source: BOOK/final-system/common/shadow.xml@ 3135bd6

clfs-1.2 clfs-2.1 clfs-3.0.0-systemd clfs-3.0.0-sysvinit systemd sysvinit
Last change on this file since 3135bd6 was 3f8be484, checked in by Jim Gifford <clfs@…>, 19 years ago

r627@server (orig r625): jim | 2005-10-31 12:59:34 -0800
Import of Cross-LFS Book
  • Property mode set to 100644
File size: 18.5 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 <!ENTITY % patches-entities SYSTEM "../../patches.ent">
6 %general-entities;
7 %patches-entities;
8]>
9
10<sect1 id="ch-system-shadow" role="wrap">
11 <?dbhtml filename="shadow.html"?>
12
13 <title>Shadow-&shadow-version;</title>
14
15 <indexterm zone="ch-system-shadow">
16 <primary sortas="a-Shadow">Shadow</primary>
17 </indexterm>
18
19 <sect2 role="package">
20 <title/>
21
22 <para>The Shadow package contains programs for handling passwords in a
23 secure way.</para>
24
25 <segmentedlist>
26 <segtitle>&buildtime;</segtitle>
27 <segtitle>&diskspace;</segtitle>
28
29 <seglistitem>
30 <seg>Not checked yet</seg>
31 <seg>Not checked yet</seg>
32 </seglistitem>
33 </segmentedlist>
34
35 <segmentedlist>
36 <segtitle>&dependencies;</segtitle>
37
38 <seglistitem>
39 <seg>Bash, Binutils, Bison, Coreutils, Diffutils, GCC, Gettext,
40 Glibc, Grep, Make, and Sed</seg>
41 </seglistitem>
42 </segmentedlist>
43
44 </sect2>
45
46 <sect2 role="installation">
47 <title>Installation of Shadow</title>
48
49 <note os="a">
50 <para>If you would like to enforce the use of strong passwords,
51 refer to <ulink url="&blfs-root;view/svn/postlfs/cracklib.html"/>
52 for installing Cracklib prior to building Shadow. Then add
53 <parameter>--with-libcrack</parameter> to the <command>configure</command>
54 command below.</para>
55 </note>
56
57 <para os="p1">Shadow has selinux, pam, and auditing defaulted to on. The
58 following patch properly fixes this issue:</para>
59
60<screen os="p2"><userinput>patch -Np1 -i ../&shadow-configure_fix-patch;</userinput></screen>
61
62 <para os="b">Prepare Shadow for compilation:</para>
63
64<screen><userinput>./configure --libdir=/lib --enable-shared</userinput></screen>
65
66 <variablelist os="c">
67 <title>The meaning of the new configure options:</title>
68
69 <varlistentry>
70 <term><parameter>to be done</parameter></term>
71 <listitem>
72 <para>to be done</para>
73 </listitem>
74 </varlistentry>
75
76 </variablelist>
77
78 <para os="d">Disable the installation of the <command>groups</command> program
79 and it's man page, as Coreutils provides a better version:</para>
80
81<screen os="e"><userinput>sed -i 's/groups$(EXEEXT) //' src/Makefile
82sed -i '/groups/d' man/Makefile</userinput></screen>
83
84 <para os="f">Compile the package:</para>
85
86<screen os="g"><userinput>make</userinput></screen>
87
88 <para os="h">Install the package:</para>
89
90<screen os="i"><userinput>make install</userinput></screen>
91
92 <para id="shadow-limits-login_access" os="j">Shadow uses two files to configure
93 authentication settings for the system. Install these two configuration
94 files:</para>
95
96 <indexterm zone="shadow-limits-login_access" os="k">
97 <primary sortas="e-/etc/limits">/etc/limits</primary>
98 </indexterm>
99
100 <indexterm zone="shadow-limits-login_access" os="l">
101 <primary sortas="e-/etc/login.access">/etc/login.access</primary>
102 </indexterm>
103
104<screen os="m"><userinput>cp etc/{limits,login.access} /etc</userinput></screen>
105
106 <para id="shadow-login_defs" os="n">Instead of using the default
107 <emphasis>crypt</emphasis> method, use the more secure
