From b75fe4940b1a5f51747d54e38d1ef3cdf168192c Mon Sep 17 00:00:00 2001 From: nekral-guest Date: Mon, 26 Nov 2007 22:11:23 +0000 Subject: [PATCH] Put each variable description in an external entities. This will permit to reference them in the various utils manpages. --- ChangeLog | 14 + man/login.defs.5.xml | 399 ++++++++------------- man/login.defs.d/CHFN_AUTH.xml | 10 + man/login.defs.d/CHFN_RESTRICT.xml | 21 ++ man/login.defs.d/ENCRYPT_METHOD.xml | 34 ++ man/login.defs.d/GID_MAX.xml | 10 + man/login.defs.d/LOGIN_STRING.xml | 10 + man/login.defs.d/MAIL_DIR.xml | 10 + man/login.defs.d/MAX_MEMBERS_PER_GROUP.xml | 29 ++ man/login.defs.d/MD5_CRYPT_ENAB.xml | 28 ++ man/login.defs.d/PASS_MAX_DAYS.xml | 10 + man/login.defs.d/PASS_MIN_DAYS.xml | 10 + man/login.defs.d/PASS_WARN_AGE.xml | 11 + man/login.defs.d/SHA_CRYPT_MIN_ROUNDS.xml | 35 ++ man/login.defs.d/UID_MAX.xml | 10 + man/login.defs.d/UMASK.xml | 9 + man/login.defs.d/USERDEL_CMD.xml | 10 + 17 files changed, 405 insertions(+), 255 deletions(-) create mode 100644 man/login.defs.d/CHFN_AUTH.xml create mode 100644 man/login.defs.d/CHFN_RESTRICT.xml create mode 100644 man/login.defs.d/ENCRYPT_METHOD.xml create mode 100644 man/login.defs.d/GID_MAX.xml create mode 100644 man/login.defs.d/LOGIN_STRING.xml create mode 100644 man/login.defs.d/MAIL_DIR.xml create mode 100644 man/login.defs.d/MAX_MEMBERS_PER_GROUP.xml create mode 100644 man/login.defs.d/MD5_CRYPT_ENAB.xml create mode 100644 man/login.defs.d/PASS_MAX_DAYS.xml create mode 100644 man/login.defs.d/PASS_MIN_DAYS.xml create mode 100644 man/login.defs.d/PASS_WARN_AGE.xml create mode 100644 man/login.defs.d/SHA_CRYPT_MIN_ROUNDS.xml create mode 100644 man/login.defs.d/UID_MAX.xml create mode 100644 man/login.defs.d/UMASK.xml create mode 100644 man/login.defs.d/USERDEL_CMD.xml diff --git a/ChangeLog b/ChangeLog index 5fc7c7ba..e7b69c5e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,17 @@ +2007-11-26 Nicolas François + + * man/login.defs.d/, man/login.defs.d/CHFN_RESTRICT.xml, + man/login.defs.d/MAIL_DIR.xml, man/login.defs.d/PASS_MAX_DAYS.xml, + man/login.defs.d/SHA_CRYPT_MIN_ROUNDS.xml, + man/login.defs.d/CHFN_AUTH.xml, man/login.defs.d/MD5_CRYPT_ENAB.xml, + man/login.defs.d/PASS_WARN_AGE.xml, ·man/login.defs.d/UMASK.xml, + man/login.defs.d/PASS_MIN_DAYS.xml, man/login.defs.d/UID_MAX.xml, + man/login.defs.d/LOGIN_STRING.xml, man/login.defs.d/GID_MAX.xml, + man/login.defs.d/ENCRYPT_METHOD.xml, man/login.defs.d/USERDEL_CMD.xml, + man/login.defs.d/MAX_MEMBERS_PER_GROUP.xml, man/login.defs.5.xml: + Put each variable description in an external entities. This will permit + to reference them in the various utils manpages. + 2007-11-26 Nicolas François * po/stats: Do not generate gmo files. diff --git a/man/login.defs.5.xml b/man/login.defs.5.xml index 15148b3c..1dad9a92 100644 --- a/man/login.defs.5.xml +++ b/man/login.defs.5.xml @@ -1,4 +1,23 @@ + + + + + + + + + + + + + + + +]> + @@ -46,190 +65,18 @@ The following configuration items are provided: - - (boolean) - - - If yes, the - chfn and chsh programs - will require authentication before making any changes, unless - run by the superuser. - - - - - (string) - - - This parameter specifies which values in the gecos field of the - /etc/passwd file may be changed by regular - users using the chfn program. It can be any - combination of letters f, - r, w, - h, for Full name, Room number, - Work phone, and Home phone, respectively. For backward - compatibility, yes is equivalent to - rwh and - no is - equivalent to frwh. If not specified, - only the superuser can - make any changes. The most restrictive setting is better - achieved by not installing chfn SUID. - - - - - (string) - - - This defines the system default encryption algorithm for - encrypting passwords (if no algorithm are specified on the - command line). - - - It can take one of these values: - - - DES (default) - - - MD5 - - - SHA256 - - - SHA512 - - - - - Note: this parameter overrides the - variable. - - - Note: if you use PAM, it is recommended to set this variable - consistently with the PAM modules configuration. - - - - - (number) - (number) - - - Range of group IDs to choose from for the - useradd and groupadd - programs. - - - - - (string) - - - The mail spool directory. This is needed to manipulate the - mailbox when its corresponding user account is modified or - deleted. If not specified, a compile-time default is used. - - - - - (number) - - - Maximum members per group entry. When the maximum is reached, - a new group entry (line) is started in - /etc/group (with the same name, same - password, and same GID). - - - The default value is 0, meaning that there are no limits in - the number of members in a group. - - - - This feature (split group) permits to limit the length of - lines in the group file. This is useful to make sure that - lines for NIS groups are not larger than 1024 characters. - - - If you need to enforce such limit, you can use 25. - - - Note: split groups may not be supported by all tools (even in - the Shadow toolsuite. You should not use this variable unless - you really need it. - - - - - (boolean) - - - Indicate if passwords must be encrypted using the MD5-based - algorithm. If set to yes, new - passwords will be encrypted - using the MD5-based algorithm compatible with the one used by - recent releases of FreeBSD. It supports passwords of - unlimited length and longer salt strings. Set to - no if you - need to copy encrypted passwords to other systems which don't - understand the new algorithm. Default is - no. - - - This variable is superceded by the - variable or by any command - line option used to configure the encryption algorithm. - - - This variable is deprecated. You should use - . - - - Note: if you use PAM, it is recommended to set this variable - consistently with the PAM modules configuration. - - - - - (number) - - - The maximum number of days a password may be used. If the - password is older than this, a password change will be forced. - If not specified, -1 will be assumed (which disables the - restriction). - - - - - (number) - - - The minimum number of days allowed between password changes. - Any password changes attempted sooner than this will be - rejected. If not specified, -1 will be assumed (which disables - the restriction). - - - - - (number) - - - The number of days warning given before a password expires. A - zero means warning is given only upon the day of expiration, a - negative value means no warning is given. If not specified, no - warning will be provided. - - - + &CHFN_AUTH; + &CHFN_RESTRICT; + &ENCRYPT_METHOD; + &GID_MAX; + &LOGIN_STRING; + &MAIL_DIR; + &MAX_MEMBERS_PER_GROUP; + &MD5_CRYPT_ENAB; + &PASS_MAX_DAYS; + &PASS_MIN_DAYS; + &PASS_WARN_AGE; - , and are only used at the @@ -237,70 +84,10 @@ existing accounts. - - (number) - (number) - - - When is set to - SHA256 or - SHA512, this defines the number of - SHA rounds used by the encryption algorithm by default (when - the number of rounds is not specified on the command line). - - - With a lot of rounds, it is more difficult to brute forcing - the password. But note also that more