chapter06/shadow.xml

   1 <?xml version="1.0" encoding="ISO-8859-1"?>
   2 <!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
   4   <!ENTITY % general-entities SYSTEM "../general.ent">
   5   %general-entities;
   6 ]>
   7
   8 <sect1 id="ch-system-shadow" role="wrap">
   9   <?dbhtml filename="shadow.html"?>
  10
  11   <sect1info condition="script">
  12     <productname>shadow</productname>
  13     <productnumber>&shadow-version;</productnumber>
  14     <address>&shadow-url;</address>
  15   </sect1info>
  16
  17   <title>Shadow-&shadow-version;</title>
  18
  19   <indexterm zone="ch-system-shadow">
  20     <primary sortas="a-Shadow">Shadow</primary>
  21   </indexterm>
  22
  23   <sect2 role="package">
  24     <title/>
  25
  26     <para>The Shadow package contains programs for handling passwords in a secure
  27     way.</para>
  28
  29     <segmentedlist>
  30       <segtitle>&buildtime;</segtitle>
  31       <segtitle>&diskspace;</segtitle>
  32
  33       <seglistitem>
  34         <seg>&shadow-ch6-sbu;</seg>
  35         <seg>&shadow-ch6-du;</seg>
  36       </seglistitem>
  37     </segmentedlist>
  38
  39   </sect2>
  40
  41   <sect2 role="installation">
  42     <title>Installation of Shadow</title>
  43
  44     <note>
  45       <para>If you would like to enforce the use of strong passwords, refer to
  46       <ulink url="&blfs-book;postlfs/cracklib.html"/> for installing
  47       CrackLib prior to building Shadow. Then add
  48       <parameter>--with-libcrack</parameter> to the <command>configure</command>
  49       command below.</para>
  50     </note>
  51
  52     <para>Disable the installation of the <command>groups</command> program
  53     and its man pages, as Coreutils provides a better version:</para>
  54
  55 <screen><userinput remap="pre">sed -i 's/groups$(EXEEXT) //' src/Makefile.in
  56 find man -name Makefile.in -exec sed -i 's/groups\.1 / /' {} \;</userinput></screen>
  57
  58     <para id="shadow-login_defs">Instead of using the default
  59     <emphasis>crypt</emphasis> method, use the more secure
  60     <emphasis>SHA-512</emphasis> method of password encryption, which also
  61     allows passwords longer than 8 characters. It is also necessary to change
  62     the obsolete <filename class="directory">/var/spool/mail</filename> location
  63     for user mailboxes that Shadow uses by default to the <filename
  64     class="directory">/var/mail</filename> location used currently:</para>
  65
  66 <screen><userinput remap="configure">sed -i -e 's@#ENCRYPT_METHOD DES@ENCRYPT_METHOD SHA512@' \
  67        -e 's@/var/spool/mail@/var/mail@' etc/login.defs</userinput></screen>
  68
  69     <note>
  70       <para>If you chose to build Shadow with Cracklib support, run the following:</para>
  71
  72 <screen role="nodump"><userinput>sed -i 's@DICTPATH.*@DICTPATH\t/lib/cracklib/pw_dict@' etc/login.defs</userinput></screen>
  73     </note>
  74
  75     <para>Make a minor change to make the default useradd consistent with the LFS
  76     groups file:</para>
  77
  78 <screen><userinput remap="pre">sed -i 's/1000/999/' etc/useradd</userinput></screen>
  79
  80     <para>Prepare Shadow for compilation:</para>
  81
  82 <screen><userinput remap="configure">./configure --sysconfdir=/etc --with-group-name-max-length=32</userinput></screen>
  83
  84     <variablelist>
  85       <title>The meaning of the configure option:</title>
  86
  87       <varlistentry>
  88         <term><parameter>--with-group-name-max-length=32</parameter></term>
  89         <listitem>
  90           <para>The maximum user name is 32 characters.  Make the maximum
  91           group name the same.</para>
  92         </listitem>
  93       </varlistentry>
  94
  95     </variablelist>
  96
  97     <para>Compile the package:</para>
  98
  99 <screen><userinput remap="make">make</userinput></screen>
 100
 101     <para>This package does not come with a test suite.</para>
 102
 103     <para>Install the package:</para>
 104
 105 <screen><userinput remap="install">make install</userinput></screen>
 106
 107     <para>Move a misplaced program to its proper location:</para>
 108
 109 <screen><userinput remap="install">mv -v /usr/bin/passwd /bin</userinput></screen>
 110
 111     <!-- <para>Move Shadow's libraries to more appropriate locations:</para>
 112
 113 <screen><userinput remap="install">mv -v /lib/libshadow.*a /usr/lib
 114 rm -v /lib/libshadow.so
 115 ln -sfv ../../lib/libshadow.so.0 /usr/lib/libshadow.so</userinput></screen> -->
 116
 117   </sect2>
 118
 119   <sect2 id="conf-shadow" role="configuration">
 120     <title>Configuring Shadow</title>
 121
 122     <indexterm zone="conf-shadow">
 123       <primary sortas="a-Shadow">Shadow</primary>
 124       <secondary>configuring</secondary>
 125     </indexterm>
 126
 127     <para>This package contains utilities to add, modify, and delete users and
 128     groups; set and change their passwords; and perform other administrative
 129     tasks. For a full explanation of what <emphasis>password shadowing</emphasis>
 130     means, see the <filename>doc/HOWTO</filename> file within the unpacked
 131     source tree. If using Shadow support, keep in mind that programs which need
 132     to verify passwords (display managers, FTP programs, pop3 daemons, etc.)
