From: nekral-guest Date: Mon, 26 Nov 2007 22:11:23 +0000 (+0000) Subject: Put each variable description in an external entities. This will permit to X-Git-Tag: 4.1.0~15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b75fe4940b1a5f51747d54e38d1ef3cdf168192c;p=thirdparty%2Fshadow.git Put each variable description in an external entities. This will permit to reference them in the various utils manpages. --- diff --git a/ChangeLog b/ChangeLog index 5fc7c7ba7..e7b69c5e2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,17 @@ +2007-11-26 Nicolas François + + * man/login.defs.d/, man/login.defs.d/CHFN_RESTRICT.xml, + man/login.defs.d/MAIL_DIR.xml, man/login.defs.d/PASS_MAX_DAYS.xml, + man/login.defs.d/SHA_CRYPT_MIN_ROUNDS.xml, + man/login.defs.d/CHFN_AUTH.xml, man/login.defs.d/MD5_CRYPT_ENAB.xml, + man/login.defs.d/PASS_WARN_AGE.xml, ·man/login.defs.d/UMASK.xml, + man/login.defs.d/PASS_MIN_DAYS.xml, man/login.defs.d/UID_MAX.xml, + man/login.defs.d/LOGIN_STRING.xml, man/login.defs.d/GID_MAX.xml, + man/login.defs.d/ENCRYPT_METHOD.xml, man/login.defs.d/USERDEL_CMD.xml, + man/login.defs.d/MAX_MEMBERS_PER_GROUP.xml, man/login.defs.5.xml: + Put each variable description in an external entities. This will permit + to reference them in the various utils manpages. + 2007-11-26 Nicolas François * po/stats: Do not generate gmo files. diff --git a/man/login.defs.5.xml b/man/login.defs.5.xml index 15148b3c3..1dad9a92e 100644 --- a/man/login.defs.5.xml +++ b/man/login.defs.5.xml @@ -1,4 +1,23 @@ + + + + + + + + + + + + + + + +]> + @@ -46,313 +65,182 @@ The following configuration items are provided: + &CHFN_AUTH; + &CHFN_RESTRICT; + &ENCRYPT_METHOD; + &GID_MAX; + &LOGIN_STRING; + &MAIL_DIR; + &MAX_MEMBERS_PER_GROUP; + &MD5_CRYPT_ENAB; + &PASS_MAX_DAYS; + &PASS_MIN_DAYS; + &PASS_WARN_AGE; + + + , and + are only used at the + time of account creation. Any changes to these settings won't affect + existing accounts. + + + &SHA_CRYPT_MIN_ROUNDS; + &UID_MAX; + &UMASK; + &USERDEL_CMD; + + + + + CROSS REFERENCE + + The following cross reference shows which programs in the shadow + password suite use which parameters. + + + + - (boolean) + chfn - If yes, the - chfn and chsh programs - will require authentication before making any changes, unless - run by the superuser. + CHFN_AUTH CHFN_RESTRICT + LOGIN_STRING - (string) + chgpasswd - This parameter specifies which values in the gecos field of the - /etc/passwd file may be changed by regular - users using the chfn program. It can be any - combination of letters f, - r, w, - h, for Full name, Room number, - Work phone, and Home phone, respectively. For backward - compatibility, yes is equivalent to - rwh and - no is - equivalent to frwh. If not specified, - only the superuser can - make any changes. The most restrictive setting is better - achieved by not installing chfn SUID. + ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB + SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS - (string) + chpasswd - This defines the system default encryption algorithm for - encrypting passwords (if no algorithm are specified on the - command line). - - - It can take one of these values: - - - DES (default) - - - MD5 - - - SHA256 - - - SHA512 - - - - - Note: this parameter overrides the - variable. - - - Note: if you use PAM, it is recommended to set this variable - consistently with the PAM modules configuration. + ENCRYPT_METHOD MD5_CRYPT_ENAB SHA_CRYPT_MAX_ROUNDS + SHA_CRYPT_MIN_ROUNDS - (number) - (number) + chsh - Range of group IDs to choose from for the - useradd and groupadd - programs. + CHFN_AUTH + LOGIN_STRING - - (string) + + expiry - - The mail spool directory. This is needed to manipulate the - mailbox when its corresponding user account is modified or - deleted. If not specified, a compile-time default is used. - + CONSOLE_GROUPS + - (number) + gpasswd - Maximum members per group entry. When the maximum is reached, - a new group entry (line) is started in - /etc/group (with the same name, same - password, and same GID). - - - The default value is 0, meaning that there are no limits in - the number of members in a group. - - - - This feature (split group) permits to limit the length