CPU resources will be - needed to authenticate users. - - - If not specified, the libc will choose the default number of - rounds (5000). - - - The values must be inside the 1000-999999999 range. - - - If only one of the or - values is set, then this - value will be used. - - - If > - , the highest value will - be used. - - - - - (number) - (number) - - - Range of user IDs to choose from for the - useradd program. - - - - - (number) - - - The permission mask is initialized to this value. If not - specified, the permission mask will be initialized to 022. - - - - - (string) - - - If defined, this command is run when removing a user. It should - remove any at/cron/print jobs etc. owned by the user to be - removed (passed as the first argument). - - - + &SHA_CRYPT_MIN_ROUNDS; + &UID_MAX; + &UMASK; + &USERDEL_CMD; @@ -312,18 +99,22 @@ + chfn - CHFN_AUTH CHFN_RESTRICT + + CHFN_AUTH CHFN_RESTRICT + LOGIN_STRING + chgpasswd - MD5_CRYPT_ENAB ENCRYPT_METHOD SHA_CRYPT_MIN_ROUNDS - SHA_CRYPT_MAX_ROUNDS MAX_MEMBERS_PER_GROUP + ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB + SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS @@ -331,28 +122,125 @@ chpasswd - MD5_CRYPT_ENAB ENCRYPT_METHOD SHA_CRYPT_MIN_ROUNDS - SHA_CRYPT_MAX_ROUNDS + ENCRYPT_METHOD MD5_CRYPT_ENAB SHA_CRYPT_MAX_ROUNDS + SHA_CRYPT_MIN_ROUNDS chsh - CHFN_AUTH + + CHFN_AUTH + LOGIN_STRING + + + + + expiry + + CONSOLE_GROUPS + + + + + gpasswd + + + ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB + SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS + groupadd - GID_MAX GID_MIN + GID_MAX GID_MIN MAX_MEMBERS_PER_GROUP + + + + groupdel + + MAX_MEMBERS_PER_GROUP + + + + groupmod + + MAX_MEMBERS_PER_GROUP + + + + + grpck + + MAX_MEMBERS_PER_GROUP + + + + grpconv + + MAX_MEMBERS_PER_GROUP + + + + grpunconv + + MAX_MEMBERS_PER_GROUP + + + + + + login + + + CONSOLE CONSOLE_GROUPS DEFAULT_HOME ENV_HZ ENV_PATH ENV_SUPATH + ENV_TZ ENVIRON_FILE ERASECHAR FAIL_DELAY FAILLOG_ENAB + FAKE_SHELL FTMP_FILE HUSHLOGIN_FILE ISSUE_FILE KILLCHAR + LASTLOG_ENAB LOGIN_RETRIES LOGIN_STRING LOGIN_TIMEOUT + LOG_OK_LOGINS LOG_UNKFAIL_ENAB MAIL_CHECK_ENAB MAIL_DIR + MAIL_FILE MOTD_FILE NOLOGINS_FILE PORTTIME_CHECKS_ENAB + QUOTAS_ENAB TTYGROUP TTYPERM TTYTYPE_FILE ULIMIT UMASK + USERGROUPS_ENAB + + + + + + newgrp + + + SYSLOG_SG_ENAB + newusers - PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE UMASK + ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB + PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE SHA_CRYPT_MIN_ROUNDS + UMASK + + + + + + passwd + + + ENCRYPT_METHOD MD5_CRYPT_ENAB OBSCURE_CHECKS_ENAB + PASS_ALWAYS_WARN PASS_CHANGE_TRIES PASS_MAX_LEN PASS_MIN_LEN + SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS + + + + + pwck + + + PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE @@ -362,6 +250,7 @@ PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE + useradd diff --git a/man/login.defs.d/CHFN_AUTH.xml b/man/login.defs.d/CHFN_AUTH.xml new file mode 100644 index 00000000..e65c04c5 --- /dev/null +++ b/man/login.defs.d/CHFN_AUTH.xml @@ -0,0 +1,10 @@ + + (boolean) + + + If yes, the chfn and + chsh programs will require authentication before + making any changes, unless run by the superuser. + + + diff --git a/man/login.defs.d/CHFN_RESTRICT.xml b/man/login.defs.d/CHFN_RESTRICT.xml new file mode 100644 index 00000000..237b2091 --- /dev/null +++ b/man/login.defs.d/CHFN_RESTRICT.xml @@ -0,0 +1,21 @@ + + (string) + + + This parameter specifies which values in the gecos field of the + /etc/passwd file may be changed by regular + users