 133     must be Shadow-compliant. That is, they need to be able to work with
 134     shadowed passwords.</para>
 135
 136     <para>To enable shadowed passwords, run the following command:</para>
 137
 138 <screen><userinput>pwconv</userinput></screen>
 139
 140     <para>To enable shadowed group passwords, run:</para>
 141
 142 <screen><userinput>grpconv</userinput></screen>
 143
 144     <para>Shadow's stock configuration for the <command>useradd</command>
 145     utility has a few caveats that need some explanation. First, the default
 146     action for the <command>useradd</command> utility is to create the user and
 147     a group of the same name as the user. By default the user ID (UID) and
 148     group ID (GID) numbers will begin with 1000. This means if you don't pass
 149     parameters to <command>useradd</command>, each user will be a member of a
 150     unique group on the system. If this behaviour is undesirable, you'll need
 151     to pass the <parameter>-g</parameter> parameter to
 152     <command>useradd</command>. The default parameters are stored in the
 153     <filename>/etc/default/useradd</filename> file. You may need to modify two
 154     parameters in this file to suit your particular needs.</para>
 155
 156     <variablelist>
 157       <title><filename>/etc/default/useradd</filename> Parameter Explanations</title>
 158
 159       <varlistentry>
 160         <term><parameter>GROUP=1000</parameter></term>
 161         <listitem>
 162           <para>This parameter sets the beginning of the group numbers used in
 163           the /etc/group file. You can modify it to anything you desire. Note
 164           that <command>useradd</command> will never reuse a UID or GID. If the
 165           number identified in this parameter is used, it will use the next
 166           available number after this. Note also that if you don't have a group
 167           1000 on your system the first time you use <command>useradd</command>
 168           without the <parameter>-g</parameter> parameter, you'll get a message
 169           displayed on the terminal that says:
 170           <computeroutput>useradd: unknown GID 1000</computeroutput>. You may
 171           disregard this message and group number 1000 will be used.</para>
 172         </listitem>
 173       </varlistentry>
 174       <varlistentry>
 175         <term><parameter>CREATE_MAIL_SPOOL=yes</parameter></term>
 176         <listitem>
 177           <para>This parameter causes <command>useradd</command> to create a
 178           mailbox file for the newly created user. <command>useradd</command>
 179           will make the group ownership of this file to the
 180           <systemitem class="groupname">mail</systemitem> group with 0660
 181           permissions. If you would prefer that these mailbox files are not
 182           created by <command>useradd</command>, issue the following
 183           command:</para>
 184
 185 <screen><userinput>sed -i 's/yes/no/' /etc/default/useradd</userinput></screen>
 186         </listitem>
 187       </varlistentry>
 188
 189     </variablelist>
 190
 191
 192   </sect2>
 193
 194   <sect2 role="configuration">
 195     <title>Setting the root password</title>
 196
 197     <para>Choose a password for user <emphasis>root</emphasis> and set it
 198     by running:</para>
 199
 200 <screen role="nodump"><userinput>passwd root</userinput></screen>
 201
 202   </sect2>
 203
 204   <sect2 id="contents-shadow" role="content">
 205     <title>Contents of Shadow</title>
 206
 207     <segmentedlist>
 208       <segtitle>Installed programs</segtitle>
 209       <segtitle>Installed directory</segtitle>
 210
 211       <seglistitem>
 212         <seg>chage, chfn, chgpasswd, chpasswd, chsh, expiry, faillog, gpasswd,
 213         groupadd, groupdel, groupmems, groupmod, grpck, grpconv, grpunconv,
 214         lastlog, login, logoutd, newgrp, newusers, nologin, passwd, pwck,
 215         pwconv, pwunconv, sg (link to newgrp), su, useradd, userdel, usermod,
 216         vigr (link to vipw), and vipw</seg>
 217         <seg>/etc/default</seg>
 218       </seglistitem>
 219     </segmentedlist>
 220
 221     <variablelist>
 222       <bridgehead renderas="sect3">Short Descriptions</bridgehead>
 223       <?dbfo list-presentation="list"?>
 224       <?dbhtml list-presentation="table"?>
 225
 226       <varlistentry id="chage">
 227         <term><command>chage</command></term>
 228         <listitem>
 229           <para>Used to change the maximum number of days between obligatory
