Serge Hallyn
GitHub
commit
8f2f2a0d9d
142
NEWS
142
NEWS
@ -654,9 +654,9 @@ shadow-4.0.18.2 -> shadow-4.1.0 09-12-2007
|
||||
- Use MD5_CRYPT_ENAB, ENCRYPT_METHOD, SHA_CRYPT_MIN_ROUNDS, and
|
||||
SHA_CRYPT_MAX_ROUNDS to define the default encryption algorithm for the
|
||||
passwords.
|
||||
- chpaswd, chgpasswd, newusers: New options -c/--crypt-method and
|
||||
- chpasswd, chgpasswd, newusers: New options -c/--crypt-method and
|
||||
-s/--sha-rounds to supersede the system default encryption algorithm.
|
||||
- chpaswd, chgpasswd, newusers: DES is no more the default algorithm. They
|
||||
- chpasswd, chgpasswd, newusers: DES is no more the default algorithm. They
|
||||
will respect the system default configured in /etc/login.defs
|
||||
|
||||
*** documentation:
|
||||
@ -701,14 +701,14 @@ shadow-4.0.17 -> shadow-4.0.18 01-08-2006
|
||||
- groupadd, groupmod, useradd, usermod: fixed UID/GID overflow (fixed
|
||||
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198920)
|
||||
- passwd, useradd, usermod: fixed inactive/mindays/warndays/maxdays overflow
|
||||
(simillar to RH#198920),
|
||||
- groupmems: rewrited for use PAM and getopt_long() and now it is enabled
|
||||
(similar to RH#198920),
|
||||
- groupmems: rewritten for use PAM and getopt_long() and now it is enabled
|
||||
for build and install (patch by George Kraft <gk4@swbell.net>),
|
||||
- S/Key: removed assign getpass() to libshadow_getpass() on autoconf level
|
||||
(patch by Ulrich Mueller <ulm@kph.uni-mainz.de>; http://bugs.gentoo.org/139966),
|
||||
- usermod: back to previous -a option semantics and clarify -a behavior
|
||||
on documentation level (by Greg Schafer <gschafer@zip.com.au>),
|
||||
- chsh, groupmod: rewrited for use getopt_long().
|
||||
- chsh, groupmod: rewritten for use getopt_long().
|
||||
- updated translations: ca, cs, da, eu, fr, gl, hu, ko, pl, pt, ru, sv, tr, uk, vi.
|
||||
*** documentation:
|
||||
- fr and ru man pages are up to date,
|
||||
@ -743,7 +743,7 @@ shadow-4.0.15 -> shadow-4.0.16 05-06-2006
|
||||
|
||||
*** general:
|
||||
- userdel: better fix for old CERT VU#312962 (which was fixed in shadow 4.0.8):
|
||||
fixed forgoten checking of the return value from fchown() before
|
||||
fixed forgotten checking of the return value from fchown() before
|
||||
proceeding with the fchmod() (based on Owl patch prepared by
|
||||
Rafal Wojtczuk <nergal@owl.openwall.com>),
|
||||
- userdel: use login.defs::MAIL_DIR instead hardcoded /var/mail in created
|
||||
@ -755,7 +755,7 @@ shadow-4.0.15 -> shadow-4.0.16 05-06-2006
|
||||
passwords and libshadow_getpass() is used only because libc getpass()
|
||||
do not handles password prompting with echo enabled,
|
||||
- move login.defs::MD5_CRYPT_ENAB to non-PAM part,
|
||||
- userdel: rewrited for use getopt_log(),
|
||||
- userdel: rewritten for use getopt_log(),
|
||||
- install default/template configuration files:
|
||||
-- if shadow is configured with use PAM install /etc/pam.d/* files,
|
||||
-- if shadow do not uses PAM install /etc/{limits,login.acces} files,
|
||||
@ -793,7 +793,7 @@ shadow-4.0.15 -> shadow-4.0.16 05-06-2006
|
||||
- updated ru login.defs(5), passwd(1), userdel(8), usermod(8) man pages,
|
||||
- pw_auth(3) man page removed (outdated),
|
||||
- install limits(5), login.access(5) and porttime(5) man pages only when
|
||||
shadow is builded with PAM support disabled,
|
||||
shadow is built with PAM support disabled,
|
||||
- passwd(1): better document how password strength is checked
|
||||
(fixed http://bugs.debian.org/115380),
|
||||
- usermod(8): added missing -a option description
|
||||
@ -816,7 +816,7 @@ shadow-4.0.14 -> shadow-4.0.15 13-03-2006
|
||||
- login: default UMASK if not specified in login.defs is 022 (pointed by
|
||||
Peter Vrabec <pvrabec@redhat.com>),
|
||||
- chgpasswd: new tool (by Jonas Meurer <mejo@debian.org>),
|
||||
- lastlog: print the usage and exit if an additional argument is profided to
|
||||
- lastlog: print the usage and exit if an additional argument is provided to
|
||||
lastlog (merge 488_laslog_verify_arguments Debian patch),
|
||||
- login, newgrp, nologin, su: do not link with libselinux (merge
|
||||
490_link_selinux_only_when_needed Debian patch),
|
||||
@ -830,9 +830,9 @@ shadow-4.0.14 -> shadow-4.0.15 13-03-2006
|
||||
tries exceeded,
|
||||
- always prints the number of tries in the syslog entry.
|
||||
- add special handling for PAM_ABORT
|
||||
- add an entry to failog, as when USE_PAM is not defined. (#53164)
|
||||
- add an entry to faillog, as when USE_PAM is not defined. (#53164)
|
||||
- changed pam_end to PAM_END. This is certainly was a mistake. PAM_END is
|
||||
pam_close_seesion + pam_end. Here, the session is still not open, we
|
||||
pam_close_session + pam_end. Here, the session is still not open, we
|
||||
don't have to close it.
|
||||
- a HAVE_PAM_FAIL_DELAY is missing,
|
||||
- su: fixed pam session support (patch from Topi Miettinen; fixed #57526,
|
||||
@ -840,7 +840,7 @@ shadow-4.0.14 -> shadow-4.0.15 13-03-2006
|
||||
- userdel: user's group is already removed by update_groups().
|
||||
remove_group() is not needed (bug introduced in 4.0.14 on merge FC fixes).
|
||||
Fixed by Nicolas François <nicolas.francois@centraliens.net>,
|
||||
- useradd: allways remove group and gshadow databases lock, Fixed by Nicolas
|
||||
- useradd: always remove group and gshadow databases lock, Fixed by Nicolas
|
||||
François <nicolas.francois@centraliens.net>
|
||||
(http://bugs.debian.org/348250)
|
||||
- auditing fixes:
|
||||
@ -848,14 +848,14 @@ shadow-4.0.14 -> shadow-4.0.15 13-03-2006
|
||||
added audit_logger() prototype),
|
||||
- useradd: fixed excess audit_logger() argument,
|
||||
- chage: added missing \n on display password status if password must be
|
||||
chaged,
|
||||
changed,
|
||||
- useradd: fixed allow non-unique UID (http://bugs.debian.org/351281),
|
||||
- variouse code cleanups for make possible compilation of shadow with -Wall
|
||||
- various code cleanups for make possible compilation of shadow with -Wall
|
||||
-Werror (by Alexander Gattin <xrgtn@yandex.ru>),
|
||||
- su: move exit() outside libmisc/shell.c::shell() for handle shell() errors
|
||||
on higher level (now is better visable where some programs exit with 126
|
||||
and 127 exit codes); added new shell() parameter (char *const envp[])
|
||||
which allow fix preserving enviloment in su on using -p, (patch by
|
||||
which allow fix preserving enviroment in su on using -p, (patch by
|
||||
Alexander Gattin <xrgtn@yandex.ru>),
|
||||
- su: added handle -c,--command option for GNU su compliance (merge
|
||||
437_su_-c_option Debian patch),
|
||||
@ -903,7 +903,7 @@ shadow-4.0.13 -> shadow-4.0.14 03-01-2006
|
||||
- userdel: make the -f option force the removal of the user's group (even if it
|
||||
is the primary group of another user)
|
||||
(merge 453_userdel_-f_removes_group Debian patch),
|
||||
- usermod: rewrited for use getopt_long() (Christian Perrier <bubulle@kheops.frmug.org>),
|
||||
- usermod: rewritten for use getopt_long() (Christian Perrier <bubulle@kheops.frmug.org>),
|
||||
- grpck: fixed segmentation fault on using -s when /etc/gshadow is empty (fix by
|
||||
Tomasz Lemiech <szpajder@staszic.waw.pl>),
|
||||
- passwd: remove handle -f, -g and -s options.
|
||||
@ -912,7 +912,7 @@ shadow-4.0.13 -> shadow-4.0.14 03-01-2006
|
||||
Nicolas François <nicolas.francois@centraliens.net>)
|
||||
- su: export $USER and $SHELL as well as $HOME (http://bugs.debian.org/11003 and
|
||||
http://bugs.debian.org/11189),
|
||||
- su, vipw: rewrited for use getopt_long(),
|
||||
- su, vipw: rewritten for use getopt_long(),
|
||||
- su: log successful/failed through syslog (http://bugs.debian.org/190215),
|
||||
- updated translations: ca, cs, da, eu, fi, fr, it, pl, pt, ru, sv, tl, vi,
|
||||
- new translations: gl.
|
||||
@ -946,7 +946,7 @@ shadow-4.0.12 -> shadow-4.0.13 10-10-2005
|
||||
|
||||
*** general:
|
||||
- chage: removed duplicated pam_start(),
|
||||
- chfn, chsh: finished PAM support usin pam_start() and co.,
|
||||
- chfn, chsh: finished PAM support using pam_start() and co.,
|
||||
- userdel: userdel should not remove the group which is primary for someone else
|
||||
(fix by Nicolas François <nicolas.francois@centraliens.net>
|
||||
http://bugs.debian.org/295416),
|
||||
@ -955,7 +955,7 @@ shadow-4.0.12 -> shadow-4.0.13 10-10-2005
|
||||
- fixedlib/commonio.c: don't assume selinux is enabled if is_selinux_enabled()
|
||||
returns -1 (merge isSelinuxEnabled FC patch by Jeremy Katz <katzj@redhat.com>),
|
||||
- login, su (non-PAM case): fixed setup max address space limits (added missing break
|
||||
statement in case) spoted by Lasse Collin <lasse.collin@tukaani.org>,
|
||||
statement in case) spotted by Lasse Collin <lasse.collin@tukaani.org>,
|
||||
- auditing support added. Patch prepared by Peter Vrabec <pvrabec@redhat.com> basing
|
||||
on work by Steve Grubb from http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=159215
|
||||
Now auditing support have commands: chage, gpasswd, groupadd, groupdel, groupmod,
|
||||
@ -972,12 +972,12 @@ shadow-4.0.12 -> shadow-4.0.13 10-10-2005
|
||||
This will permit to adduser Debian script to detect if chage failed because the
|
||||
system doesn't have shadowed passwords (fix for http://bugs.debian.org/317012),
|
||||
- merge 010_more-i18ned-messages Debian patch which adds i18n support for few
|
||||
more messages (orginaly patch was prepared by Guillem Jover <guillem@debian.org>),
|
||||
more messages (originally patch was prepared by Guillem Jover <guillem@debian.org>),
|
||||
- lastlog: added handle -b option which allow print only lastlog records older than
|
||||
specified DAYS (fix by <miles@lubin.us>),
|
||||
- chpasswd, gpasswd, newusers: fixed libmisc/salt.c for use login.defs::MD5_CRYPT_ENAB
|
||||
only if PAM support is disabled (fix by John Gatewood Ham <zappaman@buraphalinux.org>),
|
||||
- passwd: rewrited for use getopt_long(),
|
||||
- passwd: rewritten for use getopt_long(),
|
||||
- newgrp: when newgrp process sits between parent and child shells, it should
|
||||
propagate STOPs from child to parent and CONTs from parent to child,
|
||||
otherwise e.g. bash's "suspend" command won't work
|
||||
@ -987,11 +987,11 @@ shadow-4.0.12 -> shadow-4.0.13 10-10-2005
|
||||
- chsh(1), groupadd(8), newusers(8), pwconv(8), useradd(8), userdel(8), usermod(8):
|
||||
added missing references to /etc/login.defs and login.defs(5)
|
||||
(Christian Perrier <bubulle@kheops.frmug.org>),
|
||||
- passwd(5): rewrited based on work by Greg Wooledge <greg@wooledge.org>
|
||||
- passwd(5): rewritten based on work by Greg Wooledge <greg@wooledge.org>
|
||||
http://bugs.debian.org/328113
|
||||
- login(1): added securetty(5) to SEE ALSO section
|
||||
(fixed Debian bug http://bugs.debian.org/325773),
|
||||
- groupadd(8), useradd(8): fix regular expression describing alloved login/group
|
||||
- groupadd(8), useradd(8): fix regular expression describing allowed login/group
|
||||
names (pointed by Nicolas François <nicolas.francois@centraliens.net>)
|
||||
(correct is [a-z_][a-z0-9_-]*[$]),
|
||||
- groupadd(8), useradd(8): documents in CAVEATS section the limitations shadow
|
||||
@ -1001,9 +1001,9 @@ shadow-4.0.12 -> shadow-4.0.13 10-10-2005
|
||||
shadow-4.0.11.1 -> shadow-4.0.12 22-08-2005
|
||||
|
||||
*** general:
|
||||
- newgrp, login: remove using login.defs::CLOSE_SESSIONS variable and allways
|
||||
- newgrp, login: remove using login.defs::CLOSE_SESSIONS variable and always
|
||||
close PAM session,
|
||||
- fixed configure.in: realy enable shadow group support by default (pointed by
|
||||
- fixed configure.in: really enable shadow group support by default (pointed by
|
||||
Greg Schafer <gschafer@zip.com.au> and Peter Vrabec <pvrabec@redhat.com>),
|
||||
- login.defs: removed handle QMAIL_DIR variable,
|
||||
- login: allow regular user to login on read-only root file system (not only for root)
|
||||
@ -1028,9 +1028,9 @@ shadow-4.0.11.1 -> shadow-4.0.12 22-08-2005
|
||||
period and permit brute-force attacks (fixed http://bugs.debian.org/288827),
|
||||
- uClibc fixes (by Martin Schlemmer <azarah@nosferatu.za.org>):
|
||||
added require ngettext (added [need-ngettext] to AM_GNU_GETTEXT() parameters)
|
||||
and stub prototype for ngettext() in lib/prototypes.h (neccessary if shadow
|
||||
and stub prototype for ngettext() in lib/prototypes.h (necessary if shadow
|
||||
compiled with disabled NLS support)
|
||||
- groupadd: rewrited for use getopt_long(),
|
||||
- groupadd: rewritten for use getopt_long(),
|
||||
- groupadd, groupdel, groupmod, userdel: do OPENLOG() before pam_start(),
|
||||
- groupadd: fixed double OPENLOG(),
|
||||
- removed lib/{grpack,gspack,pwpack,sppack}.c and prototypes from lib/prototypes.h
|
||||
@ -1066,7 +1066,7 @@ shadow-4.0.10 -> shadow-4.0.11 18-07-2005
|
||||
- su: ignore SIGINT while authenticating. A ^C could defeat the waiting period and
|
||||
permit brute-force attacks. Also ignore SIGQUIT.
