From 51121d5484938ec0e939deebf216f94402bf0552 Mon Sep 17 00:00:00 2001 From: David Runge Date: Mon, 31 Oct 2022 09:45:13 +0100 Subject: [PATCH 2/3] Adapt login.defs for PAM and util-linux etc/login.defs: Remove unused login.defs options, that are either irrelevant due to the use of PAM or because the util-linux version of a binary does not support them. Modify all options that are ignored when using PAM, but are supported by util-linux. Removed options because they are part of PAMDEFS (options in PAMDEFS are options silently ignored by shadow when built with PAM enabled): * CHFN_AUTH * CRACKLIB_DICTPATH * ENV_HZ * ENVIRON_FILE * ENV_TZ * FAILLOG_ENAB * FTMP_FILE * ISSUE_FILE * LASTLOG_ENAB * LOGIN_STRING * MAIL_CHECK_ENAB * NOLOGINS_FILE * OBSCURE_CHECKS_ENAB * PASS_ALWAYS_WARN * PASS_CHANGE_TRIES * PASS_MAX_LEN * PASS_MIN_LEN * PORTTIME_CHECKS_ENAB * QUOTAS_ENAB * SU_WHEEL_ONLY * SYSLOG_SU_ENAB * ULIMIT Removed options because they are not availablbe with PAM enabled: * BCRYPT_MIN_ROUNDS * BCRYPT_MAX_ROUNDS * CONSOLE_GROUPS * CONSOLE * MD5_CRYPT_ENAB * PREVENT_NO_AUTH Removed encryption methods (`ENCRYPT_METHOD`), because they are unsafe or not available with PAM: * BCRYPT * MD5 Removed options because they are not supported by login from util-linux: * ERASECHAR * KILLCHAR * LOG_OK_LOGINS * TTYTYPE_FILE Removed options because they are not supported by su from util-linux: * SULOG_FILE * SU_NAME Adapted options because they are in PAMDEFS but are supported by login from util-linux: * MOTD_FILE man/login.defs.5.xml: Remove unavailable options from man 5 login.defs. --- etc/login.defs | 223 +------------------------------------------ man/login.defs.5.xml | 148 +--------------------------- 2 files changed, 8 insertions(+), 363 deletions(-) diff --git a/etc/login.defs b/etc/login.defs index 33622c29..797ca6b3 100644 --- a/etc/login.defs +++ b/etc/login.defs @@ -3,6 +3,8 @@ # # $Id$ # +# NOTE: This file is adapted for the use on Arch Linux! +# Unsupported options due to the use of util-linux or PAM are removed. # # Delay in seconds before being allowed another attempt after a login failure @@ -11,26 +13,11 @@ # FAIL_DELAY 3 -# -# Enable logging and display of /var/log/faillog login(1) failure info. -# -FAILLOG_ENAB yes - # # Enable display of unknown usernames when login(1) failures are recorded. # LOG_UNKFAIL_ENAB no -# -# Enable logging of successful logins -# -LOG_OK_LOGINS no - -# -# Enable logging and display of /var/log/lastlog login(1) time info. -# -LASTLOG_ENAB yes - # # Limit the highest user ID number for which the lastlog entries should # be updated. @@ -40,88 +27,13 @@ LASTLOG_ENAB yes # #LASTLOG_UID_MAX -# -# Enable checking and display of mailbox status upon login. -# -# Disable if the shell startup files already check for mail -# ("mailx -e" or equivalent). -# -MAIL_CHECK_ENAB yes - -# -# Enable additional checks upon password changes. -# -OBSCURE_CHECKS_ENAB yes - -# -# Enable checking of time restrictions specified in /etc/porttime. -# -PORTTIME_CHECKS_ENAB yes - -# -# Enable setting of ulimit, umask, and niceness from passwd(5) gecos field. -# -QUOTAS_ENAB yes - -# -# Enable "syslog" logging of su(1) activity - in addition to sulog file logging. -# SYSLOG_SG_ENAB does the same for newgrp(1) and sg(1). -# -SYSLOG_SU_ENAB yes -SYSLOG_SG_ENAB yes - -# -# If defined, either full pathname of a file containing device names or -# a ":" delimited list of device names. Root logins will be allowed only -# from these devices. -# -CONSOLE /etc/securetty -#CONSOLE console:tty01:tty02:tty03:tty04 - -# -# If defined, all su(1) activity is logged to this file. -# -#SULOG_FILE /var/log/sulog - # # If defined, ":" delimited list of "message of the day" files to # be displayed upon login. # -MOTD_FILE /etc/motd +MOTD_FILE #MOTD_FILE /etc/motd:/usr/lib/news/news-motd -# -# If defined, this file will be output before each login(1) prompt. -# -#ISSUE_FILE /etc/issue - -# -# If defined, file which maps tty line to TERM environment parameter. -# Each line of the file is in a format similar to "vt100 tty01". -# -#TTYTYPE_FILE /etc/ttytype - -# -# If defined, login(1) failures will be logged here in a utmp format. -# last(1), when invoked as lastb(1), will read /var/log/btmp, so... -# -FTMP_FILE /var/log/btmp - -# -# If defined, name of file whose presence will inhibit non-root -# logins. The content of this file should be a message indicating -# why logins are inhibited. -# -NOLOGINS_FILE /etc/nologin - -# -# If defined, the command name to display when running "su -". For -# example, if this is defined as "su" then ps(1) will display the -# command as "-su". If not defined, then ps(1) will display the -# name of the shell actually being run, e.g. something like "-sh". -# -SU_NAME su - # # *REQUIRED* # Directory where mailboxes reside, _or_ name of file, relative to the @@ -139,21 +51,6 @@ MAIL_DIR /var/spool/mail HUSHLOGIN_FILE .hushlogin #HUSHLOGIN_FILE /etc/hushlogins -# -# If defined, either a TZ environment parameter spec or the -# fully-rooted pathname of a file containing such a spec. -# -#ENV_TZ TZ=CST6CDT -#ENV_TZ /etc/tzname - -# -# If defined, an HZ environment parameter spec. -# -# for Linux/x86 -ENV_HZ HZ=100 -# For Linux/Alpha... -#ENV_HZ HZ=1024 - # # *REQUIRED* The default PATH settings, for superuser and normal users. # @@ -175,23 +72,6 @@ ENV_PATH PATH=/bin:/usr/bin TTYGROUP tty TTYPERM 0600 -# -# Login configuration initializations: -# -# ERASECHAR Terminal ERASE character ('\010' = backspace). -# KILLCHAR Terminal KILL character ('\025' = CTRL/U). -# ULIMIT Default "ulimit" value. -# -# The ERASECHAR and KILLCHAR are used only on System V machines. -# The ULIMIT is used only if the system supports it. -# (now it works with setrlimit too; ulimit is in 512-byte units) -# -# Prefix these values with "0" to get octal, "0x" to get hexadecimal. -# -ERASECHAR 0177 -KILLCHAR 025 -#ULIMIT 2097152 - # Default initial "umask" value used by login(1) on non-PAM enabled systems. # Default "umask" value for pam_umask(8) on PAM enabled systems. # UMASK is also used by useradd(8) and newusers(8) to set the mode for new @@ -211,22 +91,12 @@ UMASK 022 # # PASS_MAX_DAYS Maximum number of days a password may be used. # PASS_MIN_DAYS Minimum number of days allowed between password changes. -# PASS_MIN_LEN Minimum acceptable password length. # PASS_WARN_AGE Number of days warning given before a password expires. # PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 -PASS_MIN_LEN 5 PASS_WARN_AGE 7 -# -# If "yes", the user must be listed as a member of the first gid 0 group -# in /etc/group (called "root" on most Linux systems) to be able to "su" -# to uid 0 accounts. If the group doesn't exist or is empty, no one -# will be able to "su" to uid 0. -# -SU_WHEEL_ONLY no - # # Min/max values for automatic uid selection in useradd(8) # @@ -263,28 +133,6 @@ LOGIN_RETRIES 5 # LOGIN_TIMEOUT 60 -# -# Maximum number of attempts to change password if rejected (too easy) -# -PASS_CHANGE_TRIES 5 - -# -# Warn about weak passwords (but still allow them) if you are root. -# -PASS_ALWAYS_WARN yes - -# -# Number of significant characters in the password for crypt(). -# Default is 8, don't change unless your crypt() is better. -# Ignored if MD5_CRYPT_ENAB set to "yes". -# -#PASS_MAX_LEN 