of - lines in the group file. This is useful to make sure that - lines for NIS groups are not larger than 1024 characters. - - - If you need to enforce such limit, you can use 25. - - - Note: split groups may not be supported by all tools (even in - the Shadow toolsuite. You should not use this variable unless - you really need it. + ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB + SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS - (boolean) + groupadd - - Indicate if passwords must be encrypted using the MD5-based - algorithm. If set to yes, new - passwords will be encrypted - using the MD5-based algorithm compatible with the one used by - recent releases of FreeBSD. It supports passwords of - unlimited length and longer salt strings. Set to - no if you - need to copy encrypted passwords to other systems which don't - understand the new algorithm. Default is - no. - - - This variable is superceded by the - variable or by any command - line option used to configure the encryption algorithm. - - - This variable is deprecated. You should use - . - - - Note: if you use PAM, it is recommended to set this variable - consistently with the PAM modules configuration. - + GID_MAX GID_MIN MAX_MEMBERS_PER_GROUP - (number) + groupdel - - The maximum number of days a password may be used. If the - password is older than this, a password change will be forced. - If not specified, -1 will be assumed (which disables the - restriction). - + MAX_MEMBERS_PER_GROUP - (number) + groupmod - - The minimum number of days allowed between password changes. - Any password changes attempted sooner than this will be - rejected. If not specified, -1 will be assumed (which disables - the restriction). - + MAX_MEMBERS_PER_GROUP + - (number) + grpck - - The number of days warning given before a password expires. A - zero means warning is given only upon the day of expiration, a - negative value means no warning is given. If not specified, no - warning will be provided. - + MAX_MEMBERS_PER_GROUP - - - - , and - are only used at the - time of account creation. Any changes to these settings won't affect - existing accounts. - - - (number) - (number) + grpconv - - When is set to - SHA256 or - SHA512, this defines the number of - SHA rounds used by the encryption algorithm by default (when - the number of rounds is not specified on the command line). - - - With a lot of rounds, it is more difficult to brute forcing - the password. But note also that more CPU resources will be - needed to authenticate users. - - - If not specified, the libc will choose the default number of - rounds (5000). - - - The values must be inside the 1000-999999999 range. - - - If only one of the or - values is set, then this - value will be used. - - - If > - , the highest value will - be used. - + MAX_MEMBERS_PER_GROUP - (number) - (number) + grpunconv - - Range of user IDs to choose from for the - useradd program. - + MAX_MEMBERS_PER_GROUP + + - (number) + login - The permission mask is initialized to this value. If not - specified, the permission mask will be initialized to 022. + CONSOLE CONSOLE_GROUPS DEFAULT_HOME ENV_HZ ENV_PATH ENV_SUPATH + ENV_TZ ENVIRON_FILE ERASECHAR FAIL_DELAY FAILLOG_ENAB + FAKE_SHELL FTMP_FILE HUSHLOGIN_FILE ISSUE_FILE KILLCHAR + LASTLOG_ENAB LOGIN_RETRIES LOGIN_STRING LOGIN_TIMEOUT + LOG_OK_LOGINS LOG_UNKFAIL_ENAB MAIL_CHECK_ENAB MAIL_DIR + MAIL_FILE MOTD_FILE NOLOGINS_FILE PORTTIME_CHECKS_ENAB + QUOTAS_ENAB TTYGROUP TTYPERM TTYTYPE_FILE ULIMIT UMASK + USERGROUPS_ENAB + - (string) + newgrp - If defined, this command is run when removing a user. It should - remove any at/cron/print jobs etc. owned by the user to be - removed (passed as the first argument). + SYSLOG_SG_ENAB - - - - - CROSS REFERENCE - - The following cross reference shows which programs in the shadow - password suite use which parameters. - - - - - chfn - - CHFN_AUTH CHFN_RESTRICT - - - chgpasswd + newusers - MD5_CRYPT_ENAB ENCRYPT_METHOD SHA_CRYPT_MIN_ROUNDS - SHA_CRYPT_MAX_ROUNDS MAX_MEMBERS_PER_GROUP + ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB + PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE SHA_CRYPT_MIN_ROUNDS + UMASK + - chpasswd + passwd - MD5_CRYPT_ENAB ENCRYPT_METHOD SHA_CRYPT_MIN_ROUNDS - SHA_CRYPT_MAX_ROUNDS + ENCRYPT_METHOD MD5_CRYPT_ENAB OBSCURE_CHECKS_ENAB + PASS_ALWAYS_WARN PASS_CHANGE_TRIES PASS_MAX_LEN PASS_MIN_LEN + SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS - chsh - - CHFN_AUTH - - - - groupadd - - GID_MAX GID_MIN - - - - newusers + pwck - PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE UMASK + PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE @@ -362,6 +250,7 @@ PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE + useradd diff --git a/man/login.defs.d/CHFN_AUTH.xml b/man/login.defs.d/CHFN_AUTH.xml new file mode 100644 index 000000000..e65c04c58 --- /dev/null +++ b/man/login.defs.d/CHFN_AUTH.xml @@ -0,0 +1,10 @@ + + (boolean) + + + If yes, the chfn and + chsh programs will require authentication before + making any changes, unless run by the superuser. + + + diff --git a/man/login.defs.d/CHFN_RESTRICT.xml b/man/login.defs.d/CHFN_RESTRICT.xml new file mode 100644 index 000000000..237b20915 --- /dev/null +++ b/man/login.defs.d/CHFN_RESTRICT.xml @@ -0,0 +1,21 @@ + + (string) + + + This parameter specifies which values in the gecos field of the + /etc/passwd file may be changed by regular + users using the chfn program. It can be any + combination of letters f, + r, w, + h, for Full name, Room number, Work + phone, and Home phone, respectively. For backward compatibility, + yes is equivalent to + rwh and no is + equivalent to frwh. If not specified, + only the superuser can make any changes. The most restrictive + setting is better achieved by not installing chfn + SUID. + + + diff --git a/man/login.defs.d/ENCRYPT_METHOD.xml b/man/login.defs.d/ENCRYPT_METHOD.xml new file mode 100644 index 000000000..563104a5e --- /dev/null +++ b/man/login.defs.d/ENCRYPT_METHOD.xml @@ -0,0 +1,34 @@ + + (string) + + + This defines the system default encryption algorithm for encrypting + passwords (if no algorithm are specified on the command line). + + + It can take one of these values: + + + DES (default) + + + MD5 + + + SHA256 + + + SHA512 + + + + + Note: this parameter overrides the + variable. + + + Note: if you use PAM, it is recommended to set this variable + consistently with the PAM modules configuration. + + + diff --git a/man/login.defs.d/GID_MAX.xml b/man/login.defs.d/GID_MAX.xml new file mode 100644 index 000000000..d6d9a8cb0 --- /dev/null +++ b/man/login.defs.d/GID_MAX.xml @@ -0,0 +1,10 @@ + + (number) + (number) + + + Range of group IDs to choose from for the useradd + and groupadd programs. + + + diff --git a/man/login.defs.d/LOGIN_STRING.xml b/man/login.defs.d/LOGIN_STRING.xml new file mode 100644 index 000000000..55c5346bb --- /dev/null +++ b/man/login.defs.d/LOGIN_STRING.xml @@ -0,0 +1,10 @@ + + (string) + + + The string used for prompting a password. The default is to use + "Password: ", or a translation of that string. If you set this + variable, the prompt will no be translated. + + + diff --git a/man/login.defs.d/MAIL_DIR.xml b/man/login.defs.d/MAIL_DIR.xml new file mode 100644 index 000000000..ab6a485c4 --- /dev/null +++ b/man/login.defs.d/MAIL_DIR.xml @@ -0,0 +1,10 @@ + + (string) + + + The mail spool directory. This is needed to manipulate the mailbox + when its corresponding user account is modified or deleted. If not + specified, a compile-time default is used. + + + diff --git a/man/login.defs.d/MAX_MEMBERS_PER_GROUP.xml b/man/login.defs.d/MAX_MEMBERS_PER_GROUP.xml new file mode 100644 index 000000000..ca33dac7d --- /dev/null +++ b/man/login.defs.d/MAX_MEMBERS_PER_GROUP.xml @@ -0,0 +1,29 @@ + + (number) + + + Maximum members per group entry. When the maximum is reached, a new + group entry (line) is started in /etc/group + (with the same name, same password, and same GID). + + + The default value is 0, meaning that there are no limits in the + number of members in a group. + + + + This feature (split group) permits to limit the length of lines in + the group file. This is useful to make sure that lines for NIS + groups are not larger than 1024 characters. + + + If you need to enforce such limit, you can use 25. + + + Note: split groups may not be supported by all tools (even in the + Shadow toolsuite. You