|
||||
Fixed: http://bugs.debian.org/52372 and http://bugs.debian.org/288827
|
||||
- useradd: rewrited for use getopt_long(),
|
||||
- useradd: rewritten for use getopt_long(),
|
||||
- newgrp: add fix for handle splitted NIS groups: extends the functionality that,
|
||||
if the requested group is given, all groups of the same GID are tested for
|
||||
membership of the requesting user.
|
||||
@ -1097,7 +1097,7 @@ shadow-4.0.10 -> shadow-4.0.11 18-07-2005
|
||||
- updated translations: cs, da, de, es, fi, pl, pt, ro, ru, sk.
|
||||
*** documentation:
|
||||
- pwck(8): document -q option (based on Debian patch for fix http://bugs.debian.org/309408)
|
||||
- pwck(8): rewrited OPTIONS section and better SYNOPSIS,
|
||||
- pwck(8): rewritten OPTIONS section and better SYNOPSIS,
|
||||
- lastlog(8): document that lastlog is a sparse file, and don't need to be rotated
|
||||
http://bugs.debian.org/219321
|
||||
- login(8): better explain the respective roles of login, init and getty with regards
|
||||
@ -1111,12 +1111,12 @@ shadow-4.0.9 -> shadow-4.0.10 28-06-2005
|
||||
|
||||
*** general:
|
||||
- mkpasswd: removed,
|
||||
- userdel: now deletes user groups from /etc/gshdow as well as /etc/group.
|
||||
- userdel: now deletes user groups from /etc/gshadow as well as /etc/group.
|
||||
Fix by Nicolas François <nicolas.francois@centraliens.net>.
|
||||
http://bugs.debian.org/99442
|
||||
- usermod: when relocating a user's home directory, don't fail and remove the new
|
||||
home directory if we can't remove the old home directory for some
|
||||
reason; the results can be spectularly poort if, for instance, only
|
||||
reason; the results can be spectacularly poor if, for instance, only
|
||||
the rmdir() fails. Patch prepared by Timo Lindfors <lindi-spamtrap@newmail.com>.
|
||||
http://bugs.debian.org/166369
|
||||
- su: fix syslogs to be less ambiguous. Use old:new format instead of old-new
|
||||
@ -1124,7 +1124,7 @@ shadow-4.0.9 -> shadow-4.0.10 28-06-2005
|
||||
http://bugs.debian.org/213592
|
||||
- removed not used now libmisc/setup.c,
|
||||
- login: use also UTMPX API instead UTMP on failure (login was affected for this
|
||||
when shadow was builded without PAM support)
|
||||
when shadow was built without PAM support)
|
||||
patch by Nicolas François <nicolas.francois@centraliens.net>
|
||||
- login: the PAM session needs to be closed as root, thus before change_uid()
|
||||
http://bugs.debian.org/53570 http://bugs.debian.org/195048 http://bugs.debian.org/211884
|
||||
@ -1135,12 +1135,12 @@ shadow-4.0.9 -> shadow-4.0.10 28-06-2005
|
||||
http://bugs.debian.org/48002
|
||||
- login: fixed username on succesful login (was using the normal username,
|
||||
when it should have used pam_user) http://bugs.debian.org/47819
|
||||
- remove using SHADOWPWD #define so now shadow is allways builded with shadow
|
||||
passwowd support,
|
||||
- chage: rewrited for use getopt_long(),
|
||||
- remove using SHADOWPWD #define so now shadow is always built with shadow
|
||||
password support,
|
||||
- chage: rewritten for use getopt_long(),
|
||||
- updated translations: ca, cs, da, fi, pl, ru, zh_TW.
|
||||
*** documentation:
|
||||
- most of the man pages now are generated from XML files so in case submiting any
|
||||
- most of the man pages now are generated from XML files so in case submitting any
|
||||
chages to this resources please make diff to XML files,
|
||||
- chfn: give more details about the influence of login.defs on what's allowed to
|
||||
users.
|
||||
@ -1148,7 +1148,7 @@ shadow-4.0.9 -> shadow-4.0.10 28-06-2005
|
||||
shadow-4.0.8 -> shadow-4.0.9 23-05-2005
|
||||
|
||||
*** general:
|
||||
- passwd: fixed segfault in non-PAM connfiguration
|
||||
- passwd: fixed segfault in non-PAM configuration
|
||||
(submited by Greg Schafer <gschafer@zip.com.au>),
|
||||
- newgrp: fixed NULL pointer dereference - getlogin() and ttyname() can
|
||||
return NULL which is not checked (http://bugs.debian.org/162303),
|
||||
@ -1170,15 +1170,15 @@ shadow-4.0.7 -> shadow-4.0.8 26-04-2005
|
||||
- configure.in: add using AC_GNU_SOURCE macro for kill compilation warnings about
|
||||
implicit declaration of function `fseeko',
|
||||
- faillog: changed faillog record display format for allow fit in 80 columns all
|
||||
faillog atributies,
|
||||
faillog attributes,
|
||||
- removed NDBM code (unused),
|
||||
- fixed use of SU_WHEEL_ONLY in su. Now su realy is avalaible for wheel group
|
||||
- fixed use of SU_WHEEL_ONLY in su. Now su really is available for wheel group
|
||||
members. Thanks to Mike Frysinger <vapier@gentoo.org> for report:
|
||||
http://bugs.gentoo.org/show_bug.cgi?id=80345
|
||||
- drop never finished kerberos and des_rpc support (for kerberos support back firs
|
||||
must be prepared modularization),
|
||||
- fixed UTMP path detection (by Kelledin <kelledin@users.sf.net>),
|
||||
- useradd: rewrited group count to dynamic (by John Newbigin
|
||||
- useradd: rewritten group count to dynamic (by John Newbigin
|
||||
<jnewbigin@ict.swin.edu.au>),
|
||||
- login: fixed create lastlog entry fo users never loged in on non-PAM
|
||||
variant of login (fix by <oracular@ziplip.com>),
|
||||
@ -1193,7 +1193,7 @@ shadow-4.0.7 -> shadow-4.0.8 26-04-2005
|
||||
fchmod() is executed. (Actually, we could also pass the final "mode" to
|
||||
the open() call and then save the consequent fchmod().)
|
||||
- SELinux changes: added changes in chage, chfn, chsh, passwd for allow
|
||||
construct more grained user password/accuunt properties on SELinux
|
||||
construct more grained user password/account properties on SELinux
|
||||
policies level. Patch originally based on RH changes (submited by Chris
|
||||
PeBenito <pebenito@gentoo.org>),
|
||||
- added SELinux changes: in libmisc/copydir.c (based on Fedora patch),
|
||||
@ -1211,7 +1211,7 @@ shadow-4.0.7 -> shadow-4.0.8 26-04-2005
|
||||
- newgrp(1): fix #251926, #166173, #113191 Debian bugs: explain why editing /etc/group
|
||||
(without gshadow) doesn't permit to use newgrp,
|
||||
- newgrp(1): newgrp uses /bin/sh (not bash),
|
||||
- faillog(8): updated after rewrited faillog command for use getopt_long(),
|
||||
- faillog(8): updated after rewritten faillog command for use getopt_long(),
|
||||
- login(1): removed fragment about abilities pass enviroment variables in login prompt,
|
||||
- gshadow(5): new file (by Nicolas Nicolas François <nicolas.francois@centraliens.net>),
|
||||
- usermod(8): fixed #302388 Debian bug: added separated -o option description,
|
||||
@ -1229,24 +1229,24 @@ shadow-4.0.6 -> shadow-4.0.7 26-01-2005
|
||||
-- use fseeko() instead fseek() and remove casting file offsets to unsigned
|
||||
long.
|
||||
- lastlog:
|
||||
-- rewrited source code using the same style as in chpasswd.c,
|
||||
-- open lastlog file after finish parse comman line optiomns
|
||||
(now --help otput can be displayd for users without lastlog
|
||||
-- rewritten source code using the same style as in chpasswd.c,
|
||||
-- open lastlog file after finish parse commandline options
|
||||
(now --help output can be displayed for users without lastlog
|
||||
file read permission),
|
||||
-- cleanups in lastlog(8) man page using the same style as in
|
||||
chpasswd(8).
|
||||
- chpasswd:
|
||||
-- switch chpasswd to use getopt_long() and adds a --md5 option
|
||||
(by Ian Gulliver <ian@penguinhosting.net>),
|
||||
-- rewrited chpasswd(8) man page.
|
||||
-- rewritten chpasswd(8) man page.
|
||||
|
||||
shadow-4.0.5 -> shadow-4.0.6 08-11-2004
|
||||
|
||||
- su: fixed adding of pam_env env variables to enviroment
|
||||
(Martin Schlemmer <azarah@nosferatu.za.org>),
|
||||
- autoconf: fixed filling MAIL_SPOOL_DIR and MAIL_SPOOL_FILE variables
|
||||
which was allways empty (Gregorio Guidi <g.guidi@sns.it>),
|
||||
- realuy closse security bug in libmisc/pwdcheck.c,
|
||||
which was always empty (Gregorio Guidi <g.guidi@sns.it>),
|
||||
- really close security bug in libmisc/pwdcheck.c,
|
||||
- added missing template/example PAM service config files for chfn, chsh and
|
||||
userdel,
|
||||
- do not translate variable names from /etc/default/useradd during
|
||||
@ -1257,10 +1257,10 @@ shadow-4.0.4.1 -> shadow-4.0.5 27-10-2004
|
||||
- change libmisc to private static library,
|
||||
- added SELinux support (basing on patch from Gentoo),
|
||||
- chage: more verbose/human readable -l output. This output is much more
|
||||
beter for send directly via email for each users as message with account
|
||||
better for send directly via email for each users as message with account
|
||||
status (for example as message with warning about account/password expiration),
|
||||
- login: fixed handle -f option: now it works correctly without specify "-h
|
||||
<host>" if open login session localy is required (thanks for help
|
||||
<host>" if open login session locally is required (thanks for help
|
||||
investigate bug for Krzysztof Kotlenga),
|
||||
- userdel: when removing a user with userdel, userdel was always exits with 1 (fixed).
|
||||
Based on http://bugs.gentoo.org/show_bug.cgi?id=66687,
|
||||
@ -1274,7 +1274,7 @@ shadow-4.0.4.1 -> shadow-4.0.5 27-10-2004
|
||||
makes httpd Option SymlinkIfOwnerMatch break for default weg pages
|
||||
including symlinks placed into /etc/skel/public_html for example.
|
||||
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=66819
|
||||
- su: add pam_open_session() support. If builded without PAM support
|
||||
- su: add pam_open_session() support. If built without PAM support
|
||||
propagate $DISPLAY and $XAUTHORITY enviroment variables.
|
||||
Based on http://www.gentoo.org/cgi-bin/viewcvs.cgi/sys-apps/shadow/files/shadow-4.0.4.1-su-pam_open_session.patch?rev=1.1
|
||||
- applied 036_pam_access_with_preauth.patch Debian patch submited by Bjorn
|
||||
@ -1287,11 +1287,11 @@ shadow-4.0.4.1 -> shadow-4.0.5 27-10-2004
|
||||
Use constant strings rather than argv[0] for syslog ident in the user
|
||||
management commands,
|
||||
shadow-4.0.4.1-owl-tmp.diff:
|
||||
Remove using mktemp() if mkstemp() prototype not found (use allways mkstemp()),
|
||||
Remove using mktemp() if mkstemp() prototype not found (use always mkstemp()),
|
||||
shadow-4.0.4.1-owl-check-reads.diff:
|
||||
Add checking for read errors in commonio and vipw/vigr (not doing so could
|
||||
result in data loss when the records are written back),
|
||||
- fixed securirty bug in libmisc/pwdcheck.c which allow unauthorized
|
||||
- fixed security bug in libmisc/pwdcheck.c which allow unauthorized
|
||||
account properties modification.
|
||||
Affected tools: chfn and chsh.
|
||||
Bug was discovered by Martin Schulze <joey@infodrom.org>.
|
||||
@ -1307,12 +1307,12 @@ shadow-4.0.4.1 -> shadow-4.0.5 27-10-2004
|
||||
|
||||
shadow-4.0.4 => shadow-4.0.4.1 14-01-2004
|
||||
- bug fixes in automake files for generate correct tar ball on "make dist":
|
||||
added mising "EXTRA_DIST = $(man_MANS)" in man/*/Makefile.am.
|
||||
added missing "EXTRA_DIST = $(man_MANS)" in man/*/Makefile.am.
|
||||
|
||||
shadow-4.0.3 => shadow-4.0.4 14-01-2004
|
||||
|
||||
*** general:
|
||||
- added missing information about -f options in groupadd usage mesage
|
||||
- added missing information about -f options in groupadd usage message
|
||||
(document this also in man page),
|
||||
- removed TCFS support (tcfs is dead),
|
||||
- convert all po/*.po files to utf-8,
|
||||
@ -1320,7 +1320,7 @@ shadow-4.0.3 => shadow-4.0.4 14-01-2004
|
||||
per service flushing method instead HUPing nscd process),
|
||||
- removed old AUTH_METHODS dependent code,
|
||||
- chage: now all code depend on SHADOWPWD. If shadow will not be configured
|
||||
on autoconf level for using shadow possword chage is olny stub which
|
||||
on autoconf level for using shadow password chage is olny stub which
|
||||
informs "chage not configured for shadow password support."
|
||||
- dpasswd: removed,
|
||||
- login: remove handle login.defs::DIALUPS_CHECK_ENAB code,
|
||||
@ -1328,7 +1328,7 @@ shadow-4.0.3 => shadow-4.0.4 14-01-2004
|
||||
- ALL tools, libraries: remove old SVR4, SVR4_SI86_EUA BSD_QUOTA and ATT_AGE
|
||||
dependent code,
|
||||
- ALL: ready for gettext 0.11.5, automake 1.7.4, autoconf 2.57,
|
||||
- logoutd, userd: handle also utmpx if avalaile,
|
||||
- logoutd, userd: handle also utmpx if available,
|
||||
- newgrp: fix for non-PAM version
|
||||
Use CLOSE_SESSIONS depending code only when USE_PAM.
