path: root/0002-Adapt-login.defs-for-PAM-and-util-linux.patch

From 51121d5484938ec0e939deebf216f94402bf0552 Mon Sep 17 00:00:00 2001
From: David Runge <dvzrv@archlinux.org>
Date: Mon, 31 Oct 2022 09:45:13 +0100
Subject: [PATCH 2/3] Adapt login.defs for PAM and util-linux

etc/login.defs:
Remove unused login.defs options, that are either irrelevant due to the
use of PAM or because the util-linux version of a binary does not
support them.
Modify all options that are ignored when using PAM, but are supported by
util-linux.

Removed options because they are part of PAMDEFS (options in PAMDEFS are
options silently ignored by shadow when built with PAM enabled):
* CHFN_AUTH
* CRACKLIB_DICTPATH
* ENV_HZ
* ENVIRON_FILE
* ENV_TZ
* FAILLOG_ENAB
* FTMP_FILE
* ISSUE_FILE
* LASTLOG_ENAB
* LOGIN_STRING
* MAIL_CHECK_ENAB
* NOLOGINS_FILE
* OBSCURE_CHECKS_ENAB
* PASS_ALWAYS_WARN
* PASS_CHANGE_TRIES
* PASS_MAX_LEN
* PASS_MIN_LEN
* PORTTIME_CHECKS_ENAB
* QUOTAS_ENAB
* SU_WHEEL_ONLY
* SYSLOG_SU_ENAB
* ULIMIT

Removed options because they are not availablbe with PAM enabled:
* BCRYPT_MIN_ROUNDS
* BCRYPT_MAX_ROUNDS
* CONSOLE_GROUPS
* CONSOLE
* MD5_CRYPT_ENAB
* PREVENT_NO_AUTH

Removed encryption methods (`ENCRYPT_METHOD`), because they are unsafe
or not available with PAM:
* BCRYPT
* MD5

Removed options because they are not supported by login from util-linux:
* ERASECHAR
* KILLCHAR
* LOG_OK_LOGINS
* TTYTYPE_FILE

Removed options because they are not supported by su from util-linux:
* SULOG_FILE
* SU_NAME

Adapted options because they are in PAMDEFS but are supported by login
from util-linux:
* MOTD_FILE

man/login.defs.5.xml:
Remove unavailable options from man 5 login.defs.
---
 etc/login.defs       | 223 +------------------------------------------
 man/login.defs.5.xml | 148 +---------------------------
 2 files changed, 8 insertions(+), 363 deletions(-)

diff --git a/etc/login.defs b/etc/login.defs
index 33622c29..797ca6b3 100644
--- a/etc/login.defs
+++ b/etc/login.defs
@@ -3,6 +3,8 @@
 #
 #	$Id$
 #
+# NOTE: This file is adapted for the use on Arch Linux!
+#       Unsupported options due to the use of util-linux or PAM are removed.
 
 #
 # Delay in seconds before being allowed another attempt after a login failure
@@ -11,26 +13,11 @@
 #
 FAIL_DELAY		3
 
-#
-# Enable logging and display of /var/log/faillog login(1) failure info.
-#
-FAILLOG_ENAB		yes
-
 #
 # Enable display of unknown usernames when login(1) failures are recorded.
 #
 LOG_UNKFAIL_ENAB	no
 
-#
-# Enable logging of successful logins
-#
-LOG_OK_LOGINS		no
-
-#
-# Enable logging and display of /var/log/lastlog login(1) time info.
-#
-LASTLOG_ENAB		yes
-
 #
 # Limit the highest user ID number for which the lastlog entries should
 # be updated.
@@ -40,88 +27,13 @@ LASTLOG_ENAB		yes
 #
 #LASTLOG_UID_MAX
 
