login.defs 5 File Formats and Conversions login.defs shadow password suite configuration The /etc/login.defs file defines the site-specific configuration for the shadow password suite. This file is required. Absence of this file will not prevent system operation, but will probably result in undesirable operation. This file is a readable text file, each line of the file describing one configuration parameter. The lines consist of a configuration name and value, separated by whitespace. Blank lines and comment lines are ignored. Comments are introduced with a "#" pound sign and the pound sign must be the first non-white character of the line. Parameter values may be of four types: strings, booleans, numbers, and long numbers. A string is comprised of any printable characters. A boolean should be either the value yes or no. An undefined boolean parameter or one with a value other than these will be given a no value. Numbers (both regular and long) may be either decimal values, octal values (precede the value with 0) or hexadecimal values (precede the value with 0x). The maximum value of the regular and long numeric parameters is machine-dependent. The following configuration items are provided: CHFN_AUTH (boolean) If yes, the chfn and chsh programs will require authentication before making any changes, unless run by the superuser. CHFN_RESTRICT (string) This parameter specifies which values in the gecos field of the /etc/passwd file may be changed by regular users using the chfn program. It can be any combination of letters f, r, w, h, for Full name, Room number, Work phone, and Home phone, respectively. For backward compatibility, yes is equivalent to rwh and no is equivalent to frwh. If not specified, only the superuser can make any changes. The most restrictive setting is better achieved by not installing chfn SUID. ENCRYPT_METHOD (string) This defines the system default encryption algorithm for encrypting passwords (if no algorithm are specified on the command line). It can take one of these values: DES (default) MD5 SHA256 SHA512 Note: this parameter overrides the MD5_CRYPT_ENAB variable. Note: if you use PAM, it is recommended to set this variable consistently with the PAM modules configuration. GID_MAX (number) GID_MIN (number) Range of group IDs to choose from for the useradd and groupadd programs. MAIL_DIR (string) The mail spool directory. This is needed to manipulate the mailbox when its corresponding user account is modified or deleted. If not specified, a compile-time default is used. MAX_MEMBERS_PER_GROUP (number) Maximum members per group entry. When the maximum is reached, a new group entry (line) is started in /etc/group (with the same name, same password, and same GID). The default value is 0, meaning that there are no limits in the number of members in a group. This feature (split group) permits to limit the length of lines in the group file. This is useful to make sure that lines for NIS groups are not larger than 1024 characters. If you need to enforce such limit, you can use 25. Note: split groups may not be supported by all tools (even in the Shadow toolsuite. You should not use this variable unless you really need it. MD5_CRYPT_ENAB (boolean) Indicate if passwords must be encrypted using the MD5-based algorithm. If set to yes, new passwords will be encrypted using the MD5-based algorithm compatible with the one used by recent releases of FreeBSD. It supports passwords of unlimited length and longer salt strings. Set to no if you need to copy encrypted passwords to other systems which don't understand the new algorithm. Default is no. This variable is superceded by the ENCRYPT_METHOD variable or by any command line option used to configure the encryption algorithm. This variable is deprecated. You should use ENCRYPT_METHOD. Note: if you use PAM, it is recommended to set this variable consistently with the PAM modules configuration. PASS_MAX_DAYS (number) The maximum number of days a password may be used. If the password is older than this, a password change will be forced. If not specified, -1 will be assumed (which disables the restriction). PASS_MIN_DAYS (number) The minimum number of days allowed between password changes. Any password changes attempted sooner than this will be rejected. If not specified, -1 will be assumed (which disables the restriction). PASS_WARN_AGE (number) The number of days warning given before a password expires. A zero means warning is given only upon the day of expiration, a negative value means no warning is given. If not specified, no warning will be provided. PASS_MAX_DAYS, PASS_MIN_DAYS and PASS_WARN_AGE are only used at the time of account creation. Any changes to these settings won't affect existing accounts. SHA_CRYPT_MIN_ROUNDS (number) SHA_CRYPT_MAX_ROUNDS (number) When ENCRYPT_METHOD is set to SHA256 or SHA512, this defines the number of SHA rounds used by the encryption algorithm by default (when the number of rounds is not specified on the command line). With a lot of rounds, it is more difficult to brute forcing the password. But note also that more CPU resources will be needed to authenticate users. If not specified, the libc will choose the default number of rounds (5000). The values must be inside the 1000-999999999 range. If only one of the SHA_CRYPT_MIN_ROUNDS or SHA_CRYPT_MAX_ROUNDS values is set, then this value will be used. If SHA_CRYPT_MIN_ROUNDS > SHA_CRYPT_MAX_ROUNDS, the highest value will be used. UID_MAX (number) UID_MIN (number) Range of user IDs to choose from for the useradd program. UMASK (number) The permission mask is initialized to this value. If not specified, the permission mask will be initialized to 022. USERDEL_CMD (string) If defined, this command is run when removing a user. It should remove any at/cron/print jobs etc. owned by the user to be removed (passed as the first argument). The following cross reference shows which programs in the shadow password suite use which parameters. chfn CHFN_AUTH CHFN_RESTRICT chgpasswd MD5_CRYPT_ENAB ENCRYPT_METHOD SHA_CRYPT_MIN_ROUNDS SHA_CRYPT_MAX_ROUNDS MAX_MEMBERS_PER_GROUP chpasswd MD5_CRYPT_ENAB ENCRYPT_METHOD SHA_CRYPT_MIN_ROUNDS SHA_CRYPT_MAX_ROUNDS chsh CHFN_AUTH groupadd GID_MAX GID_MIN newusers PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE UMASK pwconv PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE useradd GID_MAX GID_MIN PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE UID_MAX UID_MIN UMASK userdel MAIL_DIR USERDEL_CMD usermod MAIL_DIR Much of the functionality that used to be provided by the shadow password suite is now handled by PAM. Thus, /etc/login.defs is no longer used by programs such as: login1 , passwd1 , su1 . Please refer to the corresponding PAM configuration files instead. login1 , passwd1 , su1 , passwd5 , shadow5 , pam8 .