File shadow-login_defs-suse.patch of Package shadow

Overview Repositories Revisions Requests Users Attributes Meta

File shadow-login_defs-suse.patch of Package shadow (Revision 59ba7cbe7455c73e4588dde02d263141)

Currently displaying revision 59ba7cbe7455c73e4588dde02d263141 , Show latest

Set login.defs defaults for SUSE Linux.

Index: etc/login.defs
===================================================================
--- etc/login.defs.orig
+++ etc/login.defs
@@ -3,6 +3,9 @@
 # Some variables are used by login(1), su(1) and runuser(1) from util-linux
 # package as well pam pam_unix(8) from pam package.
 #
+# For more, see login.defs(5). Please note that SUSE supports only variables
+# listed here! Not listed variables from login.defs(5) have no effect.
+#
 
 #
 # Delay in seconds before being allowed another attempt after a login failure
@@ -52,8 +55,8 @@ CONSOLE		/etc/securetty
 # If defined, ":" delimited list of "message of the day" files to
 # be displayed upon login.
 #
-MOTD_FILE	/etc/motd
-#MOTD_FILE	/etc/motd:/usr/lib/news/news-motd
+MOTD_FILE	""
+#MOTD_FILE	/etc/motd:/usr/share/misc/motd
 
 #
 # If set to "yes", login stops display content specified by MOTD_FILE after
@@ -73,8 +76,8 @@ MOTD_FILE	/etc/motd
 # user's name or shell are found in the file.  If not a full pathname, then
 # hushed mode will be enabled if the file exists in the user's home directory.
 #
-HUSHLOGIN_FILE	.hushlogin
-#HUSHLOGIN_FILE	/etc/hushlogins
+#HUSHLOGIN_FILE	.hushlogin
+HUSHLOGIN_FILE	/etc/hushlogins
 
 # If this variable is set to "yes", hostname will be suppressed in the
 # login: prompt.
@@ -93,9 +96,9 @@ HUSHLOGIN_FILE	.hushlogin
 # ENV_SUPATH is an ENV_ROOTPATH override for su and runuser
 # (and falback for login).
 #
-ENV_PATH	/bin:/usr/bin
-ENV_ROOTPATH	/sbin:/bin:/usr/sbin:/usr/bin
-#ENV_SUPATH	/sbin:/bin:/usr/sbin:/usr/bin
+ENV_PATH	/usr/local/bin:/bin:/usr/bin
+ENV_ROOTPATH	/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+#ENV_SUPATH	/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 
 # If this variable is set to "yes" (default is "no"), su will always set
 # path. every su call will overwrite the PATH variable.
@@ -105,7 +108,7 @@ ENV_ROOTPATH	/sbin:/bin:/usr/sbin:/usr/b
 # The recommended value is "yes". The default "no" behavior could have
 # a security implication in applications that use commands without path.
 #
-ALWAYS_SET_PATH	no
+ALWAYS_SET_PATH	yes
 
 #
 # Terminal permissions
@@ -119,7 +122,7 @@ ALWAYS_SET_PATH	no
 # set TTYPERM to either 622 or 600.
 #
 TTYGROUP	tty
-TTYPERM		0600
+TTYPERM		0620
 
 # Default initial "umask" value used by login(1) on non-PAM enabled systems.
 # Default "umask" value for pam_umask(8) on PAM enabled systems.
@@ -133,7 +136,7 @@ UMASK		022
 # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
 # home directories.
 # If HOME_MODE is not set, the value of UMASK is used to create the mode.
-#HOME_MODE	0700
+HOME_MODE	0700
 
 #
 # Password aging controls:
@@ -157,8 +160,8 @@ PASS_WARN_AGE	7
 UID_MIN			 1000
 UID_MAX			60000
 # System accounts
-SYS_UID_MIN		  101
-SYS_UID_MAX		  999
+SYS_UID_MIN		  100
+SYS_UID_MAX		  499
 # Extra per user uids
 SUB_UID_MIN		   100000
 SUB_UID_MAX		600100000
@@ -175,8 +178,8 @@ SUB_UID_COUNT		    65536
 GID_MIN			 1000
 GID_MAX			60000
 # System accounts
-SYS_GID_MIN		  101
-SYS_GID_MAX		  999
+SYS_GID_MIN		  100
+SYS_GID_MAX		  499
 # Extra per user group ids
 SUB_GID_MIN		   100000
 SUB_GID_MAX		600100000
@@ -185,7 +188,7 @@ SUB_GID_COUNT		    65536
 #
 # Max number of login(1) retries if password is bad
 #
-LOGIN_RETRIES		5
+LOGIN_RETRIES		3
 
 #
 # Tell login to only re-prompt for the password if authentication
@@ -207,18 +210,9 @@ LOGIN_TIMEOUT		60
 CHFN_RESTRICT		rwh
 
 #
-# If set to "yes", new passwords will be encrypted using the MD5-based
-# algorithm compatible with the one used by recent releases of FreeBSD.
-# It supports passwords of unlimited length and longer salt strings.
-# Set to "no" if you need to copy encrypted passwords to other systems
-# which don't understand the new algorithm.  Default is "no".
-#
-# Note: If you use PAM, it is recommended to use a value consistent with
-# the PAM modules configuration.
-#
-# This variable is deprecated. You should use ENCRYPT_METHOD instead.
+# This variable is deprecated. Use ENCRYPT_METHOD instead!
 #
-#MD5_CRYPT_ENAB	no
+#MD5_CRYPT_ENAB	DO_NOT_USE
 
 #
 # If set to MD5, MD5-based algorithm will be used for encrypting password
@@ -233,7 +227,7 @@ CHFN_RESTRICT		rwh
 # Note: If you use PAM, it is recommended to use a value consistent with
 # the PAM modules configuration.
 #
-#ENCRYPT_METHOD DES
+ENCRYPT_METHOD SHA512
 
 #
 # Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
@@ -322,7 +316,7 @@ USERGROUPS_ENAB yes
 # This option is overridden with the -M or -m flags on the useradd(8)
 # command-line.
 #
-#CREATE_HOME     yes
+CREATE_HOME     yes
 
 #
 # Force use shadow, even if shadow passwd & shadow group files are

Places

File shadow-login_defs-suse.patch of Package shadow (Revision 59ba7cbe7455c73e4588dde02d263141)

Places