-#
-# Enable checking and display of mailbox status upon login.
-#
-# Disable if the shell startup files already check for mail
-# ("mailx -e" or equivalent).
-#
-MAIL_CHECK_ENAB		yes
-
-#
-# Enable additional checks upon password changes.
-#
-OBSCURE_CHECKS_ENAB	yes
-
-#
-# Enable checking of time restrictions specified in /etc/porttime.
-#
-PORTTIME_CHECKS_ENAB	yes
-
-#
-# Enable setting of ulimit, umask, and niceness from passwd(5) gecos field.
-#
-QUOTAS_ENAB		yes
-
-#
-# Enable "syslog" logging of su(1) activity - in addition to sulog file logging.
-# SYSLOG_SG_ENAB does the same for newgrp(1) and sg(1).
-#
-SYSLOG_SU_ENAB		yes
-SYSLOG_SG_ENAB		yes
-
-#
-# If defined, either full pathname of a file containing device names or
-# a ":" delimited list of device names.  Root logins will be allowed only
-# from these devices.
-#
-CONSOLE		/etc/securetty
-#CONSOLE	console:tty01:tty02:tty03:tty04
-
-#
-# If defined, all su(1) activity is logged to this file.
-#
-#SULOG_FILE	/var/log/sulog
-
 #
 # If defined, ":" delimited list of "message of the day" files to
 # be displayed upon login.
 #
-MOTD_FILE	/etc/motd
+MOTD_FILE
 #MOTD_FILE	/etc/motd:/usr/lib/news/news-motd
 
-#
-# If defined, this file will be output before each login(1) prompt.
-#
-#ISSUE_FILE	/etc/issue
-
-#
-# If defined, file which maps tty line to TERM environment parameter.
-# Each line of the file is in a format similar to "vt100  tty01".
-#
-#TTYTYPE_FILE	/etc/ttytype
-
-#
-# If defined, login(1) failures will be logged here in a utmp format.
-# last(1), when invoked as lastb(1), will read /var/log/btmp, so...
-#
-FTMP_FILE	/var/log/btmp
-
-#
-# If defined, name of file whose presence will inhibit non-root
-# logins.  The content of this file should be a message indicating
-# why logins are inhibited.
-#
-NOLOGINS_FILE	/etc/nologin
-
-#
-# If defined, the command name to display when running "su -".  For
-# example, if this is defined as "su" then ps(1) will display the
-# command as "-su".  If not defined, then ps(1) will display the
-# name of the shell actually being run, e.g. something like "-sh".
-#
-SU_NAME		su
-
 #
 # *REQUIRED*
 #   Directory where mailboxes reside, _or_ name of file, relative to the
@@ -139,21 +51,6 @@ MAIL_DIR	/var/spool/mail
 HUSHLOGIN_FILE	.hushlogin
 #HUSHLOGIN_FILE	/etc/hushlogins
 
-#
-# If defined, either a TZ environment parameter spec or the
-# fully-rooted pathname of a file containing such a spec.
-#
-#ENV_TZ		TZ=CST6CDT
-#ENV_TZ		/etc/tzname
-
-#
-# If defined, an HZ environment parameter spec.
-#
-# for Linux/x86
-ENV_HZ		HZ=100
-# For Linux/Alpha...
-#ENV_HZ		HZ=1024
-
 #
 # *REQUIRED*  The default PATH settings, for superuser and normal users.
 #
@@ -175,23 +72,6 @@ ENV_PATH	PATH=/bin:/usr/bin
 TTYGROUP	tty
 TTYPERM		0600
 
-#
-# Login configuration initializations:
-#
-#	ERASECHAR	Terminal ERASE character ('\010' = backspace).
-#	KILLCHAR	Terminal KILL character ('\025' = CTRL/U).
-#	ULIMIT		Default "ulimit" value.
-#
-# The ERASECHAR and KILLCHAR are used only on System V machines.
-# The ULIMIT is used only if the system supports it.
-# (now it works with setrlimit too; ulimit is in 512-byte units)
-#
-# Prefix these values with "0" to get octal, "0x" to get hexadecimal.
-#
-ERASECHAR	0177
-KILLCHAR	025
-#ULIMIT		2097152
-
 # Default initial "umask" value used by login(1) on non-PAM enabled systems.
 # Default "umask" value for pam_umask(8) on PAM enabled systems.
 # UMASK is also used by useradd(8) and newusers(8) to set the mode for new
@@ -211,22 +91,12 @@ UMASK		022
 #
 #	PASS_MAX_DAYS	Maximum number of days a password may be used.
 #	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
-#	PASS_MIN_LEN	Minimum acceptable password length.
 #	PASS_WARN_AGE	Number of days warning given before a password expires.
 #
 PASS_MAX_DAYS	99999
 PASS_MIN_DAYS	0
-PASS_MIN_LEN	5
 PASS_WARN_AGE	7
 