108 <emphasis>MD5</emphasis> method of password encryption, which also allows
109 passwords longer than 8 characters. It is also necessary to change the
110 obsolete <filename class="directory">/var/spool/mail</filename> location
111 for user mailboxes that Shadow uses by default to the <filename
112 class="directory">/var/mail</filename> location used currently. Both of
113 these can be accomplished by changing the relevant configuration file
114 while copying it to its destination:</para>
115
116 <indexterm zone="shadow-login_defs" os="o">
117 <primary sortas="e-/etc/login.defs">/etc/login.defs</primary>
118 </indexterm>
119
120 <note os="p">
121 <para>If you built Shadow with Cracklib support, insert the following into
122 the <command>sed</command> given below:</para>
123
124<screen><literal>-e 's@DICTPATH.*@DICTPATH\t/lib/cracklib/pw_dict@'</literal></screen>
125 </note>
126
127<screen os="q"><userinput>sed -e's@#MD5_CRYPT_ENAB.no@MD5_CRYPT_ENAB yes@' \
128 -e 's@/var/spool/mail@/var/mail@' \
129 etc/login.defs &gt; /etc/login.defs</userinput></screen>
130
131 <para os="r">Move a misplaced program to their proper location:</para>
132
133<screen os="s"><userinput>mv /usr/bin/passwd /bin</userinput></screen>
134
135 <para os="t">Move Shadow's dynamic libraries to a more appropriate
136 location:</para>
137
138<screen os="u"><userinput>mv /lib/libshadow.*a /usr/lib
139rm /lib/libshadow.so
140ln -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen>
141
142 <para os="v">The <option>-D</option> option of the <command>useradd</command>
143 program requires the <filename class="directory">/etc/default</filename>
144 directory for it to work properly:</para>
145
146<screen os="w"><userinput>install -d /etc/default</userinput></screen>
147
148 </sect2>
149
150 <sect2 id="conf-shadow" role="configuration">
151 <title>Configuring Shadow</title>
152
153 <indexterm zone="conf-shadow">
154 <primary sortas="a-Shadow">Shadow</primary>
155 <secondary>configuring</secondary>
156 </indexterm>
157
158 <para>This package contains utilities to add, modify, and delete users and
159 groups; set and change their passwords; and perform other administrative
160 tasks. For a full explanation of what <emphasis>password shadowing</emphasis>
161 means, see the <filename>doc/HOWTO</filename> file within the unpacked source
162 tree. If using Shadow support, keep in mind that programs which need to
163 verify passwords (display managers, FTP programs, pop3 daemons, etc.) must
164 be Shadow-compliant. That is, they need to be able to work with shadowed
165 passwords.</para>
166
167 <para>To enable shadowed passwords, run the following command:</para>
168
169<screen><userinput>pwconv</userinput></screen>
170
171 <para>To enable shadowed group passwords, run:</para>
172
173<screen><userinput>grpconv</userinput></screen>
174
175 <para>Under normal circumstances, passwords will not have been created
176 yet. However, if returning to this section later to enable shadowing,
177 reset any current user passwords with the <command>passwd</command>
178 command or any group passwords with the <command>gpasswd</command>
179 command.</para>
180
181 </sect2>
182
183 <sect2 id="root-password" role="configuration">
184 <title>Setting the root password</title>
185
186 <para>Choose a password for user <systemitem
187 class="username">root</systemitem> and set it by running:</para>
188
189<screen><userinput>passwd root</userinput></screen>
190
191 </sect2>
192
193 <sect2 id="contents-shadow" role="content">
194 <title>Contents of Shadow</title>
195
196 <segmentedlist>
197 <segtitle>Installed programs</segtitle>