 230           password changes</para>
 231           <indexterm zone="ch-system-shadow chage">
 232             <primary sortas="b-chage">chage</primary>
 233           </indexterm>
 234         </listitem>
 235       </varlistentry>
 236
 237       <varlistentry id="chfn">
 238         <term><command>chfn</command></term>
 239         <listitem>
 240           <para>Used to change a user's full name and other information</para>
 241           <indexterm zone="ch-system-shadow chfn">
 242             <primary sortas="b-chfn">chfn</primary>
 243           </indexterm>
 244         </listitem>
 245       </varlistentry>
 246
 247       <varlistentry id="chgpasswd">
 248         <term><command>chgpasswd</command></term>
 249         <listitem>
 250           <para>Used to update group passwords in batch mode</para>
 251           <indexterm zone="ch-system-shadow chgpasswd">
 252             <primary sortas="b-chgpasswd">chgpasswd</primary>
 253           </indexterm>
 254         </listitem>
 255       </varlistentry>
 256
 257       <varlistentry id="chpasswd">
 258         <term><command>chpasswd</command></term>
 259         <listitem>
 260           <para>Used to update user passwords in batch mode</para>
 261           <indexterm zone="ch-system-shadow chpasswd">
 262             <primary sortas="b-chpasswd">chpasswd</primary>
 263           </indexterm>
 264         </listitem>
 265       </varlistentry>
 266
 267       <varlistentry id="chsh">
 268         <term><command>chsh</command></term>
 269         <listitem>
 270           <para>Used to change a user's default login shell</para>
 271           <indexterm zone="ch-system-shadow chsh">
 272             <primary sortas="b-chsh">chsh</primary>
 273           </indexterm>
 274         </listitem>
 275       </varlistentry>
 276
 277       <varlistentry id="expiry">
 278         <term><command>expiry</command></term>
 279         <listitem>
 280           <para>Checks and enforces the current password expiration policy</para>
 281           <indexterm zone="ch-system-shadow expiry">
 282             <primary sortas="b-expiry">expiry</primary>
 283           </indexterm>
 284         </listitem>
 285       </varlistentry>
 286
 287       <varlistentry id="faillog">
 288         <term><command>faillog</command></term>
 289         <listitem>
 290           <para>Is used to examine the log of login failures, to set a maximum
 291           number of failures before an account is blocked, or to reset the
 292           failure count</para>
 293           <indexterm zone="ch-system-shadow faillog">
 294             <primary sortas="b-faillog">faillog</primary>
 295           </indexterm>
 296         </listitem>
 297       </varlistentry>
 298
 299       <varlistentry id="gpasswd">
 300         <term><command>gpasswd</command></term>
 301         <listitem>
 302           <para>Is used to add and delete members and administrators to
 303           groups</para>
 304           <indexterm zone="ch-system-shadow gpasswd">
 305             <primary sortas="b-gpasswd">gpasswd</primary>
 306           </indexterm>
 307         </listitem>
 308       </varlistentry>
 309
 310       <varlistentry id="groupadd">
 311         <term><command>groupadd</command></term>
 312         <listitem>
 313           <para>Creates a group with the given name</para>
 314           <indexterm zone="ch-system-shadow groupadd">
 315             <primary sortas="b-groupadd">groupadd</primary>
 316           </indexterm>
 317         </listitem>
 318       </varlistentry>
 319
 320       <varlistentry id="groupdel">
 321         <term><command>groupdel</command></term>
 322         <listitem>
 323           <para>Deletes the group with the given name</para>
 324           <indexterm zone="ch-system-shadow groupdel">
 325             <primary sortas="b-groupdel">groupdel</primary>
 326           </indexterm>
 327         </listitem>
 328       </varlistentry>
 329
 330       <varlistentry id="groupmems">
 331         <term><command>groupmems</command></term>
 332         <listitem>
 333           <para>Allows a user to administer his/her own group membership list
 334           without the requirement of super user privileges.</para>
 335           <indexterm zone="ch-system-shadow groupmems">
 336             <primary sortas="b-groupmems">groupmems</primary>
 337           </indexterm>
 338         </listitem>
 339       </varlistentry>
 340
 341       <varlistentry id="groupmod">
 342         <term><command>groupmod</command></term>
 343         <listitem>