-#
-# If "yes", the user must be listed as a member of the first gid 0 group
-# in /etc/group (called "root" on most Linux systems) to be able to "su"
-# to uid 0 accounts.  If the group doesn't exist or is empty, no one
-# will be able to "su" to uid 0.
-#
-SU_WHEEL_ONLY	no
-
 #
 # Min/max values for automatic uid selection in useradd(8)
 #
@@ -263,28 +133,6 @@ LOGIN_RETRIES		5
 #
 LOGIN_TIMEOUT		60
 
-#
-# Maximum number of attempts to change password if rejected (too easy)
-#
-PASS_CHANGE_TRIES	5
-
-#
-# Warn about weak passwords (but still allow them) if you are root.
-#
-PASS_ALWAYS_WARN	yes
-
-#
-# Number of significant characters in the password for crypt().
-# Default is 8, don't change unless your crypt() is better.
-# Ignored if MD5_CRYPT_ENAB set to "yes".
-#
-#PASS_MAX_LEN		8
-
-#
-# Require password before chfn(1)/chsh(1) can make any changes.
-#
-CHFN_AUTH		yes
-
 #
 # Which fields may be changed by regular users using chfn(1) - use
 # any combination of letters "frwh" (full name, room number, work
@@ -293,38 +141,13 @@ CHFN_AUTH		yes
 #
 CHFN_RESTRICT		rwh
 
-#
-# Password prompt (%s will be replaced by user name).
-#
-# XXX - it doesn't work correctly yet, for now leave it commented out
-# to use the default which is just "Password: ".
-#LOGIN_STRING		"%s's Password: "
-
-#
-# Only works if compiled with MD5_CRYPT defined:
-# If set to "yes", new passwords will be encrypted using the MD5-based
-# algorithm compatible with the one used by recent releases of FreeBSD.
-# It supports passwords of unlimited length and longer salt strings.
-# Set to "no" if you need to copy encrypted passwords to other systems
-# which don't understand the new algorithm.  Default is "no".
-#
-# Note: If you use PAM, it is recommended to use a value consistent with
-# the PAM modules configuration.
-#
-# This variable is deprecated. You should use ENCRYPT_METHOD instead.
-#
-#MD5_CRYPT_ENAB	no
-
 #
 # Only works if compiled with ENCRYPTMETHOD_SELECT defined:
-# If set to MD5, MD5-based algorithm will be used for encrypting password
 # If set to SHA256, SHA256-based algorithm will be used for encrypting password
 # If set to SHA512, SHA512-based algorithm will be used for encrypting password
-# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
 # If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password
 # If set to DES, DES-based algorithm will be used for encrypting password (default)
 # MD5 and DES should not be used for new hashes, see crypt(5) for recommendations.
-# Overrides the MD5_CRYPT_ENAB option
 #
 # Note: If you use PAM, it is recommended to use a value consistent with
 # the PAM modules configuration.
@@ -348,21 +171,6 @@ CHFN_RESTRICT		rwh
 #SHA_CRYPT_MIN_ROUNDS 5000
 #SHA_CRYPT_MAX_ROUNDS 5000
 