|
||||
The problem was reported by Mattias Webjorn Eriksson using Slackware
|
||||
@ -1356,7 +1356,7 @@ shadow-4.0.3 => shadow-4.0.4 14-01-2004
|
||||
|
||||
shadow-4.0.2 => shadow-4.0.3 13-03-2002
|
||||
|
||||
- added variouse cs, de, fr, id, it, ko man pages found mainly in national
|
||||
- added various cs, de, fr, id, it, ko man pages found mainly in national
|
||||
man pages translations projects (this documents are not synced with
|
||||
current en version but you know .. "Documentations is lik sex. When it is
|
||||
good it very very good. Whet it is bad it is better than nothing."). Any
|
||||
@ -1372,9 +1372,9 @@ shadow-4.0.2 => shadow-4.0.3 13-03-2002
|
||||
shadow-4.0.1 => shadow-4.0.2 17-02-2002
|
||||
|
||||
- resolve many fuzzy translations also all this which may cause problems on
|
||||
displaing long uid/gid,
|
||||
- allow use "$" on ending in cereated by useradd usermname accounts for allow
|
||||
create machine acounts for samba (thanks to Jerome Borsboom
|
||||
displaying long uid/gid,
|
||||
- allow use "$" on ending in created by useradd username accounts for allow
|
||||
create machine accounts for samba (thanks to Jerome Borsboom
|
||||
<borsboom@tch.fgg.eur.nl> for point this problem in 4.0.1),
|
||||
- fix small but ugly bug in configure.in in libpam_mics library detection.
|
||||
|
||||
@ -1394,7 +1394,7 @@ shadow-4.0.0 => shadow-4.0.1
|
||||
as root. If root does read-only, there's no lock needed. Added missing
|
||||
"#include <errno.h>" for above (me).
|
||||
shadow-4.0.0-owl-warnings.diff
|
||||
Olny one fix from this patch was aplayd because other was fixed few days
|
||||
Olny one fix from this patch was applied because other was fixed few days
|
||||
before :)
|
||||
shadow-4.0.0-owl-check_names.diff
|
||||
Merge only prat this patch with checking login name matching; checking
|
||||
@ -1402,7 +1402,7 @@ shadow-4.0.0 => shadow-4.0.1
|
||||
probably _POSIX_LOGIN_NAME_MAX from <bits/posix1_lim.h>,
|
||||
shadow-4.0.0-owl-chage-drop-priv.diff
|
||||
shadow-4.0.0-owl-pam-auth.diff
|
||||
Merge part with reorder initialize PAM and checkin is chage is runed by
|
||||
Merge part with reorder initialize PAM and checking if chage is runed by
|
||||
root or not - now chage can be runed from non-root account for checking
|
||||
by user own account information (if PAM enabled).
|
||||
- fixes for handle/print correctly 32bit uid/gid (Thorsten Kukuk <kukuk@suse.de>),
|
||||
@ -1446,30 +1446,30 @@ shadow-20001016 => shadow-4.0.0 06-01-2002
|
||||
- much better automake support,
|
||||
- added pt_BR man pages for gpasswd(1), groupadd(8), groupdel(8),
|
||||
groupmod(8), shadow(5) (man pages for other nations also are welcome),
|
||||
- mamny small fixes and updates nad improvements in man pages,
|
||||
- aplayed Debian patch to man pages for shadowconfig,
|
||||
- many small fixes and updates nad improvements in man pages,
|
||||
- applied Debian patch to man pages for shadowconfig,
|
||||
- remove limit to 6 chars logged tty name (012_libmisc_sulog.c.diff Debian
|
||||
patch).
|
||||
|
||||
shadow-20001012 -> shadow-20001016:
|
||||
- conditionaly disabled body reload_nscd() because not every
|
||||
- conditionally disabled body reload_nscd() because not every
|
||||
version of nscd can handle it (this can be enabled by define
|
||||
ENABLE_NSCD_SIGHUP) (Marek Michałkiewicz <marekm@linux.org.pl>)
|
||||
- fixes on autoconf/automake level for dist target,
|
||||
- Julianne F. Haugh new contact adress.
|
||||
- Julianne F. Haugh new contact address.
|
||||
|
||||
shadow-20000902 => shadow-20001012
|
||||
|
||||
- removed /redhat directory with obsoleted files (partialy rewrited spec
|
||||
- removed /redhat directory with obsoleted files (partially rewritten spec
|
||||
file is now in root directory),
|
||||
- aplayed shadow-19990827-group.patch patch from RH wich prevents adduser
|
||||
- applied shadow-19990827-group.patch patch from RH wich prevents adduser
|
||||
overwrite previously existing groups in adduser,
|
||||
- added PAM support for chage (bind to "chage" PAM config file) also
|
||||
added PAM support for all other small tools like chpasswd, groupadd,
|
||||
groupdel, groupmod, newusers, useradd, userdel, usermod (bind to common
|
||||
"shadow" PAM config file) - this modificaytions mainly based on
|
||||
"shadow" PAM config file) - this modifications mainly based on
|
||||
modifications prepared by Janek Rękojarski <baggins@pld.org.pl>,
|
||||
- many small fixes and improvments in automake (mow "make dist"
|
||||
- many small fixes and improvements in automake (mow "make dist"
|
||||
works correctly),
|
||||
- added cs translation (Jiri Pavlovsky <Jiri.Pavlovsky@ff.cuni.cz>).
|
||||
|
||||
|
||||
@ -567,7 +567,7 @@ if test "$with_libpam" = "yes"; then
|
||||
LIBS=$save_libs
|
||||
|
||||
AC_DEFINE(USE_PAM, 1, [Define to support Pluggable Authentication Modules])
|
||||
AC_DEFINE_UNQUOTED(SHADOW_PAM_CONVERSATION, [$pam_conv_function],[PAM converstation to use])
|
||||
AC_DEFINE_UNQUOTED(SHADOW_PAM_CONVERSATION, [$pam_conv_function],[PAM conversation to use])
|
||||
AM_CONDITIONAL(USE_PAM, [true])
|
||||
|
||||
AC_MSG_CHECKING(use login and su access checking if PAM not used)
|
||||
|
||||
@ -20,7 +20,7 @@
|
||||
** 1/28/95
|
||||
** shadow-adduser 1.3:
|
||||
**
|
||||
** Basically a bug-fix on my additions in 1.2. Thanx to Terry Stewart
|
||||
** Basically a bug-fix on my additions in 1.2. Thanks to Terry Stewart
|
||||
** (stew@texas.net) for pointing out one of the many idiotic bugs I introduced.
|
||||
** It was such a stupid bug that I would have never seen it myself.
|
||||
**
|
||||
|
||||
@ -34,7 +34,7 @@
|
||||
** 1/28/95
|
||||
** shadow-adduser 1.3:
|
||||
**
|
||||
** Basically a bug-fix on my additions in 1.2. Thanx to Terry Stewart
|
||||
** Basically a bug-fix on my additions in 1.2. Thanks to Terry Stewart
|
||||
** (stew@texas.net) for pointing out one of the many idiotic bugs I introduced.
|
||||
** It was such a stupid bug that I would have never seen it myself.
|
||||
**
|
||||
|
||||
@ -32,7 +32,7 @@ def_home_dir=/home/users
|
||||
# default shell
|
||||
def_shell=/bin/tcsh
|
||||
|
||||
# Defaul expiration date (mm/dd/yy)
|
||||
# Default expiration date (mm/dd/yy)
|
||||
def_expire=""
|
||||
|
||||
# default dates
|
||||
|
||||
@ -2,7 +2,7 @@ Hello Marek,
|
||||
|
||||
I have created a diffile against the 980403 release that adds
|
||||
functionality to newusers for automatic handling of users with only
|
||||
anonomous ftp login (using the guestgroup feature in ftpaccess, which
|
||||
anonymous ftp login (using the guestgroup feature in ftpaccess, which
|
||||
means that the users home directory looks like '/home/user/./'). It also
|
||||
adds a commandline argument to specify an initial directory structure
|
||||
for such users, with a tarball normally containing the bin,lib,etc
|
||||
|
||||
@ -15,7 +15,7 @@ Changes:
|
||||
- code merged into lmain.c --cristiang
|
||||
|
||||
TODO: - support groups in the limits file
|
||||
(only usernames are supported at this momment :-( )
|
||||
(only usernames are supported at this moment :-( )
|
||||
|
||||
Setting user limits for shadow login program
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ typedef unsigned char _Bool;
|
||||
|
||||
/* Take care of NLS matters. */
|
||||
#ifdef S_SPLINT_S
|
||||
extern char *setlocale(int categorie, const char *locale);
|
||||
extern char *setlocale(int categories, const char *locale);
|
||||
# define LC_ALL (6)
|
||||
extern char * bindtextdomain (const char * domainname, const char * dirname);
|
||||
extern char * textdomain (const char * domainname);
|
||||
|
||||
@ -254,9 +254,9 @@ extern void motd (void);
|
||||
/* myname.c */
|
||||
extern /*@null@*//*@only@*/struct passwd *get_my_pwent (void);
|
||||
|
||||
/* pam_pass_non_interractive.c */
|
||||
/* pam_pass_non_interactive.c */
|
||||
#ifdef USE_PAM
|
||||
extern int do_pam_passwd_non_interractive (const char *pam_service,
|
||||
extern int do_pam_passwd_non_interactive (const char *pam_service,
|
||||
const char *username,
|
||||
const char* password);
|
||||
#endif /* USE_PAM */
|
||||
|
||||
@ -181,7 +181,7 @@ static const bool range_exists(struct commonio_db *db, const char *owner)
|
||||
* subuid @val.
|
||||
*
|
||||
* @db: database to query
|
||||
* @owner: owning uid being queuried
|
||||
* @owner: owning uid being queried
|
||||
* @val: subuid being searched for.
|
||||
*
|
||||
* Returns a range of subuids belonging to @owner and including the subuid
|
||||
@ -221,7 +221,7 @@ static const struct subordinate_range *find_range(struct commonio_db *db,
|
||||
|
||||
/*
|
||||
* Search loop above did not produce any result. Let's rerun it,
|
||||
* but this time try to matcha actual UIDs. The first entry that
|
||||
* but this time try to match actual UIDs. The first entry that
|
||||
* matches is considered a success.
|
||||
* (It may be specified as literal UID or as another username which
|
||||
* has the same UID as the username we are looking for.)
|
||||
@ -418,7 +418,7 @@ fail:
|
||||
* @start: the first uid in the owned range
|
||||
* @count: the number of uids in the range
|
||||
*
|
||||
* Return 1 if the range is already present or on succcess. On error
|
||||
* Return 1 if the range is already present or on success. On error
|
||||
* return 0 and set errno appropriately.
|
||||
*/
|
||||
static int add_range(struct commonio_db *db,
|
||||
|
||||
@ -44,7 +44,7 @@ libmisc_a_SOURCES = \
|
||||
myname.c \
|
||||
obscure.c \
|
||||
pam_pass.c \
|
||||
pam_pass_non_interractive.c \
|
||||
pam_pass_non_interactive.c \
|
||||
pwd2spwd.c \
|
||||
pwdcheck.c \
|
||||
pwd_init.c \
|
||||
|
||||
@ -69,7 +69,7 @@ extern int failcheck (uid_t uid, struct faillog *fl, bool failed);
|
||||
extern void failprint (const struct faillog *);
|
||||
|
||||
/*
|
||||
* failtmp - update the cummulative failure log
|
||||
* failtmp - update the cumulative failure log
|
||||
*
|
||||
* failtmp updates the (struct utmp) formatted failure log which
|
||||
* maintains a record of all login failures.
|
||||
|
||||
@ -66,7 +66,7 @@
|
||||
#endif
|
||||
|
||||
/* Remap normal yacc parser interface names (yyparse, yylex, yyerror, etc),
|
||||
as well as gratuitiously global symbol names, so we can have multiple
|
||||
as well as gratuitously global symbol names, so we can have multiple
|
||||
yacc generated parsers in the same program. Note that these are only
|
||||
the variables produced by yacc. If other parser generators (bison,
|
||||
byacc, etc) produce additional global names that conflict at link time,
|
||||
|
||||
@ -148,7 +148,7 @@ void write_mapping(int proc_dir_fd, int ranges, struct map_range *mappings,
|
||||
pos += written;
|
||||
}
|
||||
|
||||
/* Write the mapping to the maping file */
|
||||
/* Write the mapping to the mapping file */
|
||||
fd = openat(proc_dir_fd, map_file, O_WRONLY);
|
||||
if (fd < 0) {
|
||||
fprintf(stderr, _("%s: open of %s failed: %s\n"),
|
||||
|
||||
@ -134,7 +134,7 @@ failed_conversation:
|
||||
*
|
||||
* Return 0 on success, 1 on failure.
|
||||
*/
|
||||
int do_pam_passwd_non_interractive (const char *pam_service,
|
||||
int do_pam_passwd_non_interactive (const char *pam_service,
|
||||
const char *username,
|
||||
const char* password)
|
||||
{
|
||||
@ -171,7 +171,7 @@ static void read_env_file (const char *filename)
|
||||
cp++;
|
||||
goto d_quote;
|
||||
}
|
||||
eise if (*cp == '\0') {
|
||||
else if (*cp == '\0') {
|
||||
/* end of string */
|
||||
goto finished;
|
||||
} else {
|
||||
|
||||
@ -126,7 +126,7 @@ static char *date_formats[] = {
|
||||
#else
|
||||
/*
|
||||
* days and juldays are used to compute the number of days in the
|
||||
* current month, and the cummulative number of days in the preceding
|
||||
* current month, and the cumulative number of days in the preceding
|
||||
* months. they are declared so that january is 1, not 0.
|
||||
*/
|
||||
static short days[13] = { 0,
|
||||
|
||||
@ -88,7 +88,7 @@ static bool is_my_tty (const char *tty)
|
||||
* session
|
||||
*
|
||||
* The utmp file is scanned for an entry with the same process ID.
|
||||
* The line enterred by the *getty / telnetd, etc. should also match
|
||||
* The line entered by the *getty / telnetd, etc. should also match
|
||||
* the current terminal.
|
||||
*
|
||||
* When an entry is returned by get_current_utmp, and if the utmp
|
||||
|
||||
@ -480,7 +480,7 @@ msgid ""
|
||||
msgstr ""
|
||||
|
||||
msgid ""
|
||||
" -M, --maxdays MAX_DAYS set maximim number of days before password\n"
|
||||
" -M, --maxdays MAX_DAYS set maximum number of days before password\n"
|
||||
" change to MAX_DAYS\n"
|
||||
msgstr ""
|
||||
|
||||
|
||||
@ -362,7 +362,7 @@ static void list_fields (void)
|
||||
/*
|
||||
* Start with the easy numbers - the number of days before the
|
||||
* password can be changed, the number of days after which the
|
||||
* password must be chaged, the number of days before the password
|
||||
* password must be changed, the number of days before the password
|
||||
* expires that the user is told, and the number of days after the
|
||||
* password expires that the account becomes unusable.
