause problems for BLFS?

[randy@…]

I'd be happy to. Just as soon as I finish up a KDE installation I'm working on.

[Matthew Burgess]

Version increment (1.0.13). Lots of entries in NEWS for this one!

[Matthew Burgess]

This needs --without-selinux in order to compile, due to broken configure machinery. See ​http://www.diy-linux.org/pipermail/diy-linux-dev/2005-October/000658.html for a list of things that the configure summary gets wrong too (though this appears to be merely cosmetic). etc/login.defs.linux has been renamed to etc/login.defs, so the `sed' will need updating (reported by Duncan Webb, forgotten about by me until my script bailed out!).

[jim@…]

4.0.13 is in cross-lfs. Patch was made to address this issue. ​http://www.linuxfromscratch.org/patches/downloads/shadow/shadow-4.0.13- configure_fix-1.patch

[Matthew Burgess]

Version increment (4.0.14)