-#
-# Only works if ENCRYPT_METHOD is set to BCRYPT.
-#
-# Define the number of BCRYPT rounds.
-# With a lot of rounds, it is more difficult to brute-force the password.
-# However, more CPU resources will be needed to authenticate users if
-# this value is increased.
-#
-# If not specified, 13 rounds will be attempted.
-# If only one of the MIN or MAX values is set, then this value will be used.
-# If MIN > MAX, the highest value will be used.
-#
-#BCRYPT_MIN_ROUNDS 13
-#BCRYPT_MAX_ROUNDS 13
-
 #
 # Only works if ENCRYPT_METHOD is set to YESCRYPT.
 #
@@ -376,17 +184,6 @@ CHFN_RESTRICT		rwh
 #
 #YESCRYPT_COST_FACTOR 5
 
-#
-# List of groups to add to the user's supplementary group set
-# when logging in from the console (as determined by the CONSOLE
-# setting).  Default is none.
-#
-# Use with caution - it is possible for users to gain permanent
-# access to these groups, even when not logged in from the console.
-# How to do it is left as an exercise for the reader...
-#
-#CONSOLE_GROUPS		floppy:audio:cdrom
-
 #
 # Should login be allowed if we can't cd to the home directory?
 # Default is no.
@@ -401,12 +198,6 @@ DEFAULT_HOME	yes
 #
 NONEXISTENT	/nonexistent
 
-#
-# If this file exists and is readable, login environment will be
-# read from it.  Every line should be in the form name=value.
-#
-ENVIRON_FILE	/etc/environment
-
 #
 # If defined, this command is run when removing a user.
 # It should remove any at/cron/print jobs etc. owned by
@@ -454,14 +245,6 @@ USERGROUPS_ENAB yes
 #
 #GRANT_AUX_GROUP_SUBIDS yes
 
