-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Anybody object to the book using "system" pam configuration files. It
doesn't help things much in BLFS (actually at all yet), but is more
useful as you extend your system.
Also, though I personally don't see the point in BLFS, Debian and Ubuntu
are explicitly denying in the common-{account,auth,password} files to
help and keep you from shooting yourself in the foot (accidental deny or
other unintended failure). The option exists to do conditionals, so it
would be something like the following for system-auth:
# if auth in pam_unix is successful, jump over the next 1 lines
auth [success=1 default=ignore] pam_unix.so
# if we get here, deny and die
auth requisite pam_deny.so
# if we get this far (no requisite), always permit
auth required pam_permit.so
Any interest in that failsafe in BLFS?
Something similar to the following (actually taken mostly from Ubuntu)
is what I would put into the book. Please note that I haven't tested
this (close to existing book) basic configuration below as I have a much
nastier looking PAM stack ATM that I haven't converted to use system-*
(which would have been much easier when all was said and done):
# Begin /etc/pam.d/system-auth
auth required pam_unix.so
# End /etc/pam.d/system-auth
========================================================================
# Begin /etc/pam.d/system-session
session required pam_unix.so
# End /etc/pam.d/system-session
========================================================================
# Begin /etc/pam.d/system-account
account required pam_unix.so
# End /etc/pam.d/system-account
========================================================================
# Begin /etc/pam.d/system-password (with cracklib)
# check new passwords for strength (man pam_cracklib)
password required pam_cracklib.so type=Linux retry=1 difok=5 \
diffignore=23 minlen=9 dcredit=1 \
ucredit=1 lcredit=1 ocredit=1 \
dictpath=/lib/cracklib/pw_dict
# use md5 hash for encryption, use shadow, and use the
# authentication token (chosen password) set by pam_cracklib
# above
password required pam_unix.so md5 shadow use_authtok
# End /etc/pam.d/system-password (with cracklib)
========================================================================
# Begin /etc/pam.d/system-password (without cracklib)
# use md5 hash for encryption and use shadow
password required pam_unix.so md5 shadow
# End /etc/pam.d/system-password (without cracklib)
========================================================================
# Begin /etc/pam.d/login
# Set failure delay before next prompt to 3 seconds
auth optional pam_faildelay.so delay=3000000
# Check to make sure that root is allowed to login
auth required pam_securetty.so
# Check to make sure that the user is allowed to login
auth requisite pam_nologin.so
# Set default environment variables for the user
session required pam_env.so
# include the default auth settings
@include system-auth
# Additional group memberships - disabled by default
#auth optional pam_group.so
# Set resource limits for the user
session required pam_limits.so
# Display date of last login - Disabled by default
#session optional pam_lastlog.so
# Display the message of the day - Disabled by default
#session optional pam_motd.so
# Check user's mail - Disabled by default
#session optional pam_mail.so standard quiet
# Use xauth keys (if available)
session optional pam_xauth.so
# include the default settings
@include system-account
@include system-session
@include system-password
# End /etc/pam.d/login
========================================================================
# Begin /etc/pam.d/passwd
@include system-password
# End /etc/pam.d/passwd
========================================================================
# Begin /etc/pam.d/su
# always allow root
auth sufficient pam_rootok.so
# include the default account and session settings
@include system-account
# Use xauth keys (if available)
session optional pam_xauth.so
# Set default environment variables for the service user
session required pam_env.so
# include system session defaults
@include system-session
# End /etc/pam.d/su
========================================================================
# Begin /etc/pam.d/chage
# always allow root
auth sufficient pam_rootok.so
# include system defaults
@include system-auth
@include system-account
@include system-session
# Always permit for authentication updates
password required pam_permit.so
# End /etc/pam.d/chage
- -- DJ Lucas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
iQIcBAEBAgAGBQJMJZ/MAAoJEIUM+xKzBYsIwowQAK03wma+QyYtnTLf4qVm1AGE
N81DZm/VxULBIsxZ2FDPqXEQLLC6CjkGeotE4rtxQYHR5fB/2CdcrrtmAgbKKkhd
CKQr3dbexgGE1uiNa3Bwo+FsDuUnbGisGIiErUa7WOeqacgDWTOGpZUMQ5rS8fhe
YJ8CAMOpclao1xlro6AeRnV854dAEMpfw8VgqhxSqEMgqBoMQbHXC6dmO5nr+PqI
sT2VQ0+cd0ag8GwPIjYrHFIvCIEI025C2beSGCBzO37+YjlNCx1B6Glsl/pexbvE
LkwO1DI9epsiHKop9l06fKpUXWq0jW3vcLOeiCpLoei0B7blMWGS186ssSavpHmU
w9AUBH0E/taaGutwIaPJK9yPCpBKjScOy0wz3dBKzfzokAw5hXqePJN4eKBWoLeb
46MnwRN7bkmzGKhbJrzRMEe8hjPBeIlz/ekHS8oB2VGjF4NJjFOLmwDU8ukaRbTR
nJ/x6aSW9MRpysfl1GyMJn3eMxs1f/pOchOT8LK9UhtJDad7G3Tx6/mJmoQFTD6j
nzTKAiR8ClEBwNtRSr8SbFB9K8EIOoz7MtSbZo5+UXA8l2v/YSVbra+/hhcHM9ko
FYvUxnL/AiMuDWoPa194SmpXWYahX5ABPYZzmsHGqjRMJRnZXmhwC5Alu6NCNR6C
zCFsLl00sDvnyORS1jkz
=Gcbg
-----END PGP SIGNATURE-----
--
This message has been scanned for viruses and
dangerous content, and is believed to be clean.
--
http://linuxfromscratch.org/mailman/listinfo/blfs-dev
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page