 344           <para>Is used to modify the given group's name or GID</para>
 345           <indexterm zone="ch-system-shadow groupmod">
 346             <primary sortas="b-groupmod">groupmod</primary>
 347           </indexterm>
 348         </listitem>
 349       </varlistentry>
 350
 351       <varlistentry id="grpck">
 352         <term><command>grpck</command></term>
 353         <listitem>
 354           <para>Verifies the integrity of the group files
 355           <filename>/etc/group</filename> and
 356           <filename>/etc/gshadow</filename></para>
 357           <indexterm zone="ch-system-shadow grpck">
 358             <primary sortas="b-grpck">grpck</primary>
 359           </indexterm>
 360         </listitem>
 361       </varlistentry>
 362
 363       <varlistentry id="grpconv">
 364         <term><command>grpconv</command></term>
 365         <listitem>
 366           <para>Creates or updates the shadow group file from the normal
 367           group file</para>
 368           <indexterm zone="ch-system-shadow grpconv">
 369             <primary sortas="b-grpconv">grpconv</primary>
 370           </indexterm>
 371         </listitem>
 372       </varlistentry>
 373
 374       <varlistentry id="grpunconv">
 375         <term><command>grpunconv</command></term>
 376         <listitem>
 377           <para>Updates <filename>/etc/group</filename> from
 378           <filename>/etc/gshadow</filename> and then deletes the latter</para>
 379           <indexterm zone="ch-system-shadow grpunconv">
 380             <primary sortas="b-grpunconv">grpunconv</primary>
 381           </indexterm>
 382         </listitem>
 383       </varlistentry>
 384
 385       <varlistentry id="lastlog">
 386         <term><command>lastlog</command></term>
 387         <listitem>
 388           <para>Reports the most recent login of all users or of a
 389           given user</para>
 390           <indexterm zone="ch-system-shadow lastlog">
 391             <primary sortas="b-lastlog">lastlog</primary>
 392           </indexterm>
 393         </listitem>
 394       </varlistentry>
 395
 396       <varlistentry id="login">
 397         <term><command>login</command></term>
 398         <listitem>
 399           <para>Is used by the system to let users sign on</para>
 400           <indexterm zone="ch-system-shadow login">
 401             <primary sortas="b-login">login</primary>
 402           </indexterm>
 403         </listitem>
 404       </varlistentry>
 405
 406       <varlistentry id="logoutd">
 407         <term><command>logoutd</command></term>
 408         <listitem>
 409           <para>Is a daemon used to enforce restrictions on log-on time
 410           and ports</para>
 411           <indexterm zone="ch-system-shadow logoutd">
 412             <primary sortas="b-logoutd">logoutd</primary>
 413           </indexterm>
 414         </listitem>
 415       </varlistentry>
 416
 417       <varlistentry id="newgrp">
 418         <term><command>newgrp</command></term>
 419         <listitem>
 420           <para>Is used to change the current GID during a login session</para>
 421           <indexterm zone="ch-system-shadow newgrp">
 422             <primary sortas="b-newgrp">newgrp</primary>
 423           </indexterm>
 424         </listitem>
 425       </varlistentry>
 426
 427       <varlistentry id="newusers">
 428         <term><command>newusers</command></term>
 429         <listitem>
 430           <para>Is used to create or update an entire series of user
 431           accounts</para>
 432           <indexterm zone="ch-system-shadow newusers">
 433             <primary sortas="b-newusers">newusers</primary>
 434           </indexterm>
 435         </listitem>
 436       </varlistentry>
 437
 438       <varlistentry id="nologin">
 439         <term><command>nologin</command></term>
 440         <listitem>
 441           <para>Displays a message that an account is not available; it is designed
 442           to be used as the default shell for accounts that have been
 443           disabled</para>
 444           <indexterm zone="ch-system-shadow nologin">
 445             <primary sortas="b-nologin">nologin</primary>
 446           </indexterm>
 447         </listitem>
 448       </varlistentry>
 449
 450       <varlistentry id="passwd">
 451         <term><command>passwd</command></term>
 452         <listitem>
 453           <para>Is used to change the password for a user or group account</para>
 454           <indexterm zone="ch-system-shadow passwd">