-#
-# Prevents an empty password field to be interpreted as "no authentication
-# required".
-# Set to "yes" to prevent for all accounts
-# Set to "superuser" to prevent for UID 0 / root (default)
-# Set to "no" to not prevent for any account (dangerous, historical default)
-PREVENT_NO_AUTH superuser
-
 #
 # Select the HMAC cryptography algorithm.
 # Used in pam_timestamp module to calculate the keyed-hash message
diff --git a/man/login.defs.5.xml b/man/login.defs.5.xml
index 05ef5125..1ddf537e 100644
--- a/man/login.defs.5.xml
+++ b/man/login.defs.5.xml
@@ -7,70 +7,38 @@
 -->
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.5//EN" 
   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-<!ENTITY BCRYPT_MIN_ROUNDS     SYSTEM "login.defs.d/BCRYPT_MIN_ROUNDS.xml">
-<!ENTITY CHFN_AUTH             SYSTEM "login.defs.d/CHFN_AUTH.xml">
 <!ENTITY CHFN_RESTRICT         SYSTEM "login.defs.d/CHFN_RESTRICT.xml">
-<!ENTITY CHSH_AUTH             SYSTEM "login.defs.d/CHSH_AUTH.xml">
-<!ENTITY CONSOLE               SYSTEM "login.defs.d/CONSOLE.xml">
-<!ENTITY CONSOLE_GROUPS        SYSTEM "login.defs.d/CONSOLE_GROUPS.xml">
 <!ENTITY CREATE_HOME           SYSTEM "login.defs.d/CREATE_HOME.xml">
 <!ENTITY DEFAULT_HOME          SYSTEM "login.defs.d/DEFAULT_HOME.xml">
 <!ENTITY ENCRYPT_METHOD        SYSTEM "login.defs.d/ENCRYPT_METHOD.xml">
-<!ENTITY ENV_HZ                SYSTEM "login.defs.d/ENV_HZ.xml">
 <!ENTITY ENV_PATH              SYSTEM "login.defs.d/ENV_PATH.xml">
 <!ENTITY ENV_SUPATH            SYSTEM "login.defs.d/ENV_SUPATH.xml">
-<!ENTITY ENV_TZ                SYSTEM "login.defs.d/ENV_TZ.xml">
-<!ENTITY ENVIRON_FILE          SYSTEM "login.defs.d/ENVIRON_FILE.xml">
-<!ENTITY ERASECHAR             SYSTEM "login.defs.d/ERASECHAR.xml">
 <!ENTITY FAIL_DELAY            SYSTEM "login.defs.d/FAIL_DELAY.xml">
-<!ENTITY FAILLOG_ENAB          SYSTEM "login.defs.d/FAILLOG_ENAB.xml">
-<!ENTITY FAKE_SHELL            SYSTEM "login.defs.d/FAKE_SHELL.xml">
-<!ENTITY FTMP_FILE             SYSTEM "login.defs.d/FTMP_FILE.xml">
 <!ENTITY GID_MAX               SYSTEM "login.defs.d/GID_MAX.xml">
 <!ENTITY HMAC_CRYPTO_ALGO      SYSTEM "login.defs.d/HMAC_CRYPTO_ALGO.xml">
 <!ENTITY HOME_MODE             SYSTEM "login.defs.d/HOME_MODE.xml">
 <!ENTITY HUSHLOGIN_FILE        SYSTEM "login.defs.d/HUSHLOGIN_FILE.xml">
-<!ENTITY ISSUE_FILE            SYSTEM "login.defs.d/ISSUE_FILE.xml">
-<!ENTITY KILLCHAR              SYSTEM "login.defs.d/KILLCHAR.xml">
-<!ENTITY LASTLOG_ENAB          SYSTEM "login.defs.d/LASTLOG_ENAB.xml">
 <!ENTITY LASTLOG_UID_MAX       SYSTEM "login.defs.d/LASTLOG_UID_MAX.xml">
-<!ENTITY LOG_OK_LOGINS         SYSTEM "login.defs.d/LOG_OK_LOGINS.xml">
 <!ENTITY LOG_UNKFAIL_ENAB      SYSTEM "login.defs.d/LOG_UNKFAIL_ENAB.xml">
 <!ENTITY LOGIN_RETRIES         SYSTEM "login.defs.d/LOGIN_RETRIES.xml">