|
||||
*/
|
||||
|
||||
@ -464,7 +464,7 @@ int main (int argc, char **argv)
|
||||
|
||||
#ifdef USE_PAM
|
||||
if (use_pam){
|
||||
if (do_pam_passwd_non_interractive ("chpasswd", name, newpwd) != 0) {
|
||||
if (do_pam_passwd_non_interactive ("chpasswd", name, newpwd) != 0) {
|
||||
fprintf (stderr,
|
||||
_("%s: (line %d, user %s) password not changed\n"),
|
||||
Prog, line, name);
|
||||
|
||||
@ -278,7 +278,7 @@ static void remove_user (const char *user,
|
||||
}
|
||||
|
||||
/*
|
||||
* purge_members - Rmeove every members of the specified group
|
||||
* purge_members - Remove every members of the specified group
|
||||
*/
|
||||
static void purge_members (const struct group *grp)
|
||||
{
|
||||
|
||||
@ -1163,7 +1163,7 @@ int main (int argc, char **argv)
|
||||
* entries.
|
||||
* Use the x variants because we need to keep the
|
||||
* entry for a long time, and there might be other
|
||||
* getxxyy in between.
|
||||
* getxxyyy in between.
|
||||
*/
|
||||
pw_free (pwd);
|
||||
pwd = xgetpwnam (username);
|
||||
|
||||
@ -256,7 +256,7 @@ failure:
|
||||
/*
|
||||
* syslog_sg - log the change of group to syslog
|
||||
*
|
||||
* The loggout will also be logged when the user will quit the
|
||||
* The logout will also be logged when the user will quit the
|
||||
* sg/newgrp session.
|
||||
*/
|
||||
static void syslog_sg (const char *name, const char *group)
|
||||
|
||||
@ -1238,7 +1238,7 @@ int main (int argc, char **argv)
|
||||
unsigned int i;
|
||||
/* Now update the passwords using PAM */
|
||||
for (i = 0; i < nusers; i++) {
|
||||
if (do_pam_passwd_non_interractive ("newusers", usernames[i], passwords[i]) != 0) {
|
||||
if (do_pam_passwd_non_interactive ("newusers", usernames[i], passwords[i]) != 0) {
|
||||
fprintf (stderr,
|
||||
_("%s: (line %d, user %s) password not changed\n"),
|
||||
Prog, lines[i], usernames[i]);
|
||||
|
||||
@ -152,7 +152,7 @@ int check_su_auth (const char *actual_id,
|
||||
return OWNPWORD;
|
||||
} else {
|
||||
SYSLOG ((LOG_ERR,
|
||||
"%s, line %d: unrecognised action!\n",
|
||||
"%s, line %d: unrecognized action!\n",
|
||||
SUAUTHFILE, lines));
|
||||
}
|
||||
}
|
||||
|
||||
@ -2285,7 +2285,7 @@ int main (int argc, char **argv)
|
||||
/*
|
||||
* tallylog_reset needs to be able to lookup
|
||||
* a valid existing user name,
|
||||
* so we canot call it before close_files()
|
||||
* so we cannot call it before close_files()
|
||||
*/
|
||||
if (!lflg && getpwuid (user_id) != NULL) {
|
||||
tallylog_reset (user_name);
|
||||
|
||||
@ -21,7 +21,7 @@ set timeout 2
|
||||
|
||||
# user switching command, by default `sudo su -`
|
||||
set swcmd $conf(s)
|
||||
# ending of typicall shell prompt (zsh/sh):
|
||||
# ending of typical shell prompt (zsh/sh):
|
||||
set shpmt "(%|#|\\$) \\Z"
|
||||
catch {set shpmt $env(EXPECT_PROMPT)}
|
||||
# initial username:
|
||||
|
||||
@ -9,7 +9,7 @@ Options:
|
||||
-l, --list show account aging information
|
||||
-m, --mindays MIN_DAYS set minimum number of days before password
|
||||
change to MIN_DAYS
|
||||
-M, --maxdays MAX_DAYS set maximim number of days before password
|
||||
-M, --maxdays MAX_DAYS set maximum number of days before password
|
||||
change to MAX_DAYS
|
||||
-R, --root CHROOT_DIR directory to chroot into
|
||||
-W, --warndays WARN_DAYS set expiration warning days to WARN_DAYS
|
||||
|
||||
@ -185,12 +185,12 @@ chage -d 2030-03-02 -E 1979-11-24 -I 10 -m 11 -M 12 --warndays 4 myuser7
|
||||
ent=$(getent shadow myuser7)
|
||||
[ "$ent" = 'myuser7:$1$yQnIAZWV$gDAMB2IkqaONgrQiRdo4y.:21975:11:12:4:10:3614:' ] || exit 1
|
||||
|
||||
echo "interractive test"
|
||||
echo "interactive test"
|
||||
./run1.exp
|
||||
ent=$(getent shadow myuser7)
|
||||
[ "$ent" = 'myuser7:$1$yQnIAZWV$gDAMB2IkqaONgrQiRdo4y.:12990:13:14:9:35:15548:' ] || exit 1
|
||||
|
||||
echo "interractive test (default)"
|
||||
echo "interactive test (default)"
|
||||
./run2.exp
|
||||
ent=$(getent shadow myuser7)
|
||||
[ "$ent" = 'myuser7:$1$yQnIAZWV$gDAMB2IkqaONgrQiRdo4y.:12990:13:14:9:35:15548:' ] || exit 1
|
||||
|
||||
@ -44,7 +44,7 @@ do
|
||||
cp data/$i /etc
|
||||
done
|
||||
|
||||
echo "interractive test"
|
||||
echo "interactive test"
|
||||
./run.exp $(date "+%Y-%m-%d")
|
||||
|
||||
echo "OK"
|
||||
|
||||
@ -9,7 +9,7 @@ Options:
|
||||
-l, --list show account aging information
|
||||
-m, --mindays MIN_DAYS set minimum number of days before password
|
||||
change to MIN_DAYS
|
||||
-M, --maxdays MAX_DAYS set maximim number of days before password
|
||||
-M, --maxdays MAX_DAYS set maximum number of days before password
|
||||
change to MAX_DAYS
|
||||
-R, --root CHROOT_DIR directory to chroot into
|
||||
-W, --warndays WARN_DAYS set expiration warning days to WARN_DAYS
|
||||
|
||||
@ -10,7 +10,7 @@ Options:
|
||||
-l, --list show account aging information
|
||||
-m, --mindays MIN_DAYS set minimum number of days before password
|
||||
change to MIN_DAYS
|
||||
-M, --maxdays MAX_DAYS set maximim number of days before password
|
||||
-M, --maxdays MAX_DAYS set maximum number of days before password
|
||||
change to MAX_DAYS
|
||||
-R, --root CHROOT_DIR directory to chroot into
|
||||
-W, --warndays WARN_DAYS set expiration warning days to WARN_DAYS
|
||||
|
||||
@ -9,7 +9,7 @@ Options:
|
||||
-l, --list show account aging information
|
||||
-m, --mindays MIN_DAYS set minimum number of days before password
|
||||
change to MIN_DAYS
|
||||
-M, --maxdays MAX_DAYS set maximim number of days before password
|
||||
-M, --maxdays MAX_DAYS set maximum number of days before password
|
||||
change to MAX_DAYS
|
||||
-R, --root CHROOT_DIR directory to chroot into
|
||||
-W, --warndays WARN_DAYS set expiration warning days to WARN_DAYS
|
||||
|
||||
@ -9,7 +9,7 @@ Options:
|
||||
-l, --list show account aging information
|
||||
-m, --mindays MIN_DAYS set minimum number of days before password
|
||||
change to MIN_DAYS
|
||||
-M, --maxdays MAX_DAYS set maximim number of days before password
|
||||
-M, --maxdays MAX_DAYS set maximum number of days before password
|
||||
change to MAX_DAYS
|
||||
-R, --root CHROOT_DIR directory to chroot into
|
||||
-W, --warndays WARN_DAYS set expiration warning days to WARN_DAYS
|
||||
|
||||
@ -10,7 +10,7 @@ Options:
|
||||
-l, --list show account aging information
|
||||
-m, --mindays MIN_DAYS set minimum number of days before password
|
||||
change to MIN_DAYS
|
||||
-M, --maxdays MAX_DAYS set maximim number of days before password
|
||||
-M, --maxdays MAX_DAYS set maximum number of days before password
|
||||
change to MAX_DAYS
|
||||
-R, --root CHROOT_DIR directory to chroot into
|
||||
-W, --warndays WARN_DAYS set expiration warning days to WARN_DAYS
|
||||
|
||||
@ -10,7 +10,7 @@ Options:
|
||||
-l, --list show account aging information
|
||||
-m, --mindays MIN_DAYS set minimum number of days before password
|
||||
change to MIN_DAYS
|
||||
-M, --maxdays MAX_DAYS set maximim number of days before password
|
||||
-M, --maxdays MAX_DAYS set maximum number of days before password
|
||||
change to MAX_DAYS
|
||||
-R, --root CHROOT_DIR directory to chroot into
|
||||
-W, --warndays WARN_DAYS set expiration warning days to WARN_DAYS
|
||||
|
||||
@ -10,7 +10,7 @@ Options:
|
||||
-l, --list show account aging information
|
||||
-m, --mindays MIN_DAYS set minimum number of days before password
|
||||
change to MIN_DAYS
|
||||
-M, --maxdays MAX_DAYS set maximim number of days before password
|
||||
-M, --maxdays MAX_DAYS set maximum number of days before password
|
||||
change to MAX_DAYS
|
||||
-R, --root CHROOT_DIR directory to chroot into
|
||||
-W, --warndays WARN_DAYS set expiration warning days to WARN_DAYS
|
||||
|
||||
@ -185,7 +185,7 @@ GID_MAX 60000
|
||||
|
||||
#
|
||||
# Max number of login retries if password is bad. This will most likely be
|
||||
# overriden by PAM, since the default pam_unix module has it's own built
|
||||
# overridden by PAM, since the default pam_unix module has it's own built
|
||||
# in of 3 retries. However, this is a safe fallback in case you are using
|
||||
# an authentication module that does not enforce PAM_MAXTRIES.
|
||||
#
|
||||
@ -272,7 +272,7 @@ USERGROUPS_ENAB yes
|
||||
# #
|
||||
# These options are now handled by PAM. Please #
|
||||
# edit the appropriate file in /etc/pam.d/ to #
|
||||
# enable the equivelants of them.
|
||||
# enable the equivalents of them.
|
||||
#
|
||||
###############
|
||||
|
||||
|
||||
@ -185,7 +185,7 @@ GID_MAX 60000
|
||||
|
||||
#
|
||||
# Max number of login retries if password is bad. This will most likely be
|
||||
# overriden by PAM, since the default pam_unix module has it's own built
|
||||
# overridden by PAM, since the default pam_unix module has it's own built
|
||||
# in of 3 retries. However, this is a safe fallback in case you are using
|
||||
# an authentication module that does not enforce PAM_MAXTRIES.
|
||||
#
|
||||
@ -272,7 +272,7 @@ USERGROUPS_ENAB yes
|
||||
# #
|
||||
# These options are now handled by PAM. Please #
|
||||
# edit the appropriate file in /etc/pam.d/ to #
|
||||
# enable the equivelants of them.
|
||||
# enable the equivalents of them.
|
||||
#
|
||||
###############
|
||||
|
||||
|
||||
@ -185,7 +185,7 @@ GID_MAX 60000
|
||||
|
||||
#
|
||||
# Max number of login retries if password is bad. This will most likely be
|
||||
# overriden by PAM, since the default pam_unix module has it's own built
|
||||
# overridden by PAM, since the default pam_unix module has it's own built
|
||||
# in of 3 retries. However, this is a safe fallback in case you are using
|
||||
# an authentication module that does not enforce PAM_MAXTRIES.
|
||||
#
|
||||
@ -272,7 +272,7 @@ USERGROUPS_ENAB yes
|
||||
# #
|
||||
# These options are now handled by PAM. Please #
|
||||
# edit the appropriate file in /etc/pam.d/ to #
|
||||
# enable the equivelants of them.
|
||||
# enable the equivalents of them.
|
||||
#
|
||||
###############
|
||||
|
||||
|
||||
@ -185,7 +185,7 @@ GID_MAX 60000
|
||||
|
||||
#
|
||||
# Max number of login retries if password is bad. This will most likely be
|
||||
# overriden by PAM, since the default pam_unix module has it's own built
|
||||
# overridden by PAM, since the default pam_unix module has it's own built
|
||||
# in of 3 retries. However, this is a safe fallback in case you are using
|
||||
# an authentication module that does not enforce PAM_MAXTRIES.
|
||||
#
|
||||
@ -272,7 +272,7 @@ USERGROUPS_ENAB yes
|
||||
# #
|
||||
# These options are now handled by PAM. Please #
|
||||
# edit the appropriate file in /etc/pam.d/ to #
|
||||
# enable the equivelants of them.
|
||||
# enable the equivalents of them.
|
||||
#
|
||||
###############
|
||||
|
||||
|
||||
@ -185,7 +185,7 @@ GID_MAX 60000
|
||||
|
||||
#
|
||||
# Max number of login retries if password is bad. This will most likely be
|
||||
# overriden by PAM, since the default pam_unix module has it's own built
|
||||
# overridden by PAM, since the default pam_unix module has it's own built
|
||||
# in of 3 retries. However, this is a safe fallback in case you are using
|
||||
# an authentication module that does not enforce PAM_MAXTRIES.
|
||||
#
|
||||
@ -272,7 +272,7 @@ USERGROUPS_ENAB yes
|
||||
# #
|
||||
# These options are now handled by PAM. Please #
|
||||
# edit the appropriate file in /etc/pam.d/ to #
|
||||
# enable the equivelants of them.
|
||||
# enable the equivalents of them.
|
||||
#
|
||||
###############
|
||||
|
||||
|
||||
@ -185,7 +185,7 @@ GID_MAX 60000
|
||||
|
||||
#
|
||||
# Max number of login retries if password is bad. This will most likely be
|
||||
# overriden by PAM, since the default pam_unix module has it's own built
|
||||
# overridden by PAM, since the default pam_unix module has it's own built
|
||||
# in of 3 retries. However, this is a safe fallback in case you are using
|
||||
# an authentication module that does not enforce PAM_MAXTRIES.
|
||||
#
|
||||
@ -272,7 +272,7 @@ USERGROUPS_ENAB yes
|
||||
# #
|
||||
# These options are now handled by PAM. Please #
|
||||
# edit the appropriate file in /etc/pam.d/ to #
|
||||
# enable the equivelants of them.
|
||||
# enable the equivalents of them.
|
||||
#
|
||||
###############
|
||||
|
||||
|
||||
@ -16,7 +16,7 @@ trap 'log_status "$0" "FAILURE"; restore_config' 0
|
||||
|
||||
change_config
|
||||
|
||||
echo -n "chage interractive session as myuser1..."