 455             <primary sortas="b-passwd">passwd</primary>
 456           </indexterm>
 457         </listitem>
 458       </varlistentry>
 459
 460       <varlistentry id="pwck">
 461         <term><command>pwck</command></term>
 462         <listitem>
 463           <para>Verifies the integrity of the password files
 464           <filename>/etc/passwd</filename> and
 465           <filename>/etc/shadow</filename></para>
 466           <indexterm zone="ch-system-shadow pwck">
 467             <primary sortas="b-pwck">pwck</primary>
 468           </indexterm>
 469         </listitem>
 470       </varlistentry>
 471
 472       <varlistentry id="pwconv">
 473         <term><command>pwconv</command></term>
 474         <listitem>
 475           <para>Creates or updates the shadow password file from the normal
 476           password file</para>
 477           <indexterm zone="ch-system-shadow pwconv">
 478             <primary sortas="b-pwconv">pwconv</primary>
 479           </indexterm>
 480         </listitem>
 481       </varlistentry>
 482
 483       <varlistentry id="pwunconv">
 484         <term><command>pwunconv</command></term>
 485         <listitem>
 486           <para>Updates <filename>/etc/passwd</filename> from
 487           <filename>/etc/shadow</filename> and then deletes the latter</para>
 488           <indexterm zone="ch-system-shadow pwunconv">
 489             <primary sortas="b-pwunconv">pwunconv</primary>
 490           </indexterm>
 491         </listitem>
 492       </varlistentry>
 493
 494       <varlistentry id="sg">
 495         <term><command>sg</command></term>
 496         <listitem>
 497           <para>Executes a given command while the user's GID
 498           is set to that of the given group</para>
 499           <indexterm zone="ch-system-shadow sg">
 500             <primary sortas="b-sg">sg</primary>
 501           </indexterm>
 502         </listitem>
 503       </varlistentry>
 504
 505       <varlistentry id="su">
 506         <term><command>su</command></term>
 507         <listitem>
 508           <para>Runs a shell with substitute user and group IDs</para>
 509           <indexterm zone="ch-system-shadow su">
 510             <primary sortas="b-su">su</primary>
 511           </indexterm>
 512         </listitem>
 513       </varlistentry>
 514
 515       <varlistentry id="useradd">
 516         <term><command>useradd</command></term>
 517         <listitem>
 518           <para>Creates a new user with the given name, or updates the default
 519           new-user information</para>
 520           <indexterm zone="ch-system-shadow useradd">
 521             <primary sortas="b-useradd">useradd</primary>
 522           </indexterm>
 523         </listitem>
 524       </varlistentry>
 525
 526       <varlistentry id="userdel">
 527         <term><command>userdel</command></term>
 528         <listitem>
 529           <para>Deletes the given user account</para>
 530           <indexterm zone="ch-system-shadow userdel">
 531             <primary sortas="b-userdel">userdel</primary>
 532           </indexterm>
 533         </listitem>
 534       </varlistentry>
 535
 536       <varlistentry id="usermod">
 537         <term><command>usermod</command></term>
 538         <listitem>
 539           <para>Is used to modify the given user's login name, User
 540           Identification (UID), shell, initial group, home directory, etc.</para>
 541           <indexterm zone="ch-system-shadow usermod">
 542             <primary sortas="b-usermod">usermod</primary>
 543           </indexterm>
 544         </listitem>
 545       </varlistentry>
 546
 547       <varlistentry id="vigr">
 548         <term><command>vigr</command></term>
 549         <listitem>
 550           <para>Edits the <filename>/etc/group</filename> or
 551           <filename>/etc/gshadow</filename> files</para>
 552           <indexterm zone="ch-system-shadow vigr">
 553             <primary sortas="b-vigr">vigr</primary>
 554           </indexterm>
 555         </listitem>
 556       </varlistentry>
 557
 558       <varlistentry id="vipw">
 559         <term><command>vipw</command></term>
 560         <listitem>
 561           <para>Edits the <filename>/etc/passwd</filename> or
 562           <filename>/etc/shadow</filename> files</para>
 563           <indexterm zone="ch-system-shadow vipw">
 564             <primary sortas="b-vipw">vipw</primary>
 565           </indexterm>
 566         </listitem>
 567       </varlistentry>
 568
 569     </variablelist>
 570
 571   </sect2>
 572
 573 </sect1>