-<!ENTITY LOGIN_STRING          SYSTEM "login.defs.d/LOGIN_STRING.xml">
 <!ENTITY LOGIN_TIMEOUT         SYSTEM "login.defs.d/LOGIN_TIMEOUT.xml">
-<!ENTITY MAIL_CHECK_ENAB       SYSTEM "login.defs.d/MAIL_CHECK_ENAB.xml">
 <!ENTITY MAIL_DIR              SYSTEM "login.defs.d/MAIL_DIR.xml">
 <!ENTITY MAX_MEMBERS_PER_GROUP SYSTEM "login.defs.d/MAX_MEMBERS_PER_GROUP.xml">
-<!ENTITY MD5_CRYPT_ENAB        SYSTEM "login.defs.d/MD5_CRYPT_ENAB.xml">
 <!ENTITY MOTD_FILE             SYSTEM "login.defs.d/MOTD_FILE.xml">
-<!ENTITY NOLOGINS_FILE         SYSTEM "login.defs.d/NOLOGINS_FILE.xml">
 <!ENTITY NONEXISTENT           SYSTEM "login.defs.d/NONEXISTENT.xml">
-<!ENTITY OBSCURE_CHECKS_ENAB   SYSTEM "login.defs.d/OBSCURE_CHECKS_ENAB.xml">
-<!ENTITY PASS_ALWAYS_WARN      SYSTEM "login.defs.d/PASS_ALWAYS_WARN.xml">
-<!ENTITY PASS_CHANGE_TRIES     SYSTEM "login.defs.d/PASS_CHANGE_TRIES.xml">
-<!ENTITY PASS_MAX_LEN          SYSTEM "login.defs.d/PASS_MAX_LEN.xml">
 <!ENTITY PASS_MAX_DAYS         SYSTEM "login.defs.d/PASS_MAX_DAYS.xml">
 <!ENTITY PASS_MIN_DAYS         SYSTEM "login.defs.d/PASS_MIN_DAYS.xml">
 <!ENTITY PASS_WARN_AGE         SYSTEM "login.defs.d/PASS_WARN_AGE.xml">
-<!ENTITY PORTTIME_CHECKS_ENAB  SYSTEM "login.defs.d/PORTTIME_CHECKS_ENAB.xml">
-<!ENTITY QUOTAS_ENAB           SYSTEM "login.defs.d/QUOTAS_ENAB.xml">
 <!ENTITY SHA_CRYPT_MIN_ROUNDS  SYSTEM "login.defs.d/SHA_CRYPT_MIN_ROUNDS.xml">
-<!ENTITY SULOG_FILE            SYSTEM "login.defs.d/SULOG_FILE.xml">
-<!ENTITY SU_NAME               SYSTEM "login.defs.d/SU_NAME.xml">
-<!ENTITY SU_WHEEL_ONLY         SYSTEM "login.defs.d/SU_WHEEL_ONLY.xml">
 <!ENTITY SUB_GID_COUNT         SYSTEM "login.defs.d/SUB_GID_COUNT.xml">
 <!ENTITY SUB_UID_COUNT         SYSTEM "login.defs.d/SUB_UID_COUNT.xml">
 <!ENTITY SYS_GID_MAX           SYSTEM "login.defs.d/SYS_GID_MAX.xml">
 <!ENTITY SYSLOG_SG_ENAB        SYSTEM "login.defs.d/SYSLOG_SG_ENAB.xml">
-<!ENTITY SYSLOG_SU_ENAB        SYSTEM "login.defs.d/SYSLOG_SU_ENAB.xml">
 <!ENTITY SYS_UID_MAX           SYSTEM "login.defs.d/SYS_UID_MAX.xml">
 <!ENTITY TCB_AUTH_GROUP        SYSTEM "login.defs.d/TCB_AUTH_GROUP.xml">
 <!ENTITY TCB_SYMLINKS          SYSTEM "login.defs.d/TCB_SYMLINKS.xml">
 <!ENTITY TTYGROUP              SYSTEM "login.defs.d/TTYGROUP.xml">
-<!ENTITY TTYTYPE_FILE          SYSTEM "login.defs.d/TTYTYPE_FILE.xml">
 <!ENTITY UID_MAX               SYSTEM "login.defs.d/UID_MAX.xml">
-<!ENTITY ULIMIT                SYSTEM "login.defs.d/ULIMIT.xml">
 <!ENTITY UMASK                 SYSTEM "login.defs.d/UMASK.xml">
 <!ENTITY USERDEL_CMD           SYSTEM "login.defs.d/USERDEL_CMD.xml">
 <!ENTITY USERGROUPS_ENAB       SYSTEM "login.defs.d/USERGROUPS_ENAB.xml">
@@ -147,48 +115,25 @@
     <para>The following configuration items are provided:</para>
 