|
||||
echo -n "chage interactive session as myuser1..."
|
||||
./run.exp
|
||||
echo "OK"
|
||||
|
||||
@ -185,7 +185,7 @@ GID_MAX 60000
|
||||
|
||||
#
|
||||
# Max number of login retries if password is bad. This will most likely be
|
||||
# overriden by PAM, since the default pam_unix module has it's own built
|
||||
# overridden by PAM, since the default pam_unix module has it's own built
|
||||
# in of 3 retries. However, this is a safe fallback in case you are using
|
||||
# an authentication module that does not enforce PAM_MAXTRIES.
|
||||
#
|
||||
@ -272,7 +272,7 @@ USERGROUPS_ENAB yes
|
||||
# #
|
||||
# These options are now handled by PAM. Please #
|
||||
# edit the appropriate file in /etc/pam.d/ to #
|
||||
# enable the equivelants of them.
|
||||
# enable the equivalents of them.
|
||||
#
|
||||
###############
|
||||
|
||||
@ -16,7 +16,7 @@ trap 'log_status "$0" "FAILURE"; restore_config' 0
|
||||
|
||||
change_config
|
||||
|
||||
echo -n "chage interractive session as myuser1..."
|
||||
echo -n "chage interactive session as myuser1..."
|
||||
./run.exp
|
||||
echo "OK"
|
||||
|
||||
@ -185,7 +185,7 @@ GID_MAX 60000
|
||||
|
||||
#
|
||||
# Max number of login retries if password is bad. This will most likely be
|
||||
# overriden by PAM, since the default pam_unix module has it's own built
|
||||
# overridden by PAM, since the default pam_unix module has it's own built
|
||||
# in of 3 retries. However, this is a safe fallback in case you are using
|
||||
# an authentication module that does not enforce PAM_MAXTRIES.
|
||||
#
|
||||
@ -272,7 +272,7 @@ USERGROUPS_ENAB yes
|
||||
# #
|
||||
# These options are now handled by PAM. Please #
|
||||
# edit the appropriate file in /etc/pam.d/ to #
|
||||
# enable the equivelants of them.
|
||||
# enable the equivalents of them.
|
||||
#
|
||||
###############
|
||||
|
||||
@ -16,7 +16,7 @@ trap 'log_status "$0" "FAILURE"; restore_config' 0
|
||||
|
||||
change_config
|
||||
|
||||
echo -n "chage interractive session as myuser1..."
|
||||
echo -n "chage interactive session as myuser1..."
|
||||
./run.exp
|
||||
echo "OK"
|
||||
|
||||
@ -185,7 +185,7 @@ GID_MAX 60000
|
||||
|
||||
#
|
||||
# Max number of login retries if password is bad. This will most likely be
|
||||
# overriden by PAM, since the default pam_unix module has it's own built
|
||||
# overridden by PAM, since the default pam_unix module has it's own built
|
||||
# in of 3 retries. However, this is a safe fallback in case you are using
|
||||
# an authentication module that does not enforce PAM_MAXTRIES.
|
||||
#
|
||||
@ -272,7 +272,7 @@ USERGROUPS_ENAB yes
|
||||
# #
|
||||
# These options are now handled by PAM. Please #
|
||||
# edit the appropriate file in /etc/pam.d/ to #
|
||||
# enable the equivelants of them.
|
||||
# enable the equivalents of them.
|
||||
#
|
||||
###############
|
||||
|
||||
@ -16,7 +16,7 @@ trap 'log_status "$0" "FAILURE"; restore_config' 0
|
||||
|
||||
change_config
|
||||
|
||||
echo -n "chage interractive session as myuser1..."
|
||||
echo -n "chage interactive session as myuser1..."
|
||||
./run.exp
|
||||
echo "OK"
|
||||
|
||||
@ -185,7 +185,7 @@ GID_MAX 60000
|
||||
|
||||
#
|
||||
# Max number of login retries if password is bad. This will most likely be
|
||||
# overriden by PAM, since the default pam_unix module has it's own built
|
||||
# overridden by PAM, since the default pam_unix module has it's own built
|
||||
# in of 3 retries. However, this is a safe fallback in case you are using
|
||||
# an authentication module that does not enforce PAM_MAXTRIES.
|
||||
#
|
||||
@ -272,7 +272,7 @@ USERGROUPS_ENAB yes
|
||||
# #
|
||||
# These options are now handled by PAM. Please #
|
||||
# edit the appropriate file in /etc/pam.d/ to #
|
||||
# enable the equivelants of them.
|
||||
# enable the equivalents of them.
|
||||
#
|
||||
###############
|
||||
|
||||
@ -16,7 +16,7 @@ trap 'log_status "$0" "FAILURE"; restore_config' 0
|
||||
|
||||
change_config
|
||||
|
||||
echo -n "chage interractive session as myuser1..."
|
||||
echo -n "chage interactive session as myuser1..."
|
||||
./run.exp
|
||||
echo "OK"
|
||||
|
||||
@ -0,0 +1,315 @@
|
||||
#
|
||||
# /etc/login.defs - Configuration control definitions for the login package.
|
||||
#
|
||||
# Three items must be defined: MAIL_DIR, ENV_SUPATH, and ENV_PATH.
|
||||
# If unspecified, some arbitrary (and possibly incorrect) value will
|
||||
# be assumed. All other items are optional - if not specified then
|
||||
# the described action or option will be inhibited.
|
||||
#
|
||||
# Comment lines (lines beginning with "#") and blank lines are ignored.
|
||||
#
|
||||
# Modified for Linux. --marekm
|
||||
|
||||
# REQUIRED for useradd/userdel/usermod
|
||||
# Directory where mailboxes reside, _or_ name of file, relative to the
|
||||
# home directory. If you _do_ define MAIL_DIR and MAIL_FILE,
|
||||
# MAIL_DIR takes precedence.
|
||||
#
|
||||
# Essentially:
|
||||
# - MAIL_DIR defines the location of users mail spool files
|
||||
# (for mbox use) by appending the username to MAIL_DIR as defined
|
||||
# below.
|
||||
# - MAIL_FILE defines the location of the users mail spool files as the
|
||||
# fully-qualified filename obtained by prepending the user home
|
||||
# directory before $MAIL_FILE
|
||||
#
|
||||
# NOTE: This is no more used for setting up users MAIL environment variable
|
||||
# which is, starting from shadow 4.0.12-1 in Debian, entirely the
|
||||
# job of the pam_mail PAM modules
|
||||
# See default PAM configuration files provided for
|
||||
# login, su, etc.
|
||||
#
|
||||
# This is a temporary situation: setting these variables will soon
|
||||
# move to /etc/default/useradd and the variables will then be
|
||||
# no more supported
|
||||
MAIL_DIR /var/mail
|
||||
#MAIL_FILE .mail
|
||||
|
||||
#
|
||||
# Enable logging and display of /var/log/faillog login failure info.
|
||||
# This option conflicts with the pam_tally PAM module.
|
||||
#
|
||||
FAILLOG_ENAB yes
|
||||
|
||||
#
|
||||
# Enable display of unknown usernames when login failures are recorded.
|
||||
#
|
||||
# WARNING: Unknown usernames may become world readable.
|
||||
# See #290803 and #298773 for details about how this could become a security
|
||||
# concern
|
||||
LOG_UNKFAIL_ENAB no
|
||||
|
||||
#
|
||||
# Enable logging of successful logins
|
||||
#
|
||||
LOG_OK_LOGINS no
|
||||
|
||||
#
|
||||
# Enable "syslog" logging of su activity - in addition to sulog file logging.
|
||||
# SYSLOG_SG_ENAB does the same for newgrp and sg.
|
||||
#
|
||||
SYSLOG_SU_ENAB yes
|
||||
SYSLOG_SG_ENAB yes
|
||||
|
||||
#
|
||||
# If defined, all su activity is logged to this file.
|
||||
#
|
||||
#SULOG_FILE /var/log/sulog
|
||||
|
||||
#
|
||||
# If defined, file which maps tty line to TERM environment parameter.
|
||||
# Each line of the file is in a format something like "vt100 tty01".
|
||||
#
|
||||
#TTYTYPE_FILE /etc/ttytype
|
||||
|
||||
#
|
||||
# If defined, login failures will be logged here in a utmp format
|
||||
# last, when invoked as lastb, will read /var/log/btmp, so...
|
||||
#
|
||||
FTMP_FILE /var/log/btmp
|
||||
|
||||
#
|
||||
# If defined, the command name to display when running "su -". For
|
||||
# example, if this is defined as "su" then a "ps" will display the
|
||||
# command is "-su". If not defined, then "ps" would display the
|
||||
# name of the shell actually being run, e.g. something like "-sh".
|
||||
#
|
||||
SU_NAME su
|
||||
|
||||
#
|
||||
# If defined, file which inhibits all the usual chatter during the login
|
||||
# sequence. If a full pathname, then hushed mode will be enabled if the
|
||||
# user's name or shell are found in the file. If not a full pathname, then
|
||||
# hushed mode will be enabled if the file exists in the user's home directory.
|
||||
#
|
||||
HUSHLOGIN_FILE .hushlogin
|
||||
#HUSHLOGIN_FILE /etc/hushlogins
|
||||
|
||||
#
|
||||
# *REQUIRED* The default PATH settings, for superuser and normal users.
|
||||
#
|
||||
# (they are minimal, add the rest in the shell startup files)
|
||||
ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ENV_PATH PATH=/usr/local/bin:/usr/bin:/bin:/usr/games