198 <segtitle>Installed libraries</segtitle>
199
200 <seglistitem>
201 <seg>chage, chfn, chpasswd, chsh, expiry, faillog, gpasswd, groupadd,
202 groupdel, groupmod, grpck, grpconv, grpunconv, lastlog, login,
203 logoutd, newgrp, newusers, passwd, pwck, pwconv, pwunconv,
204 sg (link to newgrp), useradd, userdel, usermod, vigr (link to vipw),
205 and vipw</seg>
206 <seg>libshadow.[a,so]</seg>
207 </seglistitem>
208 </segmentedlist>
209
210 <variablelist>
211 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
212 <?dbfo list-presentation="list"?>
213 <?dbhtml list-presentation="table"?>
214
215 <varlistentry id="chage">
216 <term><command>chage</command></term>
217 <listitem>
218 <para>Used to change the maximum number of days between obligatory
219 password changes</para>
220 <indexterm zone="ch-system-shadow chage">
221 <primary sortas="b-chage">chage</primary>
222 </indexterm>
223 </listitem>
224 </varlistentry>
225
226 <varlistentry id="chfn">
227 <term><command>chfn</command></term>
228 <listitem>
229 <para>Used to change a user's full name and other information</para>
230 <indexterm zone="ch-system-shadow chfn">
231 <primary sortas="b-chfn">chfn</primary>
232 </indexterm>
233 </listitem>
234 </varlistentry>
235
236 <varlistentry id="chpasswd">
237 <term><command>chpasswd</command></term>
238 <listitem>
239 <para>Used to update the passwords of an entire series of user
240 accounts</para>
241 <indexterm zone="ch-system-shadow chpasswd">
242 <primary sortas="b-chpasswd">chpasswd</primary>
243 </indexterm>
244 </listitem>
245 </varlistentry>
246
247 <varlistentry id="chsh">
248 <term><command>chsh</command></term>
249 <listitem>
250 <para>Used to change a user's default login shell</para>
251 <indexterm zone="ch-system-shadow chsh">
252 <primary sortas="b-chsh">chsh</primary>
253 </indexterm>
254 </listitem>
255 </varlistentry>
256
257 <varlistentry id="expiry">
258 <term><command>expiry</command></term>
259 <listitem>
260 <para>Checks and enforces the current password expiration policy</para>
261 <indexterm zone="ch-system-shadow expiry">
262 <primary sortas="b-expiry">expiry</primary>
263 </indexterm>
264 </listitem>
265 </varlistentry>
266
267 <varlistentry id="faillog">
268 <term><command>faillog</command></term>
269 <listitem>
270 <para>Is used to examine the log of login failures, to set a maximum
271 number of failures before an account is blocked, or to reset the
272 failure count</para>
273 <indexterm zone="ch-system-shadow faillog">
274 <primary sortas="b-faillog">faillog</primary>
275 </indexterm>
276 </listitem>
277 </varlistentry>
278
279 <varlistentry id="gpasswd">
280 <term><command>gpasswd</command></term>
281 <listitem>
282 <para>Is used to add and delete members and administrators to
283 groups</para>
284 <indexterm zone="ch-system-shadow gpasswd">
285 <primary sortas="b-gpasswd">gpasswd</primary>
286 </indexterm>
287 </listitem>
288 </varlistentry>
289
290 <varlistentry id="groupadd">
291 <term><command>groupadd</command></term>
292 <listitem>
293 <para>Creates a group with the given name</para>
294 <indexterm zone="ch-system-shadow groupadd">
295 <primary sortas="b-groupadd">groupadd</primary>
296 </indexterm>
297 </listitem>
298 </varlistentry>
299
300 <varlistentry id="groupdel">
301 <term><command>groupdel</command></term>
302 <listitem>
303 <para>Deletes the group with the given name</para>
304 <indexterm zone="ch-system-shadow groupdel">
305 <primary sortas="b-groupdel">groupdel</primary>
306 </indexterm>
307 </listitem>
308 </varlistentry>
309
310 <varlistentry id="groupmod">