8 - -# -# Require password before chfn(1)/chsh(1) can make any changes. -# -CHFN_AUTH yes - # # Which fields may be changed by regular users using chfn(1) - use # any combination of letters "frwh" (full name, room number, work @@ -293,38 +141,13 @@ CHFN_AUTH yes # CHFN_RESTRICT rwh -# -# Password prompt (%s will be replaced by user name). -# -# XXX - it doesn't work correctly yet, for now leave it commented out -# to use the default which is just "Password: ". -#LOGIN_STRING "%s's Password: " - -# -# Only works if compiled with MD5_CRYPT defined: -# If set to "yes", new passwords will be encrypted using the MD5-based -# algorithm compatible with the one used by recent releases of FreeBSD. -# It supports passwords of unlimited length and longer salt strings. -# Set to "no" if you need to copy encrypted passwords to other systems -# which don't understand the new algorithm. Default is "no". -# -# Note: If you use PAM, it is recommended to use a value consistent with -# the PAM modules configuration. -# -# This variable is deprecated. You should use ENCRYPT_METHOD instead. -# -#MD5_CRYPT_ENAB no - # # Only works if compiled with ENCRYPTMETHOD_SELECT defined: -# If set to MD5, MD5-based algorithm will be used for encrypting password # If set to SHA256, SHA256-based algorithm will be used for encrypting password # If set to SHA512, SHA512-based algorithm will be used for encrypting password -# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password # If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password # If set to DES, DES-based algorithm will be used for encrypting password (default) # MD5 and DES should not be used for new hashes, see crypt(5) for recommendations. -# Overrides the MD5_CRYPT_ENAB option # # Note: If you use PAM, it is recommended to use a value consistent with # the PAM modules configuration. @@ -348,21 +171,6 @@ CHFN_RESTRICT rwh #SHA_CRYPT_MIN_ROUNDS 5000 #SHA_CRYPT_MAX_ROUNDS 5000 -# -# Only works if ENCRYPT_METHOD is set to BCRYPT. -# -# Define the number of BCRYPT rounds. -# With a lot of rounds, it is more difficult to brute-force the password. -# However, more CPU resources will be needed to authenticate users if -# this value is increased. -# -# If not specified, 13 rounds will be attempted. -# If only one of the MIN or MAX values is set, then this value will be used. -# If MIN > MAX, the highest value will be used. -# -#BCRYPT_MIN_ROUNDS 13 -#BCRYPT_MAX_ROUNDS 13 - # # Only works if ENCRYPT_METHOD is set to YESCRYPT. # @@ -376,17 +184,6 @@ CHFN_RESTRICT rwh # #YESCRYPT_COST_FACTOR 5 -# -# List of groups to add to the user's supplementary group set -# when logging in from the console (as determined by the CONSOLE -# setting). Default is none. -# -# Use with caution - it is possible for users to gain permanent -# access to these groups, even when not logged in from the console. -# How to do it is left as an exercise for the reader... -# -#CONSOLE_GROUPS floppy:audio:cdrom - # # Should login be allowed if we can't cd to the home directory? # Default is no. @@ -401,12 +198,6 @@ DEFAULT_HOME yes # NONEXISTENT /nonexistent -# -# If this file exists and is readable, login environment will be -# read from it. Every line should be in the form name=value. -# -ENVIRON_FILE /etc/environment - # # If defined, this command is run when removing a user. # It should remove any at/cron/print jobs etc. owned by @@ -454,14 +245,6 @@ USERGROUPS_ENAB yes # #GRANT_AUX_GROUP_SUBIDS yes -# -# Prevents an empty password field to be interpreted as "no authentication -# required". -# Set to "yes" to prevent for all accounts -# Set to "superuser" to prevent for UID 0 / root (default) -# Set to "no" to not prevent for any account (dangerous, historical default) -PREVENT_NO_AUTH superuser - # # Select the HMAC cryptography algorithm. # Used in pam_timestamp module to calculate the keyed-hash message diff --git a/man/login.defs.5.xml b/man/login.defs.5.xml index 05ef5125..1ddf537e 100644 --- a/man/login.defs.5.xml +++ b/man/login.defs.5.xml @@ -7,70 +7,38 @@ --> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -147,48 +115,25 @@ The following configuration items are provided: - &BCRYPT_MIN_ROUNDS; - &CHFN_AUTH; &CHFN_RESTRICT; - &CHSH_AUTH; - &CONSOLE; - &CONSOLE_GROUPS; &CREATE_HOME; &DEFAULT_HOME; &ENCRYPT_METHOD; - &ENV_HZ; &ENV_PATH; &ENV_SUPATH; - &ENV_TZ; - &ENVIRON_FILE; - &ERASECHAR; &FAIL_DELAY; - &FAILLOG_ENAB; - &FAKE_SHELL; - &FTMP_FILE; &GID_MAX; &HMAC_CRYPTO_ALGO; &HOME_MODE; &HUSHLOGIN_FILE; - &ISSUE_FILE; - &KILLCHAR; - &LASTLOG_ENAB; &LASTLOG_UID_MAX; - &LOG_OK_LOGINS; &LOG_UNKFAIL_ENAB; &LOGIN_RETRIES; - &LOGIN_STRING; &LOGIN_TIMEOUT; - &MAIL_CHECK_ENAB; &MAIL_DIR; &MAX_MEMBERS_PER_GROUP; - &MD5_CRYPT_ENAB; &MOTD_FILE; - &NOLOGINS_FILE; &NONEXISTENT; - &OBSCURE_CHECKS_ENAB; - &PASS_ALWAYS_WARN; - &PASS_CHANGE_TRIES; &PASS_MAX_DAYS; &PASS_MIN_DAYS; &PASS_WARN_AGE; @@ -198,25 +143,16 @@ time of account creation. Any changes to these settings won't affect existing accounts. - &PASS_MAX_LEN; - &PORTTIME_CHECKS_ENAB; - "AS_ENAB; &SHA_CRYPT_MIN_ROUNDS; - &SULOG_FILE; - &SU_NAME; - &SU_WHEEL_ONLY; &SUB_GID_COUNT; &SUB_UID_COUNT; &SYS_GID_MAX; &SYS_UID_MAX; &SYSLOG_SG_ENAB; - &SYSLOG_SU_ENAB; &TCB_AUTH_GROUP; &TCB_SYMLINKS; &TTYGROUP; - &TTYTYPE_FILE; &UID_MAX; - &ULIMIT; &UMASK; &USERDEL_CMD; &USERGROUPS_ENAB; @@ -255,7 +191,7 @@ BCRYPT_MAX_ROUNDS BCRYPT_MIN_ROUNDS - ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB + ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS YESCRYPT_COST_FACTOR @@ -280,7 +216,7 @@ chsh - CHSH_AUTH LOGIN_STRING + CHSH_AUTH @@ -292,7 +228,7 @@ BCRYPT_MAX_ROUNDS BCRYPT_MIN_ROUNDS - ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB + ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS YESCRYPT_COST_FACTOR @@ -352,35 +288,6 @@ LASTLOG_UID_MAX - - login - - - CONSOLE - CONSOLE_GROUPS DEFAULT_HOME - ENV_HZ ENV_PATH ENV_SUPATH - ENV_TZ ENVIRON_FILE - ERASECHAR FAIL_DELAY - FAILLOG_ENAB - FAKE_SHELL - FTMP_FILE - HUSHLOGIN_FILE - ISSUE_FILE - KILLCHAR - LASTLOG_ENAB LASTLOG_UID_MAX - LOGIN_RETRIES - LOGIN_STRING - LOGIN_TIMEOUT LOG_OK_LOGINS LOG_UNKFAIL_ENAB - MAIL_CHECK_ENAB MAIL_DIR MAIL_FILE - MOTD_FILE NOLOGINS_FILE PORTTIME_CHECKS_ENAB - QUOTAS_ENAB - TTYGROUP TTYPERM TTYTYPE_FILE - ULIMIT UMASK - USERGROUPS_ENAB - - - - newgrp / sg @@ -397,7 +304,7 @@ BCRYPT_MIN_ROUNDS ENCRYPT_METHOD GID_MAX GID_MIN - MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB + MAX_MEMBERS_PER_GROUP HOME_MODE PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE SHA_CRYPT_MAX_ROUNDS @@ -417,8 +324,7 @@ BCRYPT_MAX_ROUNDS BCRYPT_MIN_ROUNDS - ENCRYPT_METHOD MD5_CRYPT_ENAB OBSCURE_CHECKS_ENAB - PASS_ALWAYS_WARN PASS_CHANGE_TRIES PASS_MAX_LEN PASS_MIN_LEN + ENCRYPT_METHOD SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS YESCRYPT_COST_FACTOR @@ -451,32 +357,6 @@ - - su - - - CONSOLE - CONSOLE_GROUPS DEFAULT_HOME - ENV_HZ ENVIRON_FILE - ENV_PATH ENV_SUPATH - ENV_TZ LOGIN_STRING MAIL_CHECK_ENAB - MAIL_DIR MAIL_FILE QUOTAS_ENAB - SULOG_FILE SU_NAME - SU_WHEEL_ONLY - SYSLOG_SU_ENAB - USERGROUPS_ENAB - - - - - sulogin - - - ENV_HZ - ENV_TZ - - - useradd @@ -505,24 +385,6 @@ - - usermod - - - LASTLOG_UID_MAX - MAIL_DIR MAIL_FILE MAX_MEMBERS_PER_GROUP - TCB_SYMLINKS USE_TCB - - - - - vipw - - - USE_TCB - - - -- 2.44.0