|
||||
|
||||
#
|
||||
# Terminal permissions
|
||||
#
|
||||
# TTYGROUP Login tty will be assigned this group ownership.
|
||||
# TTYPERM Login tty will be set to this permission.
|
||||
#
|
||||
# If you have a "write" program which is "setgid" to a special group
|
||||
# which owns the terminals, define TTYGROUP to the group number and
|
||||
# TTYPERM to 0620. Otherwise leave TTYGROUP commented out and assign
|
||||
# TTYPERM to either 622 or 600.
|
||||
#
|
||||
# In Debian /usr/bin/bsd-write or similar programs are setgid tty
|
||||
# However, the default and recommended value for TTYPERM is still 0600
|
||||
# to not allow anyone to write to anyone else console or terminal
|
||||
|
||||
# Users can still allow other people to write them by issuing
|
||||
# the "mesg y" command.
|
||||
|
||||
TTYGROUP tty
|
||||
TTYPERM 0600
|
||||
|
||||
#
|
||||
# Login configuration initializations:
|
||||
#
|
||||
# ERASECHAR Terminal ERASE character ('\010' = backspace).
|
||||
# KILLCHAR Terminal KILL character ('\025' = CTRL/U).
|
||||
# UMASK Default "umask" value.
|
||||
#
|
||||
# The ERASECHAR and KILLCHAR are used only on System V machines.
|
||||
#
|
||||
# UMASK usage is discouraged because it catches only some classes of user
|
||||
# entries to system, in fact only those made through login(1), while setting
|
||||
# umask in shell rc file will catch also logins through su, cron, ssh etc.
|
||||
#
|
||||
# At the same time, using shell rc to set umask won't catch entries which use
|
||||
# non-shell executables in place of login shell, like /usr/sbin/pppd for "ppp"
|
||||
# user and alike.
|
||||
#
|
||||
# Therefore the use of pam_umask is recommended (Debian package libpam-umask)
|
||||
# as the solution which catches all these cases on PAM-enabled systems.
|
||||
#
|
||||
# This avoids the confusion created by having the umask set
|
||||
# in two different places -- in login.defs and shell rc files (i.e.
|
||||
# /etc/profile).
|
||||
#
|
||||
# For discussion, see #314539 and #248150 as well as the thread starting at
|
||||
# http://lists.debian.org/debian-devel/2005/06/msg01598.html
|
||||
#
|
||||
# Prefix these values with "0" to get octal, "0x" to get hexadecimal.
|
||||
#
|
||||
ERASECHAR 0177
|
||||
KILLCHAR 025
|
||||
# 022 is the "historical" value in Debian for UMASK when it was used
|
||||
# 027, or even 077, could be considered better for privacy
|
||||
# There is no One True Answer here : each sysadmin must make up their
|
||||
# mind.
|
||||
#UMASK 022
|
||||
|
||||
#
|
||||
# Password aging controls:
|
||||
#
|
||||
# PASS_MAX_DAYS Maximum number of days a password may be used.
|
||||
# PASS_MIN_DAYS Minimum number of days allowed between password changes.
|
||||
# PASS_WARN_AGE Number of days warning given before a password expires.
|
||||
#
|
||||
PASS_MAX_DAYS 99999
|
||||
PASS_MIN_DAYS 0
|
||||
PASS_WARN_AGE 7
|
||||
|
||||
#
|
||||
# Min/max values for automatic uid selection in useradd
|
||||
#
|
||||
UID_MIN 1000
|
||||
UID_MAX 60000
|
||||
|
||||
#
|
||||
# Min/max values for automatic gid selection in groupadd
|
||||
#
|
||||
GID_MIN 100
|
||||
GID_MAX 60000
|
||||
|
||||
#
|
||||
# Max number of login retries if password is bad. This will most likely be
|
||||
# overridden by PAM, since the default pam_unix module has it's own built
|
||||
# in of 3 retries. However, this is a safe fallback in case you are using
|
||||
# an authentication module that does not enforce PAM_MAXTRIES.
|
||||
#
|
||||
LOGIN_RETRIES 5
|
||||
|
||||
#
|
||||
# Max time in seconds for login
|
||||
#
|
||||
LOGIN_TIMEOUT 60
|
||||
|
||||
#
|
||||
# Which fields may be changed by regular users using chfn - use
|
||||
# any combination of letters "frwh" (full name, room number, work
|
||||
# phone, home phone). If not defined, no changes are allowed.
|
||||
# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
|
||||
#
|
||||
CHFN_RESTRICT rwh
|
||||
|
||||
#
|
||||
# Should login be allowed if we can't cd to the home directory?
|
||||
# Default in no.
|
||||
#
|
||||
DEFAULT_HOME yes
|
||||
|
||||
#
|
||||
# If defined, this command is run when removing a user.
|
||||
# It should remove any at/cron/print jobs etc. owned by
|
||||
# the user to be removed (passed as the first argument).
|
||||
#
|
||||
#USERDEL_CMD /usr/sbin/userdel_local
|
||||
|
||||
#
|
||||
# This enables userdel to remove user groups if no members exist.
|
||||
#
|
||||
# Other former uses of this variable such as setting the umask when
|
||||
# user==primary group are not used in PAM environments, thus in Debian
|
||||
#
|
||||
USERGROUPS_ENAB yes
|
||||
|
||||
#
|
||||
# Instead of the real user shell, the program specified by this parameter
|
||||
# will be launched, although its visible name (argv[0]) will be the shell's.
|
||||
# The program may do whatever it wants (logging, additional authentification,
|
||||
# banner, ...) before running the actual shell.
|
||||
#
|
||||
# FAKE_SHELL /bin/fakeshell
|
||||
|
||||
#
|
||||
# If defined, either full pathname of a file containing device names or
|
||||
# a ":" delimited list of device names. Root logins will be allowed only
|
||||
# upon these devices.
|
||||
#
|
||||
# This variable is used by login and su.
|
||||
#
|
||||
#CONSOLE /etc/consoles
|
||||
#CONSOLE console:tty01:tty02:tty03:tty04
|
||||
|
||||
#
|
||||
# List of groups to add to the user's supplementary group set
|
||||
# when logging in on the console (as determined by the CONSOLE
|
||||
# setting). Default is none.
|
||||
#
|
||||
# Use with caution - it is possible for users to gain permanent
|
||||
# access to these groups, even when not logged in on the console.
|
||||
# How to do it is left as an exercise for the reader...
|
||||
#
|
||||
# This variable is used by login and su.
|
||||
#
|
||||
#CONSOLE_GROUPS floppy:audio:cdrom
|
||||
|
||||
#
|
||||
# Only works if compiled with MD5_CRYPT defined:
|
||||
# If set to "yes", new passwords will be encrypted using the MD5-based
|
||||
# algorithm compatible with the one used by recent releases of FreeBSD.
|
||||
# It supports passwords of unlimited length and longer salt strings.
|
||||
# Set to "no" if you need to copy encrypted passwords to other systems
|
||||
# which don't understand the new algorithm. Default is "no".
|
||||
#
|
||||
# This variable is used by chpasswd, gpasswd and newusers.
|
||||
#
|
||||
#MD5_CRYPT_ENAB no
|
||||
|
||||
################# OBSOLETED BY PAM ##############
|
||||
# #
|
||||
# These options are now handled by PAM. Please #
|
||||
# edit the appropriate file in /etc/pam.d/ to #
|
||||
# enable the equivalents of them.
|
||||
#
|
||||
###############
|
||||
|
||||
#MOTD_FILE
|
||||
#DIALUPS_CHECK_ENAB
|
||||
#LASTLOG_ENAB
|
||||
#MAIL_CHECK_ENAB
|
||||
#OBSCURE_CHECKS_ENAB
|
||||
#PORTTIME_CHECKS_ENAB
|
||||
#SU_WHEEL_ONLY
|
||||
#CRACKLIB_DICTPATH
|
||||
#PASS_CHANGE_TRIES
|
||||
#PASS_ALWAYS_WARN
|
||||
#ENVIRON_FILE
|
||||
#NOLOGINS_FILE
|
||||
#ISSUE_FILE
|
||||
#PASS_MIN_LEN
|
||||
#PASS_MAX_LEN
|
||||
#ULIMIT
|
||||
#ENV_HZ
|
||||
#CHFN_AUTH
|
||||
#CHSH_AUTH
|
||||
#FAIL_DELAY
|
||||
|
||||
################# OBSOLETED #######################
|
||||
# #
|
||||
# These options are no more handled by shadow. #
|
||||
# #
|
||||
# Shadow utilities will display a warning if they #
|
||||
# still appear. #
|
||||
# #
|
||||
###################################################
|
||||
|
||||
# CLOSE_SESSIONS
|
||||
# LOGIN_STRING
|
||||
# NO_PASSWORD_CONSOLE
|
||||
# QMAIL_DIR
|
||||
|
||||
|
||||
|
||||
@ -1,315 +0,0 @@
|
||||
#
|
||||
# /etc/login.defs - Configuration control definitions for the login package.
|
||||
#
|
||||
# Three items must be defined: MAIL_DIR, ENV_SUPATH, and ENV_PATH.
|
||||
# If unspecified, some arbitrary (and possibly incorrect) value will
|
||||
# be assumed. All other items are optional - if not specified then
|
||||
# the described action or option will be inhibited.
|
||||
#
|
||||
# Comment lines (lines beginning with "#") and blank lines are ignored.
|
||||
#
|
||||
# Modified for Linux. --marekm
|
||||
|
||||
# REQUIRED for useradd/userdel/usermod
|
||||
# Directory where mailboxes reside, _or_ name of file, relative to the
|
||||
# home directory. If you _do_ define MAIL_DIR and MAIL_FILE,
|
||||
# MAIL_DIR takes precedence.
|
||||
#
|
||||
# Essentially:
|
||||
# - MAIL_DIR defines the location of users mail spool files
|
||||
# (for mbox use) by appending the username to MAIL_DIR as defined
|
||||
# below.
|
||||
# - MAIL_FILE defines the location of the users mail spool files as the
|
||||
# fully-qualified filename obtained by prepending the user home
|
||||
# directory before $MAIL_FILE
|
||||
#
|
||||
# NOTE: This is no more used for setting up users MAIL environment variable
|
||||
# which is, starting from shadow 4.0.12-1 in Debian, entirely the
|
||||
# job of the pam_mail PAM modules
|
||||
# See default PAM configuration files provided for
|
||||
# login, su, etc.
|
||||
#
|
||||
# This is a temporary situation: setting these variables will soon
|
||||
# move to /etc/default/useradd and the variables will then be
|
||||
# no more supported
|
||||
MAIL_DIR /var/mail
|
||||
#MAIL_FILE .mail
|
||||
|
||||
#
|
||||
# Enable logging and display of /var/log/faillog login failure info.
|
||||
# This option conflicts with the pam_tally PAM module.
|
||||
#
|
||||
FAILLOG_ENAB yes
|
||||
|
||||
#
|
||||
# Enable display of unknown usernames when login failures are recorded.
|
||||
#
|
||||
# WARNING: Unknown usernames may become world readable.
|
||||
# See #290803 and #298773 for details about how this could become a security
|
||||
# concern
|
||||
LOG_UNKFAIL_ENAB no
|
||||
|
||||
#
|
||||
# Enable logging of successful logins
|
||||
#
|
||||
LOG_OK_LOGINS no
|
||||
|
||||
#
|
||||
# Enable "syslog" logging of su activity - in addition to sulog file logging.
|
||||
# SYSLOG_SG_ENAB does the same for newgrp and sg.
|
||||
#
|
||||
SYSLOG_SU_ENAB yes
|
||||
SYSLOG_SG_ENAB yes
|
||||
|
||||
#
|
||||
# If defined, all su activity is logged to this file.
|
||||
#
|
||||
#SULOG_FILE /var/log/sulog
|
||||
|
||||
#
|
||||
# If defined, file which maps tty line to TERM environment parameter.
|
||||
# Each line of the file is in a format something like "vt100 tty01".
|
||||
#
|
||||
#TTYTYPE_FILE /etc/ttytype
|
||||
|
||||
#
|
||||
# If defined, login failures will be logged here in a utmp format
|
||||
# last, when invoked as lastb, will read /var/log/btmp, so...
|
||||
#
|
||||
FTMP_FILE /var/log/btmp
|
||||
|
||||
#
|
||||
# If defined, the command name to display when running "su -". For
|
||||
# example, if this is defined as "su" then a "ps" will display the
|
||||
# command is "-su". If not defined, then "ps" would display the
|
||||
# name of the shell actually being run, e.g. something like "-sh".
|
||||
#
|
||||
SU_NAME su
|
||||
|
||||
#
|
||||
# If defined, file which inhibits all the usual chatter during the login
|
||||
# sequence. If a full pathname, then hushed mode will be enabled if the
|
||||
# user's name or shell are found in the file. If not a full pathname, then
|
||||
# hushed mode will be enabled if the file exists in the user's home directory.
|
||||
#
|
||||
HUSHLOGIN_FILE .hushlogin
|
||||
#HUSHLOGIN_FILE /etc/hushlogins
|
||||
|
||||
#
|
||||
# *REQUIRED* The default PATH settings, for superuser and normal users.
|
||||
#
|
||||
# (they are minimal, add the rest in the shell startup files)
|
||||
ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ENV_PATH PATH=/usr/local/bin:/usr/bin:/bin:/usr/games
