BOOK/chapter06/shadowpwd.xml

   1 <sect1 id="ch-system-shadow" xreflabel="Shadow">
   2 <title>Installing Shadow-&shadow-version;</title>
   3 <?dbhtml filename="shadow.html" dir="chapter06"?>
   4
   5 <para>The Shadow package contains programs for handling passwords in a secure
   6 way.</para>
   7
   8 <screen>&buildtime; &shadow-time;
   9 &diskspace; &shadow-compsize;</screen>
  10
  11 &aa-shadowpwd-down;
  12 &aa-shadowpwd-dep;
  13
  14 <sect2><title>&nbsp;</title><para>&nbsp;</para></sect2>
  15
  16 <sect2>
  17 <title>Installation of Shadow</title>
  18
  19 <para>Shadow hard-wires the path to the <command>passwd</command> binary
  20 within the binary itself, but does this the wrong way. If a
  21 <command>passwd</command> binary is not present before installing Shadow,
  22 the package incorrectly assumes it is going to be located at
  23 <filename>/bin/passwd</filename>, but then installs it in
  24 <filename>/usr/bin/passwd</filename>. This will lead to errors about not finding
  25 <filename>/bin/passwd</filename>. To work around this bug, create a dummy
  26 <filename>passwd</filename> file, so that it gets hard-wired properly:</para>
  27
  28 <screen><userinput>touch /usr/bin/passwd</userinput></screen>
  29
  30 <para>Now prepare Shadow for compilation:</para>
  31
  32 <screen><userinput>./configure --libdir=/usr/lib --enable-shared</userinput></screen>
  33
  34 <para>Work around a problem that prevents Shadow's internationalization from
  35 working:</para>
  36
  37 <screen><userinput>echo '#define HAVE_SETLOCALE 1' >> config.h</userinput></screen>
  38
  39 <para>Compile the package:</para>
  40
  41 <screen><userinput>make</userinput></screen>
  42
  43 <para>And install it:</para>
  44
  45 <screen><userinput>make install</userinput></screen>
  46
  47 <para>Shadow uses two files to configure authentication settings for the
  48 system. Install these two config files:</para>
  49
  50 <screen><userinput>cp etc/{limits,login.access} /etc</userinput></screen>
  51
  52 <para>We want to change the password method to enable MD5 passwords which are
  53 theoretically more secure than the default "crypt" method and also allow
  54 password lengths greater than 8 characters. We also need to change the old
  55 <filename class="directory">/var/spool/mail</filename> location for user
  56 mailboxes to the current location at
  57 <filename class="directory">/var/mail</filename>. We do this by changing the
  58 relevant configuration file while copying it to its destination:</para>
  59
  60 <screen><userinput>sed -e 's%/var/spool/mail%/var/mail%' \
  61 &nbsp;&nbsp;&nbsp;&nbsp;-e 's%#MD5_CRYPT_ENAB.no%MD5_CRYPT_ENAB yes%' \
  62 &nbsp;&nbsp;&nbsp;&nbsp;etc/login.defs.linux &gt; /etc/login.defs</userinput></screen>
  63
  64 <note><para>Be extra careful when typing all of the above. It is probably safer
  65 to cut-and-paste it rather than try and type it all in.</para></note>
  66
  67 <para>Move some misplaced symlinks to their proper locations:</para>
  68
  69 <screen><userinput>mv /bin/sg /usr/bin
  70 mv /bin/vigr /usr/sbin</userinput></screen>
  71
  72 <para>And move Shadow's dynamic libraries to a more appropriate location:</para>
  73
  74 <screen><userinput>mv /usr/lib/lib{shadow,misc}.so.0* /lib</userinput></screen>
  75
  76 <para>As some packages expect to find the just-moved libraries in
  77 <filename>/usr/lib</filename>, create the following symlinks:</para>
  78
  79 <screen><userinput>ln -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so
  80 ln -sf ../../lib/libmisc.so.0 /usr/lib/libmisc.so</userinput></screen>
  81
  82 <para>The -D option of the <filename>useradd</filename> program requires this
  83 directory for it to work properly:</para>
  84
  85 <screen><userinput>mkdir /etc/default</userinput></screen>
  86
  87 <para>Coreutils has already installed a better <command>groups</command>
  88 program in <filename>/usr/bin</filename>. Remove the one installed by
  89 Shadow:</para>
  90
  91 <screen><userinput>rm /bin/groups</userinput></screen>
  92
  93 </sect2>
  94
  95 &c6-cf-shadowpwd;
  96 &c6-cf-password;
  97
  98 &aa-shadowpwd-shortdesc;
  99 &aa-shadowpwd-desc;
 100
 101 </sect1>
 102