using the chfn program. It can be any + combination of letters f, + r, w, + h, for Full name, Room number, Work + phone, and Home phone, respectively. For backward compatibility, + yes is equivalent to + rwh and no is + equivalent to frwh. If not specified, + only the superuser can make any changes. The most restrictive + setting is better achieved by not installing chfn + SUID. + + + diff --git a/man/login.defs.d/ENCRYPT_METHOD.xml b/man/login.defs.d/ENCRYPT_METHOD.xml new file mode 100644 index 00000000..563104a5 --- /dev/null +++ b/man/login.defs.d/ENCRYPT_METHOD.xml @@ -0,0 +1,34 @@ + + (string) + + + This defines the system default encryption algorithm for encrypting + passwords (if no algorithm are specified on the command line). + + + It can take one of these values: + + + DES (default) + + + MD5 + + + SHA256 + + + SHA512 + + + + + Note: this parameter overrides the + variable. + + + Note: if you use PAM, it is recommended to set this variable + consistently with the PAM modules configuration. + + + diff --git a/man/login.defs.d/GID_MAX.xml b/man/login.defs.d/GID_MAX.xml new file mode 100644 index 00000000..d6d9a8cb --- /dev/null +++ b/man/login.defs.d/GID_MAX.xml @@ -0,0 +1,10 @@ + + (number) + (number) + + + Range of group IDs to choose from for the useradd + and groupadd programs. + + + diff --git a/man/login.defs.d/LOGIN_STRING.xml b/man/login.defs.d/LOGIN_STRING.xml new file mode 100644 index 00000000..55c5346b --- /dev/null +++ b/man/login.defs.d/LOGIN_STRING.xml @@ -0,0 +1,10 @@ + + (string) + + + The string used for prompting a password. The default is to use + "Password: ", or a translation of that string. If you set this + variable, the prompt will no be translated. + + + diff --git a/man/login.defs.d/MAIL_DIR.xml b/man/login.defs.d/MAIL_DIR.xml new file mode 100644 index 00000000..ab6a485c --- /dev/null +++ b/man/login.defs.d/MAIL_DIR.xml @@ -0,0 +1,10 @@ + + (string) + + + The mail spool directory. This is needed to manipulate the mailbox + when its corresponding user account is modified or deleted. If not + specified, a compile-time default is used. + + + diff --git a/man/login.defs.d/MAX_MEMBERS_PER_GROUP.xml b/man/login.defs.d/MAX_MEMBERS_PER_GROUP.xml new file mode 100644 index 00000000..ca33dac7 --- /dev/null +++ b/man/login.defs.d/MAX_MEMBERS_PER_GROUP.xml @@ -0,0 +1,29 @@ + + (number) + + + Maximum members per group entry. When the maximum is reached, a new + group entry (line) is started in /etc/group + (with the same name, same password, and same GID). + + + The default value is 0, meaning that there are no limits in the + number of members in a group. + + + + This feature (split group) permits to limit the length of lines in + the group file. This is useful to make sure that lines for NIS + groups are not larger than 1024 characters. + + + If you need to enforce such limit, you can use 25. + + + Note: split groups may not be supported by all tools (even in the + Shadow toolsuite. You should not use this variable unless you really + need it. + + + diff --git a/man/login.defs.d/MD5_CRYPT_ENAB.xml b/man/login.defs.d/MD5_CRYPT_ENAB.xml new file mode 100644 index 00000000..af113748 --- /dev/null +++ b/man/login.defs.d/MD5_CRYPT_ENAB.xml @@ -0,0 +1,28 @@ + + (boolean) + + + Indicate if passwords must be encrypted using the MD5-based + algorithm. If set to yes, new passwords + will be encrypted using the MD5-based algorithm compatible with the + one used by recent releases of FreeBSD. It supports passwords of + unlimited length and longer salt strings. Set to + no if you need to copy