|
||||
|
||||
#
|
||||
# Terminal permissions
|
||||
#
|
||||
# TTYGROUP Login tty will be assigned this group ownership.
|
||||
# TTYPERM Login tty will be set to this permission.
|
||||
#
|
||||
# If you have a "write" program which is "setgid" to a special group
|
||||
# which owns the terminals, define TTYGROUP to the group number and
|
||||
# TTYPERM to 0620. Otherwise leave TTYGROUP commented out and assign
|
||||
# TTYPERM to either 622 or 600.
|
||||
#
|
||||
# In Debian /usr/bin/bsd-write or similar programs are setgid tty
|
||||
# However, the default and recommended value for TTYPERM is still 0600
|
||||
# to not allow anyone to write to anyone else console or terminal
|
||||
|
||||
# Users can still allow other people to write them by issuing
|
||||
# the "mesg y" command.
|
||||
|
||||
TTYGROUP tty
|
||||
TTYPERM 0600
|
||||
|
||||
#
|
||||
# Login configuration initializations:
|
||||
#
|
||||
# ERASECHAR Terminal ERASE character ('\010' = backspace).
|
||||
# KILLCHAR Terminal KILL character ('\025' = CTRL/U).
|
||||
# UMASK Default "umask" value.
|
||||
#
|
||||
# The ERASECHAR and KILLCHAR are used only on System V machines.
|
||||
#
|
||||
# UMASK usage is discouraged because it catches only some classes of user
|
||||
# entries to system, in fact only those made through login(1), while setting
|
||||
# umask in shell rc file will catch also logins through su, cron, ssh etc.
|
||||
#
|
||||
# At the same time, using shell rc to set umask won't catch entries which use
|
||||
# non-shell executables in place of login shell, like /usr/sbin/pppd for "ppp"
|
||||
# user and alike.
|
||||
#
|
||||
# Therefore the use of pam_umask is recommended (Debian package libpam-umask)
|
||||
# as the solution which catches all these cases on PAM-enabled systems.
|
||||
#
|
||||
# This avoids the confusion created by having the umask set
|
||||
# in two different places -- in login.defs and shell rc files (i.e.
|
||||
# /etc/profile).
|
||||
#
|
||||
# For discussion, see #314539 and #248150 as well as the thread starting at
|
||||
# http://lists.debian.org/debian-devel/2005/06/msg01598.html
|
||||
#
|
||||
# Prefix these values with "0" to get octal, "0x" to get hexadecimal.
|
||||
#
|
||||
ERASECHAR 0177
|
||||
KILLCHAR 025
|
||||
# 022 is the "historical" value in Debian for UMASK when it was used
|
||||
# 027, or even 077, could be considered better for privacy
|
||||
# There is no One True Answer here : each sysadmin must make up their
|
||||
# mind.
|
||||
#UMASK 022
|
||||
|
||||
#
|
||||
# Password aging controls:
|
||||
#
|
||||
# PASS_MAX_DAYS Maximum number of days a password may be used.
|
||||
# PASS_MIN_DAYS Minimum number of days allowed between password changes.
|
||||
# PASS_WARN_AGE Number of days warning given before a password expires.
|
||||
#
|
||||
PASS_MAX_DAYS 99999
|
||||
PASS_MIN_DAYS 0
|
||||
PASS_WARN_AGE 7
|
||||
|
||||
#
|
||||
# Min/max values for automatic uid selection in useradd
|
||||
#
|
||||
UID_MIN 1000
|
||||
UID_MAX 60000
|
||||
|
||||
#
|
||||
# Min/max values for automatic gid selection in groupadd
|
||||
#
|
||||
GID_MIN 100
|
||||
GID_MAX 60000
|
||||
|
||||
#
|
||||
# Max number of login retries if password is bad. This will most likely be
|
||||
# overriden by PAM, since the default pam_unix module has it's own built
|
||||
# in of 3 retries. However, this is a safe fallback in case you are using
|
||||
# an authentication module that does not enforce PAM_MAXTRIES.
|
||||
#
|
||||
LOGIN_RETRIES 5
|
||||
|
||||
#
|
||||
# Max time in seconds for login
|
||||
#
|
||||
LOGIN_TIMEOUT 60
|
||||
|
||||
#
|
||||
# Which fields may be changed by regular users using chfn - use
|
||||
# any combination of letters "frwh" (full name, room number, work
|
||||
# phone, home phone). If not defined, no changes are allowed.
|
||||
# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
|
||||
#
|
||||
CHFN_RESTRICT rwh
|
||||
|
||||
#
|
||||
# Should login be allowed if we can't cd to the home directory?
|
||||
# Default in no.
|
||||
#
|
||||
DEFAULT_HOME yes
|
||||
|
||||
#
|
||||
# If defined, this command is run when removing a user.
|
||||
# It should remove any at/cron/print jobs etc. owned by
|
||||
# the user to be removed (passed as the first argument).
|
||||
#
|
||||
#USERDEL_CMD /usr/sbin/userdel_local
|
||||
|
||||
#
|
||||
# This enables userdel to remove user groups if no members exist.
|
||||
#
|
||||
# Other former uses of this variable such as setting the umask when
|
||||
# user==primary group are not used in PAM environments, thus in Debian
|
||||
#
|
||||
USERGROUPS_ENAB yes
|
||||
|
||||
#
|
||||
# Instead of the real user shell, the program specified by this parameter
|
||||
# will be launched, although its visible name (argv[0]) will be the shell's.
|
||||
# The program may do whatever it wants (logging, additional authentification,
|
||||
# banner, ...) before running the actual shell.
|
||||
#
|
||||
# FAKE_SHELL /bin/fakeshell
|
||||
|
||||
#
|
||||
# If defined, either full pathname of a file containing device names or
|
||||
# a ":" delimited list of device names. Root logins will be allowed only
|
||||
# upon these devices.
|
||||
#
|
||||
# This variable is used by login and su.
|
||||
#
|
||||
#CONSOLE /etc/consoles
|
||||
#CONSOLE console:tty01:tty02:tty03:tty04
|
||||
|
||||
#
|
||||
# List of groups to add to the user's supplementary group set
|
||||
# when logging in on the console (as determined by the CONSOLE
|
||||
# setting). Default is none.
|
||||
#
|
||||
# Use with caution - it is possible for users to gain permanent
|
||||
# access to these groups, even when not logged in on the console.
|
||||
# How to do it is left as an exercise for the reader...
|
||||
#
|
||||
# This variable is used by login and su.
|
||||
#
|
||||
#CONSOLE_GROUPS floppy:audio:cdrom
|
||||
|
||||
#
|
||||
# Only works if compiled with MD5_CRYPT defined:
|
||||
# If set to "yes", new passwords will be encrypted using the MD5-based
|
||||
# algorithm compatible with the one used by recent releases of FreeBSD.
|
||||
# It supports passwords of unlimited length and longer salt strings.
|
||||
# Set to "no" if you need to copy encrypted passwords to other systems
|
||||
# which don't understand the new algorithm. Default is "no".
|
||||
#
|
||||
# This variable is used by chpasswd, gpasswd and newusers.
|
||||
#
|
||||
#MD5_CRYPT_ENAB no
|
||||
|
||||
################# OBSOLETED BY PAM ##############
|
||||
# #
|
||||
# These options are now handled by PAM. Please #
|
||||
# edit the appropriate file in /etc/pam.d/ to #
|
||||
# enable the equivelants of them.
|
||||
#
|
||||
###############
|
||||
|
||||
#MOTD_FILE
|
||||
#DIALUPS_CHECK_ENAB
|
||||
#LASTLOG_ENAB
|
||||
#MAIL_CHECK_ENAB
|
||||
#OBSCURE_CHECKS_ENAB
|
||||
#PORTTIME_CHECKS_ENAB
|
||||
#SU_WHEEL_ONLY
|
||||
#CRACKLIB_DICTPATH
|
||||
#PASS_CHANGE_TRIES
|
||||
#PASS_ALWAYS_WARN
|
||||
#ENVIRON_FILE
|
||||
#NOLOGINS_FILE
|
||||
#ISSUE_FILE
|
||||
#PASS_MIN_LEN
|
||||
#PASS_MAX_LEN
|
||||
#ULIMIT
|
||||
#ENV_HZ
|
||||
#CHFN_AUTH
|
||||
#CHSH_AUTH
|
||||
#FAIL_DELAY
|
||||
|
||||
################# OBSOLETED #######################
|
||||
# #
|
||||
# These options are no more handled by shadow. #
|
||||
# #
|
||||
# Shadow utilities will display a warning if they #
|
||||
# still appear. #
|
||||
# #
|
||||
###################################################
|
||||
|
||||
# CLOSE_SESSIONS
|
||||
# LOGIN_STRING
|
||||
# NO_PASSWORD_CONSOLE
|
||||
# QMAIL_DIR
|
||||
|
||||
|
||||
|
||||
@ -16,7 +16,7 @@ trap 'log_status "$0" "FAILURE"; restore_config' 0
|
||||
|
||||
change_config
|
||||
|
||||
echo -n "chage interractive session as myuser1..."
|
||||
echo -n "chage interactive session as myuser1..."
|
||||
./run.exp
|
||||
echo "OK"
|
||||
|
||||
@ -0,0 +1,315 @@
|
||||
#
|
||||
# /etc/login.defs - Configuration control definitions for the login package.
|
||||
#
|
||||
# Three items must be defined: MAIL_DIR, ENV_SUPATH, and ENV_PATH.
|
||||
# If unspecified, some arbitrary (and possibly incorrect) value will
|
||||
# be assumed. All other items are optional - if not specified then
|
||||
# the described action or option will be inhibited.
|
||||
#
|
||||
# Comment lines (lines beginning with "#") and blank lines are ignored.
|
||||
#
|
||||
# Modified for Linux. --marekm
|
||||
|
||||
# REQUIRED for useradd/userdel/usermod
|
||||
# Directory where mailboxes reside, _or_ name of file, relative to the
|
||||
# home directory. If you _do_ define MAIL_DIR and MAIL_FILE,
|
||||
# MAIL_DIR takes precedence.
|
||||
#
|
||||
# Essentially:
|
||||
# - MAIL_DIR defines the location of users mail spool files
|
||||
# (for mbox use) by appending the username to MAIL_DIR as defined
|
||||
# below.
|
||||
# - MAIL_FILE defines the location of the users mail spool files as the
|
||||
# fully-qualified filename obtained by prepending the user home
|
||||
# directory before $MAIL_FILE
|
||||
#
|
||||
# NOTE: This is no more used for setting up users MAIL environment variable
|
||||
# which is, starting from shadow 4.0.12-1 in Debian, entirely the
|
||||
# job of the pam_mail PAM modules
|
||||
# See default PAM configuration files provided for
|
||||
# login, su, etc.
|
||||
#
|
||||
# This is a temporary situation: setting these variables will soon
|
||||
# move to /etc/default/useradd and the variables will then be
|
||||
# no more supported
|
||||
MAIL_DIR /var/mail
|
||||
#MAIL_FILE .mail
|
||||
|
||||
#
|
||||
# Enable logging and display of /var/log/faillog login failure info.
|
||||
# This option conflicts with the pam_tally PAM module.
|
||||
#
|
||||
FAILLOG_ENAB yes
|
||||
|
||||
#
|
||||
# Enable display of unknown usernames when login failures are recorded.
|
||||
#
|
||||
# WARNING: Unknown usernames may become world readable.
|
||||
# See #290803 and #298773 for details about how this could become a security
|
||||
# concern
|
||||
LOG_UNKFAIL_ENAB no
|
||||
|
||||
#
|
||||
# Enable logging of successful logins
|
||||
#
|
||||
LOG_OK_LOGINS no
|
||||
|
||||
#
|
||||
# Enable "syslog" logging of su activity - in addition to sulog file logging.
|
||||
# SYSLOG_SG_ENAB does the same for newgrp and sg.
|
||||
#
|
||||
SYSLOG_SU_ENAB yes
|
||||
SYSLOG_SG_ENAB yes
|
||||
|
||||
#
|
||||
# If defined, all su activity is logged to this file.
|
||||
#
|
||||
#SULOG_FILE /var/log/sulog
|
||||
|
||||
#
|
||||
# If defined, file which maps tty line to TERM environment parameter.
|
||||
# Each line of the file is in a format something like "vt100 tty01".
|
||||
#
|
||||
#TTYTYPE_FILE /etc/ttytype
|
||||
|
||||
#
|
||||
# If defined, login failures will be logged here in a utmp format
|
||||
# last, when invoked as lastb, will read /var/log/btmp, so...
|
||||
#
|
||||
FTMP_FILE /var/log/btmp
|
||||
|
||||
#
|
||||
# If defined, the command name to display when running "su -". For
|
||||
# example, if this is defined as "su" then a "ps" will display the
|
||||
# command is "-su". If not defined, then "ps" would display the
|
||||
# name of the shell actually being run, e.g. something like "-sh".
|
||||
#
|
||||
SU_NAME su
|
||||
|
||||
#
|
||||
# If defined, file which inhibits all the usual chatter during the login
|
||||
# sequence. If a full pathname, then hushed mode will be enabled if the
|
||||
# user's name or shell are found in the file. If not a full pathname, then
|
||||
# hushed mode will be enabled if the file exists in the user's home directory.
|
||||
#
|
||||
HUSHLOGIN_FILE .hushlogin
|
||||
#HUSHLOGIN_FILE /etc/hushlogins
|
||||
|
||||
#
|
||||
# *REQUIRED* The default PATH settings, for superuser and normal users.
|
||||
#
|
||||
# (they are minimal, add the rest in the shell startup files)
|
||||
ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ENV_PATH PATH=/usr/local/bin:/usr/bin:/bin:/usr/games
