| blob | 6522342e66ef29c21220f4aad140f998d820e7e1 |
1 From 8727ea3e58908d3270e68c1614308682b70a44c1 Mon Sep 17 00:00:00 2001
2 From: David Runge <dvzrv@archlinux.org>
3 Date: Sat, 5 Nov 2022 22:52:58 +0100
4 Subject: [PATCH 4/4] Add Arch Linux defaults for /etc/pam.d/
6 etc/pam.d/Makefile.am:
7 Disable chfn, chsh and login.
8 Enable shadow.
9 Always install the PAM integration for the account tools (even if they
10 are not setuid).
12 etc/pam.d/{chage,chpasswd,group{add,del,mod},newusers,passwd,shadow,user{add,del,mod}}:
13 Add distribution defaults for Arch Linux.
15 s
16 ---
17 etc/pam.d/Makefile.am | 7 ++-----
18 etc/pam.d/chage | 6 ++++--
19 etc/pam.d/chpasswd | 6 ++++--
20 etc/pam.d/groupadd | 6 ++++--
21 etc/pam.d/groupdel | 6 ++++--
22 etc/pam.d/groupmod | 6 ++++--
23 etc/pam.d/newusers | 6 ++++--
24 etc/pam.d/passwd | 4 +---
25 etc/pam.d/shadow | 6 ++++++
26 etc/pam.d/useradd | 6 ++++--
27 etc/pam.d/userdel | 6 ++++--
28 etc/pam.d/usermod | 6 ++++--
29 12 files changed, 45 insertions(+), 26 deletions(-)
30 create mode 100644 etc/pam.d/shadow
32 diff --git a/etc/pam.d/Makefile.am b/etc/pam.d/Makefile.am
33 index 38ff26ae..41e43e01 100644
34 --- a/etc/pam.d/Makefile.am
35 +++ b/etc/pam.d/Makefile.am
36 @@ -2,10 +2,8 @@
37 # and also cooperate to make a distribution for `make dist'
39 pamd_files = \
40 - chfn \
41 - chsh \
42 groupmems \
43 - login \
44 + shadow \
45 passwd
47 pamd_acct_tools_files = \
48 @@ -23,10 +21,9 @@ pamd_acct_tools_files = \
49 if USE_PAM
50 pamddir = $(sysconfdir)/pam.d
51 pamd_DATA = $(pamd_files)
52 -if ACCT_TOOLS_SETUID
53 +# NOTE: we are always installing the PAM integration for the account tools
54 pamd_DATA += $(pamd_acct_tools_files)
55 endif
56 -endif
58 if WITH_SU
59 pamd_files += su
60 diff --git a/etc/pam.d/chage b/etc/pam.d/chage
61 index 8f49f5cc..a7bf8a4a 100644
62 --- a/etc/pam.d/chage
63 +++ b/etc/pam.d/chage
64 @@ -1,4 +1,6 @@
65 #%PAM-1.0
66 auth sufficient pam_rootok.so
67 -account required pam_permit.so
68 -password include system-auth
69 +auth required pam_unix.so
70 +account required pam_unix.so
71 +session required pam_unix.so
72 +password required pam_permit.so
73 diff --git a/etc/pam.d/chpasswd b/etc/pam.d/chpasswd
74 index 8f49f5cc..5d447985 100644
75 --- a/etc/pam.d/chpasswd
76 +++ b/etc/pam.d/chpasswd
77 @@ -1,4 +1,6 @@
78 #%PAM-1.0
79 auth sufficient pam_rootok.so
80 -account required pam_permit.so
81 -password include system-auth
82 +auth required pam_unix.so
83 +account required pam_unix.so
84 +session required pam_unix.so
85 +password required pam_unix.so sha512 shadow
86 diff --git a/etc/pam.d/groupadd b/etc/pam.d/groupadd
87 index 8f49f5cc..a7bf8a4a 100644
88 --- a/etc/pam.d/groupadd
89 +++ b/etc/pam.d/groupadd
90 @@ -1,4 +1,6 @@
91 #%PAM-1.0
92 auth sufficient pam_rootok.so
93 -account required pam_permit.so
94 -password include system-auth
95 +auth required pam_unix.so
96 +account required pam_unix.so
97 +session required pam_unix.so
98 +password required pam_permit.so
99 diff --git a/etc/pam.d/groupdel b/etc/pam.d/groupdel
100 index 8f49f5cc..a7bf8a4a 100644
101 --- a/etc/pam.d/groupdel