encrypted + passwords to other systems which don't understand the new algorithm. + Default is no. + + + This variable is superceded by the + variable or by any command line option used to configure the + encryption algorithm. + + + This variable is deprecated. You should use + . + + + Note: if you use PAM, it is recommended to set this variable + consistently with the PAM modules configuration. + + + diff --git a/man/login.defs.d/PASS_MAX_DAYS.xml b/man/login.defs.d/PASS_MAX_DAYS.xml new file mode 100644 index 00000000..deb0f838 --- /dev/null +++ b/man/login.defs.d/PASS_MAX_DAYS.xml @@ -0,0 +1,10 @@ + + (number) + + + The maximum number of days a password may be used. If the password + is older than this, a password change will be forced. If not + specified, -1 will be assumed (which disables the restriction). + + + diff --git a/man/login.defs.d/PASS_MIN_DAYS.xml b/man/login.defs.d/PASS_MIN_DAYS.xml new file mode 100644 index 00000000..fc726d0f --- /dev/null +++ b/man/login.defs.d/PASS_MIN_DAYS.xml @@ -0,0 +1,10 @@ + + (number) + + + The minimum number of days allowed between password changes. Any + password changes attempted sooner than this will be rejected. If not + specified, -1 will be assumed (which disables the restriction). + + + diff --git a/man/login.defs.d/PASS_WARN_AGE.xml b/man/login.defs.d/PASS_WARN_AGE.xml new file mode 100644 index 00000000..d0c410c2 --- /dev/null +++ b/man/login.defs.d/PASS_WARN_AGE.xml @@ -0,0 +1,11 @@ + + (number) + + + The number of days warning given before a password expires. A zero + means warning is given only upon the day of expiration, a negative + value means no warning is given. If not specified, no warning will + be provided. + + + diff --git a/man/login.defs.d/SHA_CRYPT_MIN_ROUNDS.xml b/man/login.defs.d/SHA_CRYPT_MIN_ROUNDS.xml new file mode 100644 index 00000000..20e57605 --- /dev/null +++ b/man/login.defs.d/SHA_CRYPT_MIN_ROUNDS.xml @@ -0,0 +1,35 @@ + + (number) + (number) + + + When is set to + SHA256 or + SHA512, this defines the number of SHA + rounds used by the encryption algorithm by default (when the number + of rounds is not specified on the command line). + + + With a lot of rounds, it is more difficult to brute forcing the + password. But note also that more CPU resources will be needed to + authenticate users. + + + If not specified, the libc will choose the default number of rounds + (5000). + + + The values must be inside the 1000-999999999 range. + + + If only one of the or + values is set, then this value + will be used. + + + If > + , the highest value will be + used. + + + diff --git a/man/login.defs.d/UID_MAX.xml b/man/login.defs.d/UID_MAX.xml new file mode 100644 index 00000000..b0c76a23 --- /dev/null +++ b/man/login.defs.d/UID_MAX.xml @@ -0,0 +1,10 @@ + + (number) + (number) + + + Range of user IDs to choose from for the useradd + program. + + + diff --git a/man/login.defs.d/UMASK.xml b/man/login.defs.d/UMASK.xml new file mode 100644 index 00000000..66e6188e --- /dev/null +++ b/man/login.defs.d/UMASK.xml @@ -0,0 +1,9 @@ + + (number) + + + The permission mask is initialized to this value. If not specified, + the permission mask will be initialized to 022. + + + diff --git a/man/login.defs.d/USERDEL_CMD.xml b/man/login.defs.d/USERDEL_CMD.xml new file mode 100644 index 00000000..f04fae30 --- /dev/null +++ b/man/login.defs.d/USERDEL_CMD.xml @@ -0,0 +1,10 @@ + + (string) + + + If defined, this command is run when removing a user. It should + remove any at/cron/print jobs etc. owned by the user to be removed + (passed as the first argument). + + +