311 <term><command>groupmod</command></term>
312 <listitem>
313 <para>Is used to modify the given group's name or GID</para>
314 <indexterm zone="ch-system-shadow groupmod">
315 <primary sortas="b-groupmod">groupmod</primary>
316 </indexterm>
317 </listitem>
318 </varlistentry>
319
320 <varlistentry id="grpck">
321 <term><command>grpck</command></term>
322 <listitem>
323 <para>Verifies the integrity of the group files
324 <filename>/etc/group</filename> and
325 <filename>/etc/gshadow</filename></para>
326 <indexterm zone="ch-system-shadow grpck">
327 <primary sortas="b-grpck">grpck</primary>
328 </indexterm>
329 </listitem>
330 </varlistentry>
331
332 <varlistentry id="grpconv">
333 <term><command>grpconv</command></term>
334 <listitem>
335 <para>Creates or updates the shadow group file from the normal
336 group file</para>
337 <indexterm zone="ch-system-shadow grpconv">
338 <primary sortas="b-grpconv">grpconv</primary>
339 </indexterm>
340 </listitem>
341 </varlistentry>
342
343 <varlistentry id="grpunconv">
344 <term><command>grpunconv</command></term>
345 <listitem>
346 <para>Updates <filename>/etc/group</filename> from
347 <filename>/etc/gshadow</filename> and then deletes the latter</para>
348 <indexterm zone="ch-system-shadow grpunconv">
349 <primary sortas="b-grpunconv">grpunconv</primary>
350 </indexterm>
351 </listitem>
352 </varlistentry>
353
354 <varlistentry id="lastlog">
355 <term><command>lastlog</command></term>
356 <listitem>
357 <para>Reports the most recent login of all users or of a
358 given user</para>
359 <indexterm zone="ch-system-shadow lastlog">
360 <primary sortas="b-lastlog">lastlog</primary>
361 </indexterm>
362 </listitem>
363 </varlistentry>
364
365 <varlistentry id="login">
366 <term><command>login</command></term>
367 <listitem>
368 <para>Is used by the system to let users sign on</para>
369 <indexterm zone="ch-system-shadow login">
370 <primary sortas="b-login">login</primary>
371 </indexterm>
372 </listitem>
373 </varlistentry>
374
375 <varlistentry id="logoutd">
376 <term><command>logoutd</command></term>
377 <listitem>
378 <para>Is a daemon used to enforce restrictions on log-on time
379 and ports</para>
380 <indexterm zone="ch-system-shadow logoutd">
381 <primary sortas="b-logoutd">logoutd</primary>
382 </indexterm>
383 </listitem>
384 </varlistentry>
385
386 <varlistentry id="newgrp">
387 <term><command>newgrp</command></term>
388 <listitem>
389 <para>Is used to change the current GID during a login session</para>
390 <indexterm zone="ch-system-shadow newgrp">
391 <primary sortas="b-newgrp">newgrp</primary>
392 </indexterm>
393 </listitem>
394 </varlistentry>
395
396 <varlistentry id="newusers">
397 <term><command>newusers</command></term>
398 <listitem>
399 <para>Is used to create or update an entire series of user
400 accounts</para>
401 <indexterm zone="ch-system-shadow newusers">
402 <primary sortas="b-newusers">newusers</primary>
403 </indexterm>
404 </listitem>
405 </varlistentry>
406
407 <varlistentry id="passwd">
408 <term><command>passwd</command></term>
409 <listitem>
410 <para>Is used to change the password for a user or group account</para>
411 <indexterm zone="ch-system-shadow passwd">
412 <primary sortas="b-passwd">passwd</primary>
413 </indexterm>
414 </listitem>
415 </varlistentry>
416
417 <varlistentry id="pwck">
418 <term><command>pwck</command></term>
419 <listitem>
420 <para>Verifies the integrity of the password files
421 <filename>/etc/passwd</filename> and
422 <filename>/etc/shadow</filename></para>
423 <indexterm zone="ch-system-shadow pwck">