102 +++ b/etc/pam.d/groupdel
103 @@ -1,4 +1,6 @@
104 #%PAM-1.0
105 auth sufficient pam_rootok.so
106 -account required pam_permit.so
107 -password include system-auth
108 +auth required pam_unix.so
109 +account required pam_unix.so
110 +session required pam_unix.so
111 +password required pam_permit.so
112 diff --git a/etc/pam.d/groupmod b/etc/pam.d/groupmod
113 index 8f49f5cc..a7bf8a4a 100644
114 --- a/etc/pam.d/groupmod
115 +++ b/etc/pam.d/groupmod
116 @@ -1,4 +1,6 @@
117 #%PAM-1.0
118 auth sufficient pam_rootok.so
119 -account required pam_permit.so
120 -password include system-auth
121 +auth required pam_unix.so
122 +account required pam_unix.so
123 +session required pam_unix.so
124 +password required pam_permit.so
125 diff --git a/etc/pam.d/newusers b/etc/pam.d/newusers
126 index 8f49f5cc..5d447985 100644
127 --- a/etc/pam.d/newusers
128 +++ b/etc/pam.d/newusers
129 @@ -1,4 +1,6 @@
130 #%PAM-1.0
131 auth sufficient pam_rootok.so
132 -account required pam_permit.so
133 -password include system-auth
134 +auth required pam_unix.so
135 +account required pam_unix.so
136 +session required pam_unix.so
137 +password required pam_unix.so sha512 shadow
138 diff --git a/etc/pam.d/passwd b/etc/pam.d/passwd
139 index 731c0d36..08d819b2 100644
140 --- a/etc/pam.d/passwd
141 +++ b/etc/pam.d/passwd
142 @@ -1,4 +1,2 @@
143 #%PAM-1.0
144 -auth include system-auth
145 -account include system-auth
146 -password include system-auth
147 +password required pam_unix.so sha512 shadow nullok
148 diff --git a/etc/pam.d/shadow b/etc/pam.d/shadow
149 new file mode 100644
150 index 00000000..a7bf8a4a
151 --- /dev/null
152 +++ b/etc/pam.d/shadow
153 @@ -0,0 +1,6 @@
154 +#%PAM-1.0
155 +auth sufficient pam_rootok.so
156 +auth required pam_unix.so
157 +account required pam_unix.so
158 +session required pam_unix.so
159 +password required pam_permit.so
160 diff --git a/etc/pam.d/useradd b/etc/pam.d/useradd
161 index 8f49f5cc..a7bf8a4a 100644
162 --- a/etc/pam.d/useradd
163 +++ b/etc/pam.d/useradd
164 @@ -1,4 +1,6 @@
165 #%PAM-1.0
166 auth sufficient pam_rootok.so
167 -account required pam_permit.so
168 -password include system-auth
169 +auth required pam_unix.so
170 +account required pam_unix.so
171 +session required pam_unix.so
172 +password required pam_permit.so
173 diff --git a/etc/pam.d/userdel b/etc/pam.d/userdel
174 index 8f49f5cc..a7bf8a4a 100644
175 --- a/etc/pam.d/userdel
176 +++ b/etc/pam.d/userdel
177 @@ -1,4 +1,6 @@
178 #%PAM-1.0
179 auth sufficient pam_rootok.so
180 -account required pam_permit.so
181 -password include system-auth
182 +auth required pam_unix.so
183 +account required pam_unix.so
184 +session required pam_unix.so
185 +password required pam_permit.so
186 diff --git a/etc/pam.d/usermod b/etc/pam.d/usermod
187 index 8f49f5cc..a7bf8a4a 100644
188 --- a/etc/pam.d/usermod
189 +++ b/etc/pam.d/usermod
190 @@ -1,4 +1,6 @@
191 #%PAM-1.0
192 auth sufficient pam_rootok.so
193 -account required pam_permit.so
194 -password include system-auth
195 +auth required pam_unix.so
196 +account required pam_unix.so
197 +session required pam_unix.so
198 +password required pam_permit.so
199 --
200 2.39.0