     <variablelist remap='IP'>
-      &BCRYPT_MIN_ROUNDS; <!-- documents also BCRYPT_MAX_ROUNDS -->
-      &CHFN_AUTH;
       &CHFN_RESTRICT;
-      &CHSH_AUTH;
-      &CONSOLE;
-      &CONSOLE_GROUPS;
       &CREATE_HOME;
       &DEFAULT_HOME;
       &ENCRYPT_METHOD;
-      &ENV_HZ;
       &ENV_PATH;
       &ENV_SUPATH;
-      &ENV_TZ;
-      &ENVIRON_FILE;
-      &ERASECHAR;
       &FAIL_DELAY;
-      &FAILLOG_ENAB;
-      &FAKE_SHELL;
-      &FTMP_FILE;
       &GID_MAX; <!-- documents also GID_MIN -->
       &HMAC_CRYPTO_ALGO;
       &HOME_MODE;
       &HUSHLOGIN_FILE;
-      &ISSUE_FILE;
-      &KILLCHAR;
-      &LASTLOG_ENAB;
       &LASTLOG_UID_MAX;
-      &LOG_OK_LOGINS;
       &LOG_UNKFAIL_ENAB;
       &LOGIN_RETRIES;
-      &LOGIN_STRING;
       &LOGIN_TIMEOUT;
-      &MAIL_CHECK_ENAB;
       &MAIL_DIR;
       &MAX_MEMBERS_PER_GROUP;
-      &MD5_CRYPT_ENAB;
       &MOTD_FILE;
-      &NOLOGINS_FILE;
       &NONEXISTENT;
-      &OBSCURE_CHECKS_ENAB;
-      &PASS_ALWAYS_WARN;
-      &PASS_CHANGE_TRIES;
       &PASS_MAX_DAYS;
       &PASS_MIN_DAYS;
       &PASS_WARN_AGE;
@@ -198,25 +143,16 @@
         time of account creation. Any changes to these settings won't affect
         existing accounts.
       </para>
-      &PASS_MAX_LEN; <!-- documents also PASS_MIN_LEN -->
-      &PORTTIME_CHECKS_ENAB;
-      &QUOTAS_ENAB;
       &SHA_CRYPT_MIN_ROUNDS; <!-- documents also SHA_CRYPT_MAX_ROUNDS -->
-      &SULOG_FILE;
-      &SU_NAME;
-      &SU_WHEEL_ONLY;
       &SUB_GID_COUNT; <!-- documents also SUB_GID_MIN SUB_GID_MAX -->
       &SUB_UID_COUNT; <!-- documents also SUB_UID_MIN SUB_UID_MAX -->
       &SYS_GID_MAX; <!-- documents also SYS_GID_MIN -->
       &SYS_UID_MAX; <!-- documents also SYS_UID_MIN -->
       &SYSLOG_SG_ENAB;
-      &SYSLOG_SU_ENAB;
       &TCB_AUTH_GROUP;
       &TCB_SYMLINKS;
       &TTYGROUP;
-      &TTYTYPE_FILE;
       &UID_MAX; <!-- documents also UID_MIN -->
-      &ULIMIT;
       &UMASK;
       &USERDEL_CMD;
       &USERGROUPS_ENAB;
@@ -255,7 +191,7 @@
 	  <para>
 	    <phrase condition="bcrypt">BCRYPT_MAX_ROUNDS
 	    BCRYPT_MIN_ROUNDS</phrase>
-	    ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB
+	    ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP
 	    <phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
 	    SHA_CRYPT_MIN_ROUNDS</phrase>
 	    <phrase condition="yescrypt">YESCRYPT_COST_FACTOR</phrase>
@@ -280,7 +216,7 @@
 	<term>chsh</term>
 	<listitem>
 	  <para>
-	    CHSH_AUTH LOGIN_STRING
+	    CHSH_AUTH
 	  </para>
 	</listitem>
       </varlistentry>
@@ -292,7 +228,7 @@
 	  <para>
 	    <phrase condition="bcrypt">BCRYPT_MAX_ROUNDS
 	    BCRYPT_MIN_ROUNDS</phrase>
-	    ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB
+	    ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP
 	    <phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
 	    SHA_CRYPT_MIN_ROUNDS</phrase>
 	    <phrase condition="yescrypt">YESCRYPT_COST_FACTOR</phrase>
@@ -352,35 +288,6 @@
 	  <para>LASTLOG_UID_MAX</para>
 	</listitem>
       </varlistentry>
-      <varlistentry>
-	<term>login</term>
-	<listitem>
-	  <para>
-	    <phrase condition="no_pam">CONSOLE</phrase>