424 <primary sortas="b-pwck">pwck</primary>
425 </indexterm>
426 </listitem>
427 </varlistentry>
428
429 <varlistentry id="pwconv">
430 <term><command>pwconv</command></term>
431 <listitem>
432 <para>Creates or updates the shadow password file from the normal
433 password file</para>
434 <indexterm zone="ch-system-shadow pwconv">
435 <primary sortas="b-pwconv">pwconv</primary>
436 </indexterm>
437 </listitem>
438 </varlistentry>
439
440 <varlistentry id="pwunconv">
441 <term><command>pwunconv</command></term>
442 <listitem>
443 <para>Updates <filename>/etc/passwd</filename> from
444 <filename>/etc/shadow</filename> and then deletes the latter</para>
445 <indexterm zone="ch-system-shadow pwunconv">
446 <primary sortas="b-pwunconv">pwunconv</primary>
447 </indexterm>
448 </listitem>
449 </varlistentry>
450
451 <varlistentry id="sg">
452 <term><command>sg</command></term>
453 <listitem>
454 <para>Executes a given command while the user's GID
455 is set to that of the given group</para>
456 <indexterm zone="ch-system-shadow sg">
457 <primary sortas="b-sg">sg</primary>
458 </indexterm>
459 </listitem>
460 </varlistentry>
461
462 <varlistentry id="su">
463 <term><command>su</command></term>
464 <listitem>
465 <para>Runs a shell with substitute user and group IDs</para>
466 <indexterm zone="ch-system-shadow su">
467 <primary sortas="b-su">su</primary>
468 </indexterm>
469 </listitem>
470 </varlistentry>
471
472 <varlistentry id="useradd">
473 <term><command>useradd</command></term>
474 <listitem>
475 <para>Creates a new user with the given name, or updates the default
476 new-user information</para>
477 <indexterm zone="ch-system-shadow useradd">
478 <primary sortas="b-useradd">useradd</primary>
479 </indexterm>
480 </listitem>
481 </varlistentry>
482
483 <varlistentry id="userdel">
484 <term><command>userdel</command></term>
485 <listitem>
486 <para>Deletes the given user account</para>
487 <indexterm zone="ch-system-shadow userdel">
488 <primary sortas="b-userdel">userdel</primary>
489 </indexterm>
490 </listitem>
491 </varlistentry>
492
493 <varlistentry id="usermod">
494 <term><command>usermod</command></term>
495 <listitem>
496 <para>Is used to modify the given user's login name, User
497 Identification (UID), shell, initial group, home directory, etc.</para>
498 <indexterm zone="ch-system-shadow usermod">
499 <primary sortas="b-usermod">usermod</primary>
500 </indexterm>
501 </listitem>
502 </varlistentry>
503
504 <varlistentry id="vigr">
505 <term><command>vigr</command></term>
506 <listitem>
507 <para>Edits the <filename>/etc/group</filename> or
508 <filename>/etc/gshadow</filename> files</para>
509 <indexterm zone="ch-system-shadow vigr">
510 <primary sortas="b-vigr">vigr</primary>
511 </indexterm>
512 </listitem>
513 </varlistentry>
514
515 <varlistentry id="vipw">
516 <term><command>vipw</command></term>
517 <listitem>
518 <para>Edits the <filename>/etc/passwd</filename> or
519 <filename>/etc/shadow</filename> files</para>
520 <indexterm zone="ch-system-shadow vipw">
521 <primary sortas="b-vipw">vipw</primary>
522 </indexterm>
523 </listitem>
524 </varlistentry>
525
526 <varlistentry id="libshadow">
527 <term><filename class="libraryfile">libshadow</filename></term>
528 <listitem>
529 <para>Contains functions used by most programs in this package</para>
530 <indexterm zone="ch-system-shadow libshadow">
531 <primary sortas="c-libshadow">libshadow</primary>
532 </indexterm>
533 </listitem>
534 </varlistentry>
535
536 </variablelist>
537
538 </sect2>
539
540</sect1>
Note: See TracBrowser for help on using the repository browser.