should not use this variable unless you really + need it. + + + diff --git a/man/login.defs.d/MD5_CRYPT_ENAB.xml b/man/login.defs.d/MD5_CRYPT_ENAB.xml new file mode 100644 index 000000000..af113748e --- /dev/null +++ b/man/login.defs.d/MD5_CRYPT_ENAB.xml @@ -0,0 +1,28 @@ + + (boolean) + + + Indicate if passwords must be encrypted using the MD5-based + algorithm. If set to yes, new passwords + will be encrypted using the MD5-based algorithm compatible with the + one used by recent releases of FreeBSD. It supports passwords of + unlimited length and longer salt strings. Set to + no if you need to copy encrypted + passwords to other systems which don't understand the new algorithm. + Default is no. + + + This variable is superceded by the + variable or by any command line option used to configure the + encryption algorithm. + + + This variable is deprecated. You should use + . + + + Note: if you use PAM, it is recommended to set this variable + consistently with the PAM modules configuration. + + + diff --git a/man/login.defs.d/PASS_MAX_DAYS.xml b/man/login.defs.d/PASS_MAX_DAYS.xml new file mode 100644 index 000000000..deb0f8381 --- /dev/null +++ b/man/login.defs.d/PASS_MAX_DAYS.xml @@ -0,0 +1,10 @@ + + (number) + + + The maximum number of days a password may be used. If the password + is older than this, a password change will be forced. If not + specified, -1 will be assumed (which disables the restriction). + + + diff --git a/man/login.defs.d/PASS_MIN_DAYS.xml b/man/login.defs.d/PASS_MIN_DAYS.xml new file mode 100644 index 000000000..fc726d0f9 --- /dev/null +++ b/man/login.defs.d/PASS_MIN_DAYS.xml @@ -0,0 +1,10 @@ + + (number) + + + The minimum number of days allowed between password changes. Any + password changes attempted sooner than this will be rejected. If not + specified, -1 will be assumed (which disables the restriction). + + + diff --git a/man/login.defs.d/PASS_WARN_AGE.xml b/man/login.defs.d/PASS_WARN_AGE.xml new file mode 100644 index 000000000..d0c410c2b --- /dev/null +++ b/man/login.defs.d/PASS_WARN_AGE.xml @@ -0,0 +1,11 @@ + + (number) + + + The number of days warning given before a password expires. A zero + means warning is given only upon the day of expiration, a negative + value means no warning is given. If not specified, no warning will + be provided. + + + diff --git a/man/login.defs.d/SHA_CRYPT_MIN_ROUNDS.xml b/man/login.defs.d/SHA_CRYPT_MIN_ROUNDS.xml new file mode 100644 index 000000000..20e57605b --- /dev/null +++ b/man/login.defs.d/SHA_CRYPT_MIN_ROUNDS.xml @@ -0,0 +1,35 @@ + + (number) + (number) + + + When is set to + SHA256 or + SHA512, this defines the number of SHA + rounds used by the encryption algorithm by default (when the number + of rounds is not specified on the command line). + + + With a lot of rounds, it is more difficult to brute forcing the + password. But note also that more CPU resources will be needed to + authenticate users. + + + If not specified, the libc will choose the default number of rounds + (5000). + + + The values must be inside the 1000-999999999 range. + + + If only one of the or + values is set, then this value + will be used. + + + If > + , the highest value will be + used. + + + diff --git a/man/login.defs.d/UID_MAX.xml b/man/login.defs.d/UID_MAX.xml new file mode 100644 index 000000000..b0c76a234 --- /dev/null +++ b/man/login.defs.d/UID_MAX.xml @@ -0,0 +1,10 @@ + + (number) + (number) + + + Range of user IDs to choose from for the useradd + program. + + + diff --git a/man/login.defs.d/UMASK.xml b/man/login.defs.d/UMASK.xml new file mode 100644 index 000000000..66e6188ed --- /dev/null +++ b/man/login.defs.d/UMASK.xml @@ -0,0 +1,9 @@ + + (number) + + + The permission mask is initialized to this value. If not specified, + the permission mask will be initialized to 022. + + + diff --git a/man/login.defs.d/USERDEL_CMD.xml b/man/login.defs.d/USERDEL_CMD.xml new file mode 100644 index 000000000..f04fae30a --- /dev/null +++ b/man/login.defs.d/USERDEL_CMD.xml @@ -0,0 +1,10 @@ + + (string) + + + If defined, this command is run when removing a user. It should + remove any at/cron/print jobs etc. owned by the user to be removed + (passed as the first argument). + + +