-	    CONSOLE_GROUPS DEFAULT_HOME
-	    <phrase condition="no_pam">ENV_HZ ENV_PATH ENV_SUPATH
-	    ENV_TZ ENVIRON_FILE</phrase>
-	    ERASECHAR FAIL_DELAY
-	    <phrase condition="no_pam">FAILLOG_ENAB</phrase>
-	    FAKE_SHELL
-	    <phrase condition="no_pam">FTMP_FILE</phrase>
-	    HUSHLOGIN_FILE
-	    <phrase condition="no_pam">ISSUE_FILE</phrase>
-	    KILLCHAR
-	    <phrase condition="no_pam">LASTLOG_ENAB LASTLOG_UID_MAX</phrase>
-	    LOGIN_RETRIES
-	    <phrase condition="no_pam">LOGIN_STRING</phrase>
-	    LOGIN_TIMEOUT LOG_OK_LOGINS LOG_UNKFAIL_ENAB
-	    <phrase condition="no_pam">MAIL_CHECK_ENAB MAIL_DIR MAIL_FILE
-	    MOTD_FILE NOLOGINS_FILE PORTTIME_CHECKS_ENAB
-	    QUOTAS_ENAB</phrase>
-	    TTYGROUP TTYPERM TTYTYPE_FILE
-	    <phrase condition="no_pam">ULIMIT UMASK</phrase>
-	    USERGROUPS_ENAB
-	  </para>
-	</listitem>
-      </varlistentry>
-      <!-- logoutd: no variables -->
       <varlistentry>
 	<term>newgrp / sg</term>
 	<listitem>
@@ -397,7 +304,7 @@
 	    BCRYPT_MIN_ROUNDS</phrase>
 	    ENCRYPT_METHOD
 	    GID_MAX GID_MIN
-	    MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB
+	    MAX_MEMBERS_PER_GROUP
 	    HOME_MODE
 	    PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE
 	    <phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
@@ -417,8 +324,7 @@
 	  <para>
 	    <phrase condition="bcrypt">BCRYPT_MAX_ROUNDS
 	    BCRYPT_MIN_ROUNDS</phrase>
-	    ENCRYPT_METHOD MD5_CRYPT_ENAB OBSCURE_CHECKS_ENAB
-	    PASS_ALWAYS_WARN PASS_CHANGE_TRIES PASS_MAX_LEN PASS_MIN_LEN
+	    ENCRYPT_METHOD
 	    <phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
 	    SHA_CRYPT_MIN_ROUNDS</phrase>
 	    <phrase condition="yescrypt">YESCRYPT_COST_FACTOR</phrase>
@@ -451,32 +357,6 @@
 	  </para>
 	</listitem>
       </varlistentry>
-      <varlistentry>
-	<term>su</term>
-	<listitem>
-	  <para>
-	    <phrase condition="no_pam">CONSOLE</phrase>
-	    CONSOLE_GROUPS DEFAULT_HOME
-	    <phrase condition="no_pam">ENV_HZ ENVIRON_FILE</phrase>
-	    ENV_PATH ENV_SUPATH
-	    <phrase condition="no_pam">ENV_TZ LOGIN_STRING MAIL_CHECK_ENAB
-	    MAIL_DIR MAIL_FILE QUOTAS_ENAB</phrase>
-	    SULOG_FILE SU_NAME
-	    <phrase condition="no_pam">SU_WHEEL_ONLY</phrase>
-	    SYSLOG_SU_ENAB
-	    <phrase condition="no_pam">USERGROUPS_ENAB</phrase>
-	  </para>
-	</listitem>
-      </varlistentry>
-      <varlistentry condition="no_pam">
-	<term>sulogin</term>
-	<listitem>
-	  <para>
-	    ENV_HZ
-	    ENV_TZ
-	  </para>
-	</listitem>
-      </varlistentry>
       <varlistentry>
 	<term>useradd</term>
 	<listitem>
@@ -505,24 +385,6 @@
 	  </para>
 	</listitem>
       </varlistentry>
-      <varlistentry>
-	<term>usermod</term>
-	<listitem>
-	  <para>
-	    LASTLOG_UID_MAX
-	    MAIL_DIR MAIL_FILE MAX_MEMBERS_PER_GROUP
-	    <phrase condition="tcb">TCB_SYMLINKS USE_TCB</phrase>
-	  </para>
-	</listitem>
-      </varlistentry>
-      <varlistentry condition="tcb">
-	<term>vipw</term>
-	<listitem>
-	  <para>
-	    <phrase condition="tcb">USE_TCB</phrase>
-	  </para>
-	</listitem>
-      </varlistentry>
     </variablelist>
   </refsect1>
 
-- 
2.44.0