10.46. Shadow-4.0.16

#### Cross-Compiled Linux From Scratch - Version 1.0.0rc2-Sparc64-Pure64

### Chapter 10. Installing Basic System Software

- Prev

  Psmisc-22.2

- Next

  Sysklogd-1.4.1

- Up.
- Home

# 10.46. Shadow-4.0.16

The Shadow package contains programs for handling passwords in a secure way.

## 10.46.1. Installation of Shadow

### Note

If you would like to enforce the use of strong passwords, refer to http://www.linuxfromscratch.org/blfs/view/svn/postlfs/cracklib.html for installing Cracklib prior to building Shadow. Then add `--with-libcrack` to the configure command below.

Prepare Shadow for compilation:

    ./configure --libdir=/lib --sysconfdir=/etc --enable-shared \
        --without-libpam --without-audit --without-selinux

The meaning of the configure options:

`--without-libpam`

  Support for Linux-PAM is enabled by default in Shadow, however PAM is not installed on a base CLFS system, so this switch disables PAM support in Shadow. For instructions to install PAM and link Shadow to it, you can look at http://www.linuxfromscratch.org/blfs/view/svn/postlfs/shadow.html.

`--without-audit`

  Support for auditing is enabled by default, but a library that it needs is not installed in a base CLFS system. This switch disables auditing support.

`--without-selinux`

  Support for selinux is enabled by default, but selinux is not built in a base CLFS system and configure will fail without this switch.

Disable the installation of the groups program and its man pages, as Coreutils provides a better version:

    sed -i 's/groups$(EXEEXT) //' src/Makefile
    sed -i '/groups/d' man/Makefile

Compile the package:

    make

This package does not come with a test suite.

Install the package:

    make install

Instead of using the default crypt method, use the more secure MD5 method of password encryption, which also allows passwords longer than 8 characters. It is also necessary to change the obsolete `/var/spool/mail` location for user mailboxes that Shadow uses by default to the `/var/mail` location used currently. Use the following sed command to make these changes to the appropriate configuration file:

    sed -i /etc/login.defs \
        -e 's@#MD5_CRYPT_ENAB.no@MD5_CRYPT_ENAB yes@' \
        -e 's@/var/spool/mail@/var/mail@'

### Note

If you built Shadow with Cracklib support, execute this sed to correct the path to the Cracklib dictionary:

    sed -i 's@DICTPATH.*@DICTPATH\t/lib/cracklib/pw_dict@' /etc/login.defs

Move a misplaced program to its proper location:

    mv -v /usr/bin/passwd /bin

Move Shadow's dynamic libraries to a more appropriate location:

    mv -v /lib/libshadow.*a /usr/lib
    rm -v /lib/libshadow.so
    ln -svf ../../lib/libshadow.so.0 /usr/lib/libshadow.so

## 10.46.2. Configuring Shadow

This package contains utilities to add, modify, and delete users and groups; set and change their passwords; and perform other administrative tasks. For a full explanation of what password shadowing means, see the `doc/HOWTO` file within the unpacked source tree. If using Shadow support, keep in mind that programs which need to verify passwords (display managers, FTP programs, pop3 daemons, etc.) must be Shadow-compliant. That is, they need to be able to work with shadowed passwords.

To enable shadowed passwords, run the following command:

    pwconv

To enable shadowed group passwords, run:

    grpconv

To view or change the default settings for new user accounts that you create, you can edit `/etc/default/useradd`. See man useradd or http://www.linuxfromscratch.org/blfs/view/svn/postlfs/skel.html for more information.

## 10.46.3. Setting the root password

Choose a password for user `root` and set it by running:

    passwd root

## 10.46.4. Contents of Shadow

Installed programs: chage, chfn, chpasswd, chgpasswd, chsh, expiry, faillog, gpasswd, groupadd, groupdel, groupmod, grpck, grpconv, grpunconv, lastlog, login, logoutd, newgrp, newusers, nologin, passwd, pwck, pwconv, pwunconv, sg (link to newgrp), useradd, userdel, usermod, vigr (link to vipw), and vipw
Installed libraries: libshadow.[a,so]

### Short Descriptions

chage | Used to change the maximum number of days between obligatory password changes
chfn | Used to change a user's full name and other information
chgpasswd | Used to update group passwords in batch mode
chpasswd | Used to update the passwords of an entire series of user accounts
chsh | Used to change a user's default login shell
expiry | Checks and enforces the current password expiration policy
faillog | Is used to examine the log of login failures, to set a maximum number of failures before an account is blocked, or to reset the failure count
gpasswd | Is used to add and delete members and administrators to groups
groupadd | Creates a group with the given name
groupdel | Deletes the group with the given name
groupmod | Is used to modify the given group's name or GID
grpck | Verifies the integrity of the group files `/etc/group` and `/etc/gshadow`
grpconv | Creates or updates the shadow group file from the normal group file
grpunconv | Updates `/etc/group` from `/etc/gshadow` and then deletes the latter
lastlog | Reports the most recent login of all users or of a given user
login | Is used by the system to let users sign on
logoutd | Is a daemon used to enforce restrictions on log-on time and ports
newgrp | Is used to change the current GID during a login session
newusers | Is used to create or update an entire series of user accounts
nologin | Displays a message that an account is not available. Designed to be used as the default shell for accounts that have been disabled
passwd | Is used to change the password for a user or group account
pwck | Verifies the integrity of the password files `/etc/passwd` and `/etc/shadow`
pwconv | Creates or updates the shadow password file from the normal password file
pwunconv | Updates `/etc/passwd` from `/etc/shadow` and then deletes the latter
sg | Executes a given command while the user's GID is set to that of the given group
su | Runs a shell with substitute user and group IDs
useradd | Creates a new user with the given name, or updates the default new-user information
userdel | Deletes the given user account
usermod | Is used to modify the given user's login name, User Identification (UID), shell, initial group, home directory, etc.
vigr | Edits the `/etc/group` or `/etc/gshadow` files
vipw | Edits the `/etc/passwd` or `/etc/shadow` files
`libshadow` | Contains functions used by most programs in this package

- Prev

  Psmisc-22.2

- Next

  Sysklogd-1.4.1

- Up.
- Home.