|
||||
|
||||
#
|
||||
# Terminal permissions
|
||||
#
|
||||
# TTYGROUP Login tty will be assigned this group ownership.
|
||||
# TTYPERM Login tty will be set to this permission.
|
||||
#
|
||||
# If you have a "write" program which is "setgid" to a special group
|
||||
# which owns the terminals, define TTYGROUP to the group number and
|
||||
# TTYPERM to 0620. Otherwise leave TTYGROUP commented out and assign
|
||||
# TTYPERM to either 622 or 600.
|
||||
#
|
||||
# In Debian /usr/bin/bsd-write or similar programs are setgid tty
|
||||
# However, the default and recommended value for TTYPERM is still 0600
|
||||
# to not allow anyone to write to anyone else console or terminal
|
||||
|
||||
# Users can still allow other people to write them by issuing
|
||||
# the "mesg y" command.
|
||||
|
||||
TTYGROUP tty
|
||||
TTYPERM 0600
|
||||
|
||||
#
|
||||
# Login configuration initializations:
|
||||
#
|
||||
# ERASECHAR Terminal ERASE character ('\010' = backspace).
|
||||
# KILLCHAR Terminal KILL character ('\025' = CTRL/U).
|
||||
# UMASK Default "umask" value.
|
||||
#
|
||||
# The ERASECHAR and KILLCHAR are used only on System V machines.
|
||||
#
|
||||
# UMASK usage is discouraged because it catches only some classes of user
|
||||
# entries to system, in fact only those made through login(1), while setting
|
||||
# umask in shell rc file will catch also logins through su, cron, ssh etc.
|
||||
#
|
||||
# At the same time, using shell rc to set umask won't catch entries which use
|
||||
# non-shell executables in place of login shell, like /usr/sbin/pppd for "ppp"
|
||||
# user and alike.
|
||||
#
|
||||
# Therefore the use of pam_umask is recommended (Debian package libpam-umask)
|
||||
# as the solution which catches all these cases on PAM-enabled systems.
|
||||
#
|
||||
# This avoids the confusion created by having the umask set
|
||||
# in two different places -- in login.defs and shell rc files (i.e.
|
||||
# /etc/profile).
|
||||
#
|
||||
# For discussion, see #314539 and #248150 as well as the thread starting at
|
||||
# http://lists.debian.org/debian-devel/2005/06/msg01598.html
|
||||
#
|
||||
# Prefix these values with "0" to get octal, "0x" to get hexadecimal.
|
||||
#
|
||||
ERASECHAR 0177
|
||||
KILLCHAR 025
|
||||
# 022 is the "historical" value in Debian for UMASK when it was used
|
||||
# 027, or even 077, could be considered better for privacy
|
||||
# There is no One True Answer here : each sysadmin must make up their
|
||||
# mind.
|
||||
#UMASK 022
|
||||
|
||||
#
|
||||
# Password aging controls:
|
||||
#
|
||||
# PASS_MAX_DAYS Maximum number of days a password may be used.
|
||||
# PASS_MIN_DAYS Minimum number of days allowed between password changes.
|
||||
# PASS_WARN_AGE Number of days warning given before a password expires.
|
||||
#
|
||||
PASS_MAX_DAYS 99999
|
||||
PASS_MIN_DAYS 0
|
||||
PASS_WARN_AGE 7
|
||||
|
||||
#
|
||||
# Min/max values for automatic uid selection in useradd
|
||||
#
|
||||
UID_MIN 1000
|
||||
UID_MAX 60000
|
||||
|
||||
#
|
||||
# Min/max values for automatic gid selection in groupadd
|
||||
#
|
||||
GID_MIN 100
|
||||
GID_MAX 60000
|
||||
|
||||
#
|
||||
# Max number of login retries if password is bad. This will most likely be
|
||||
# overridden by PAM, since the default pam_unix module has it's own built
|
||||
# in of 3 retries. However, this is a safe fallback in case you are using
|
||||
# an authentication module that does not enforce PAM_MAXTRIES.
|
||||
#
|
||||
LOGIN_RETRIES 5
|
||||
|
||||
#
|
||||
# Max time in seconds for login
|
||||
#
|
||||
LOGIN_TIMEOUT 60
|
||||
|
||||
#
|
||||
# Which fields may be changed by regular users using chfn - use
|
||||
# any combination of letters "frwh" (full name, room number, work
|
||||
# phone, home phone). If not defined, no changes are allowed.
|
||||
# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
|
||||
#
|
||||
CHFN_RESTRICT rwh
|
||||
|
||||
#
|
||||
# Should login be allowed if we can't cd to the home directory?
|
||||
# Default in no.
|
||||
#
|
||||
DEFAULT_HOME yes
|
||||
|
||||
#
|
||||
# If defined, this command is run when removing a user.
|
||||
# It should remove any at/cron/print jobs etc. owned by
|
||||
# the user to be removed (passed as the first argument).
|
||||
#
|
||||
#USERDEL_CMD /usr/sbin/userdel_local
|
||||
|
||||
#
|
||||
# This enables userdel to remove user groups if no members exist.
|
||||
#
|
||||
# Other former uses of this variable such as setting the umask when
|
||||
# user==primary group are not used in PAM environments, thus in Debian
|
||||
#
|
||||
USERGROUPS_ENAB yes
|
||||
|
||||
#
|
||||
# Instead of the real user shell, the program specified by this parameter
|
||||
# will be launched, although its visible name (argv[0]) will be the shell's.
|
||||
# The program may do whatever it wants (logging, additional authentification,
|
||||
# banner, ...) before running the actual shell.
|
||||
#
|
||||
# FAKE_SHELL /bin/fakeshell
|
||||
|
||||
#
|
||||
# If defined, either full pathname of a file containing device names or
|
||||
# a ":" delimited list of device names. Root logins will be allowed only
|
||||
# upon these devices.
|
||||
#
|
||||
# This variable is used by login and su.
|
||||
#
|
||||
#CONSOLE /etc/consoles
|
||||
#CONSOLE console:tty01:tty02:tty03:tty04
|
||||
|
||||
#
|
||||
# List of groups to add to the user's supplementary group set
|
||||
# when logging in on the console (as determined by the CONSOLE
|
||||
# setting). Default is none.
|
||||
#
|
||||
# Use with caution - it is possible for users to gain permanent
|
||||
# access to these groups, even when not logged in on the console.
|
||||
# How to do it is left as an exercise for the reader...
|
||||
#
|
||||
# This variable is used by login and su.
|
||||
#
|
||||
#CONSOLE_GROUPS floppy:audio:cdrom
|
||||
|
||||
#
|
||||
# Only works if compiled with MD5_CRYPT defined:
|
||||
# If set to "yes", new passwords will be encrypted using the MD5-based
|
||||
# algorithm compatible with the one used by recent releases of FreeBSD.
|
||||
# It supports passwords of unlimited length and longer salt strings.
|
||||
# Set to "no" if you need to copy encrypted passwords to other systems
|
||||
# which don't understand the new algorithm. Default is "no".
|
||||
#
|
||||
# This variable is used by chpasswd, gpasswd and newusers.
|
||||
#
|
||||
#MD5_CRYPT_ENAB no
|
||||
|
||||
################# OBSOLETED BY PAM ##############
|
||||
# #
|
||||
# These options are now handled by PAM. Please #
|
||||
# edit the appropriate file in /etc/pam.d/ to #
|
||||
# enable the equivalents of them.
|
||||
#
|
||||
###############
|
||||
|
||||
#MOTD_FILE
|
||||
#DIALUPS_CHECK_ENAB
|
||||
#LASTLOG_ENAB
|
||||
#MAIL_CHECK_ENAB
|
||||
#OBSCURE_CHECKS_ENAB
|
||||
#PORTTIME_CHECKS_ENAB
|
||||
#SU_WHEEL_ONLY
|
||||
#CRACKLIB_DICTPATH
|
||||
#PASS_CHANGE_TRIES
|
||||
#PASS_ALWAYS_WARN
|
||||
#ENVIRON_FILE
|
||||
#NOLOGINS_FILE
|
||||
#ISSUE_FILE
|
||||
#PASS_MIN_LEN
|
||||
#PASS_MAX_LEN
|
||||
#ULIMIT
|
||||
#ENV_HZ
|
||||
#CHFN_AUTH
|
||||
#CHSH_AUTH
|
||||
#FAIL_DELAY
|
||||
|
||||
################# OBSOLETED #######################
|
||||
# #
|
||||
# These options are no more handled by shadow. #
|
||||
# #
|
||||
# Shadow utilities will display a warning if they #
|
||||
# still appear. #
|
||||
# #
|
||||
###################################################
|
||||
|
||||
# CLOSE_SESSIONS
|
||||
# LOGIN_STRING
|
||||
# NO_PASSWORD_CONSOLE
|
||||
# QMAIL_DIR
|
||||
|
||||
|
||||
|
||||
@ -1,315 +0,0 @@
|
||||
#
|
||||
# /etc/login.defs - Configuration control definitions for the login package.
|
||||
#
|
||||
# Three items must be defined: MAIL_DIR, ENV_SUPATH, and ENV_PATH.
|
||||
# If unspecified, some arbitrary (and possibly incorrect) value will
|
||||
# be assumed. All other items are optional - if not specified then
|
||||
# the described action or option will be inhibited.
|
||||
#
|
||||
# Comment lines (lines beginning with "#") and blank lines are ignored.
|
||||
#
|
||||
# Modified for Linux. --marekm
|
||||
|
||||
# REQUIRED for useradd/userdel/usermod
|
||||
# Directory where mailboxes reside, _or_ name of file, relative to the
|
||||
# home directory. If you _do_ define MAIL_DIR and MAIL_FILE,
|
||||
# MAIL_DIR takes precedence.
|
||||
#
|
||||
# Essentially:
|
||||
# - MAIL_DIR defines the location of users mail spool files
|
||||
# (for mbox use) by appending the username to MAIL_DIR as defined
|
||||
# below.
|
||||
# - MAIL_FILE defines the location of the users mail spool files as the
|
||||
# fully-qualified filename obtained by prepending the user home
|
||||
# directory before $MAIL_FILE
|
||||
#
|
||||
# NOTE: This is no more used for setting up users MAIL environment variable
|
||||
# which is, starting from shadow 4.0.12-1 in Debian, entirely the
|
||||
# job of the pam_mail PAM modules
|
||||
# See default PAM configuration files provided for
|
||||
# login, su, etc.
|
||||
#
|
||||
# This is a temporary situation: setting these variables will soon
|
||||
# move to /etc/default/useradd and the variables will then be
|
||||
# no more supported
|
||||
MAIL_DIR /var/mail
|
||||
#MAIL_FILE .mail
|
||||
|
||||
#
|
||||
# Enable logging and display of /var/log/faillog login failure info.
|
||||
# This option conflicts with the pam_tally PAM module.
|
||||
#
|
||||
FAILLOG_ENAB yes
|
||||
|
||||
#
|
||||
# Enable display of unknown usernames when login failures are recorded.
|
||||
#
|
||||
# WARNING: Unknown usernames may become world readable.
|
||||
# See #290803 and #298773 for details about how this could become a security
|
||||
# concern
|
||||
LOG_UNKFAIL_ENAB no
|
||||
|
||||
#
|
||||
# Enable logging of successful logins
|
||||
#
|
||||
LOG_OK_LOGINS no
|
||||
|
||||
#
|
||||
# Enable "syslog" logging of su activity - in addition to sulog file logging.
|
||||
# SYSLOG_SG_ENAB does the same for newgrp and sg.
|
||||
#
|
||||
SYSLOG_SU_ENAB yes
|
||||
SYSLOG_SG_ENAB yes
|
||||
|
||||
#
|
||||
# If defined, all su activity is logged to this file.
|
||||
#
|
||||
#SULOG_FILE /var/log/sulog
|
||||
|
||||
#
|
||||
# If defined, file which maps tty line to TERM environment parameter.
|
||||
# Each line of the file is in a format something like "vt100 tty01".
|
||||
#
|
||||
#TTYTYPE_FILE /etc/ttytype
|
||||
|
||||
#
|
||||
# If defined, login failures will be logged here in a utmp format
|
||||
# last, when invoked as lastb, will read /var/log/btmp, so...
|
||||
#
|
||||
FTMP_FILE /var/log/btmp
|
||||
|
||||
#
|
||||
# If defined, the command name to display when running "su -". For
|
||||
# example, if this is defined as "su" then a "ps" will display the
|
||||
# command is "-su". If not defined, then "ps" would display the
|
||||
# name of the shell actually being run, e.g. something like "-sh".
|
||||
#
|
||||
SU_NAME su
|
||||
|
||||
#
|
||||
# If defined, file which inhibits all the usual chatter during the login
|
||||
# sequence. If a full pathname, then hushed mode will be enabled if the
|
||||
# user's name or shell are found in the file. If not a full pathname, then
|
||||
# hushed mode will be enabled if the file exists in the user's home directory.
|
||||
#
|
||||
HUSHLOGIN_FILE .hushlogin
|
||||
#HUSHLOGIN_FILE /etc/hushlogins
|
||||
|
||||
#
|
||||
# *REQUIRED* The default PATH settings, for superuser and normal users.
|
||||
#
|
||||
# (they are minimal, add the rest in the shell startup files)
|
||||
ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ENV_PATH PATH=/usr/local/bin:/usr/bin:/bin:/usr/games
|
||||
|
||||
#
|
||||
# Terminal permissions
|
||||
#
|
||||
# TTYGROUP Login tty will be assigned this group ownership.
|
||||
# TTYPERM Login tty will be set to this permission.
|
||||
#
|
||||
# If you have a "write" program which is "setgid" to a special group
|
||||
# which owns the terminals, define TTYGROUP to the group number and
|
||||
# TTYPERM to 0620. Otherwise leave TTYGROUP commented out and assign
|
||||
# TTYPERM to either 622 or 600.
|
||||
#
|
||||
# In Debian /usr/bin/bsd-write or similar programs are setgid tty
|
||||
# However, the default and recommended value for TTYPERM is still 0600
|
||||
# to not allow anyone to write to anyone else console or terminal
|
||||
|
||||
# Users can still allow other people to write them by issuing
|
||||
# the "mesg y" command.
|
||||
|
||||
TTYGROUP tty
|
||||
TTYPERM 0600
|
||||
|
||||
#
|
||||
# Login configuration initializations:
|
||||
#
|
||||
# ERASECHAR Terminal ERASE character ('\010' = backspace).
|
||||
# KILLCHAR Terminal KILL character ('\025' = CTRL/U).
|
||||
# UMASK Default "umask" value.
|
||||
#
|
||||
# The ERASECHAR and KILLCHAR are used only on System V machines.
|
||||
#
|
||||
# UMASK usage is discouraged because it catches only some classes of user
|
||||
# entries to system, in fact only those made through login(1), while setting
|
||||
# umask in shell rc file will catch also logins through su, cron, ssh etc.
|
||||
#
|
||||
# At the same time, using shell rc to set umask won't catch entries which use
|
||||
# non-shell executables in place of login shell, like /usr/sbin/pppd for "ppp"
|
||||
# user and alike.
|
||||
#
|
||||
# Therefore the use of pam_umask is recommended (Debian package libpam-umask)
|
||||
# as the solution which catches all these cases on PAM-enabled systems.
|
||||
#
|
||||
# This avoids the confusion created by having the umask set
|
||||
# in two different places -- in login.defs and shell rc files (i.e.
|
||||
# /etc/profile).
|
||||
#
|
||||
# For discussion, see #314539 and #248150 as well as the thread starting at
|
||||
# http://lists.debian.org/debian-devel/2005/06/msg01598.html
|
||||
#
|
||||
# Prefix these values with "0" to get octal, "0x" to get hexadecimal.
|
||||
#
|
||||
ERASECHAR 0177
|
||||
KILLCHAR 025
|
||||
# 022 is the "historical" value in Debian for UMASK when it was used
|
||||
# 027, or even 077, could be considered better for privacy
|
||||
# There is no One True Answer here : each sysadmin must make up their
|
||||
# mind.
|
||||
#UMASK 022
|
||||
|
||||
#
|
||||
# Password aging controls:
|
||||
#
|
||||
# PASS_MAX_DAYS Maximum number of days a password may be used.
|
||||
# PASS_MIN_DAYS Minimum number of days allowed between password changes.
|
||||
# PASS_WARN_AGE Number of days warning given before a password expires.
|
||||
#
|
||||
PASS_MAX_DAYS 99999
|
||||
PASS_MIN_DAYS 0
|
||||
PASS_WARN_AGE 7
|
||||
|
||||
#
|
||||
# Min/max values for automatic uid selection in useradd
|
||||
#
|
||||
UID_MIN 1000
|
||||
UID_MAX 60000
|
||||
|
||||
#
|
||||
# Min/max values for automatic gid selection in groupadd
|
||||
#
|
||||
GID_MIN 100
|
||||
GID_MAX 60000
|
||||
|
||||
#
|
||||
# Max number of login retries if password is bad. This will most likely be
|
||||
# overriden by PAM, since the default pam_unix module has it's own built
|
||||
# in of 3 retries. However, this is a safe fallback in case you are using
|
||||
# an authentication module that does not enforce PAM_MAXTRIES.
|
||||
#
|
||||
LOGIN_RETRIES 5
|
||||
|
||||
#
|
||||
# Max time in seconds for login
|
||||
#
|
||||
LOGIN_TIMEOUT 60
|
||||
|
||||
#
|
||||
# Which fields may be changed by regular users using chfn - use
|
||||
# any combination of letters "frwh" (full name, room number, work
|
||||
# phone, home phone). If not defined, no changes are allowed.
|
||||
# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
|
||||
#
|
||||
CHFN_RESTRICT rwh
|
||||
|
||||
#
|
||||
# Should login be allowed if we can't cd to the home directory?
|
||||
# Default in no.
|
||||
#
|
||||
DEFAULT_HOME yes
|
||||
|
||||
#
|
||||
# If defined, this command is run when removing a user.
|
||||
# It should remove any at/cron/print jobs etc. owned by
|
||||
# the user to be removed (passed as the first argument).
|
||||
#
|
||||
#USERDEL_CMD /usr/sbin/userdel_local
|
||||
|
||||
#
|
||||
# This enables userdel to remove user groups if no members exist.
|
||||
#
|
||||
# Other former uses of this variable such as setting the umask when
|
||||
# user==primary group are not used in PAM environments, thus in Debian
|
||||
#
|
||||
USERGROUPS_ENAB yes
|
||||
|
||||
#
|
||||
# Instead of the real user shell, the program specified by this parameter
|
||||
# will be launched, although its visible name (argv[0]) will be the shell's.
|
||||
# The program may do whatever it wants (logging, additional authentification,
|
||||
# banner, ...) before running the actual shell.
|
||||
#
|
||||
# FAKE_SHELL /bin/fakeshell
|
||||
|
||||
#
|
||||
# If defined, either full pathname of a file containing device names or
|
||||
# a ":" delimited list of device names. Root logins will be allowed only
|
||||
# upon these devices.
|
||||
#
|
||||
# This variable is used by login and su.
|
||||
#
|
||||
#CONSOLE /etc/consoles
|
||||
#CONSOLE console:tty01:tty02:tty03:tty04
|
||||
|
||||
#
|
||||
# List of groups to add to the user's supplementary group set
|
||||
# when logging in on the console (as determined by the CONSOLE
|
||||
# setting). Default is none.
|
||||
#
|
||||
# Use with caution - it is possible for users to gain permanent
|
||||
# access to these groups, even when not logged in on the console.
|
||||
# How to do it is left as an exercise for the reader...
|
||||
#
|
||||
# This variable is used by login and su.
|
||||
#
|
||||
#CONSOLE_GROUPS floppy:audio:cdrom
|
||||
|
||||
#
|
||||
# Only works if compiled with MD5_CRYPT defined:
|
||||
# If set to "yes", new passwords will be encrypted using the MD5-based
|
||||
# algorithm compatible with the one used by recent releases of FreeBSD.
|
||||
# It supports passwords of unlimited length and longer salt strings.
|
||||
# Set to "no" if you need to copy encrypted passwords to other systems
|
||||
# which don't understand the new algorithm. Default is "no".
|
||||
#
|
||||
# This variable is used by chpasswd, gpasswd and newusers.
|
||||
#
|
||||
#MD5_CRYPT_ENAB no
|
||||
|
||||
################# OBSOLETED BY PAM ##############
|
||||
# #
|
||||
# These options are now handled by PAM. Please #
|
||||
# edit the appropriate file in /etc/pam.d/ to #
|
||||
# enable the equivelants of them.
|
||||
#
|
||||
###############
|
||||
|
||||
#MOTD_FILE
|
||||
#DIALUPS_CHECK_ENAB
|
||||
#LASTLOG_ENAB
|
||||
#MAIL_CHECK_ENAB
|
||||
#OBSCURE_CHECKS_ENAB
|
||||
#PORTTIME_CHECKS_ENAB
|
||||
#SU_WHEEL_ONLY
|
||||
#CRACKLIB_DICTPATH
|
||||
#PASS_CHANGE_TRIES
|
||||
#PASS_ALWAYS_WARN
|
||||
#ENVIRON_FILE
|
||||
#NOLOGINS_FILE
|
||||
#ISSUE_FILE
|
||||
#PASS_MIN_LEN
|
||||
#PASS_MAX_LEN
|
||||
#ULIMIT
|
||||
#ENV_HZ
|
||||
#CHFN_AUTH
|
||||
#CHSH_AUTH
|
||||
#FAIL_DELAY
|
||||
|
||||
################# OBSOLETED #######################
|
||||
# #
|
||||
# These options are no more handled by shadow. #
|
||||
# #
|
||||
# Shadow utilities will display a warning if they #
|
||||
# still appear. #
|
||||
# #
|
||||
###################################################
|
||||
|
||||
# CLOSE_SESSIONS
|
||||
# LOGIN_STRING
|
||||
# NO_PASSWORD_CONSOLE
|
||||
# QMAIL_DIR
|
||||
|
||||
|
||||
|
||||
@ -16,7 +16,7 @@ trap 'log_status "$0" "FAILURE"; restore_config; rm -f /etc/passwd.lock /etc/sha
|
||||
|
||||
change_config
|
||||
|
||||
echo -n "chage interractive session as myuser1..."
|
||||
echo -n "chage interactive session as myuser1..."
|
||||
./run.exp
|
||||
echo "OK"
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user