Attachment 863224 Details for Bug 1205783

file_1205783.txt (text/plain), 10.28 KB, created by B on 2022-11-30 16:16:03 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: B

Created: 2022-11-30 16:16:03 UTC

Size: 10.28 KB

patch

obsolete

>#
># /etc/login.defs - Configuration control definitions for the shadow package.
># Some variables are used by login(1), su(1) and runuser(1) from util-linux
># package as well pam pam_unix(8) from pam package.
>#
># For more, see login.defs(5). Please note that SUSE supports only variables
># listed here! Not listed variables from login.defs(5) have no effect.
>#
>
>#
># Delay in seconds before being allowed another attempt after a login failure
># Note: When PAM is used, some modules may enforce a minimum delay (e.g.
>#       pam_unix(8) enforces a 2s delay)
>#
>FAIL_DELAY		3
>
>#
># Enable display of unknown usernames when login(1) failures are recorded.
>#
>LOG_UNKFAIL_ENAB	no
>
>#
># Enable "syslog" logging of  newgrp(1) and sg(1) activity.
>#
>
>#
># Limit the highest user ID number for which the lastlog entries should
># be updated.
>#
># No LASTLOG_UID_MAX means that there is no user ID limit for writing
># lastlog entries.
>#
>#LASTLOG_UID_MAX
>
>#
># Enable "syslog" logging of newgrp(1) and sg(1) activity - in addition
># to sulog file logging.
>#
>SYSLOG_SG_ENAB		yes
>
>#
># If defined, either full pathname of a file containing device names or
># a ":" delimited list of device names.  Root logins will be allowed only
># from these devices.
>#
>CONSOLE		/etc/securetty
>#CONSOLE	console:tty01:tty02:tty03:tty04
>
>#
># If defined, all su(1) activity is logged to this file.
>#
>#SULOG_FILE	/var/log/sulog
>
>#
># If defined, ":" delimited list of "message of the day" files to
># be displayed upon login.
>#
>MOTD_FILE	""
>#MOTD_FILE	/etc/motd:/usr/share/misc/motd
>
>#
># If set to "yes", login stops display content specified by MOTD_FILE after
># the first accessible item in the list.
>#
>#MOTD_FIRSTONLY	no
>
>#
># If defined, file which maps tty line to TERM environment parameter.
># Each line of the file is in a format similar to "vt100  tty01".
>#
>#TTYTYPE_FILE	/etc/ttytype
>
>#
># If defined, file which inhibits all the usual chatter during the login
># sequence.  If a full pathname, then hushed mode will be enabled if the
># user's name or shell are found in the file.  If not a full pathname, then
># hushed mode will be enabled if the file exists in the user's home directory.
>#
>#HUSHLOGIN_FILE	.hushlogin
>HUSHLOGIN_FILE	/etc/hushlogins
>
># If this variable is set to "yes", hostname will be suppressed in the
># login: prompt.
>#LOGIN_PLAIN_PROMPT	no
>
>#
># *REQUIRED*  The default PATH settings, for superuser and normal users.
>#
># (they are minimal, add the rest in the shell startup files)
>#
># ENV_PATH: The default PATH settings for non-root.
>#
># ENV_ROOTPATH: The default PATH settings for root
># (used by login, su and runuser).
>#
># ENV_SUPATH is an ENV_ROOTPATH override for su and runuser
># (and falback for login).
>#
>ENV_PATH	/usr/local/bin:/bin:/usr/bin
>ENV_ROOTPATH	/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
>#ENV_SUPATH	/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
>
># If this variable is set to "yes" (default is "no"), su will always set
># path. every su call will overwrite the PATH variable.
>#
># Per default, only "su -" will set a new PATH.
>#
># The recommended value is "yes". The default "no" behavior could have
># a security implication in applications that use commands without path.
>#
>ALWAYS_SET_PATH	yes
>
>#
># Terminal permissions
>#
>#	TTYGROUP	Login tty will be assigned this group ownership.
>#	TTYPERM		Login tty will be set to this permission.
>#
># If you have a write(1) program which is "setgid" to a special group
># which owns the terminals, define TTYGROUP as the number of such group
># and TTYPERM as 0620.  Otherwise leave TTYGROUP commented out and
># set TTYPERM to either 622 or 600.
>#
>TTYGROUP	tty
>TTYPERM		0620
>
># Default initial "umask" value used by login(1) on non-PAM enabled systems.
># Default "umask" value for pam_umask(8) on PAM enabled systems.
># UMASK is also used by useradd(8) and newusers(8) to set the mode for new
># home directories if HOME_MODE is not set.
># 022 is the default value, but 027, or even 077, could be considered
># for increased privacy. There is no One True Answer here: each sysadmin
># must make up their mind.
>UMASK		022
>
># HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
># home directories.
># If HOME_MODE is not set, the value of UMASK is used to create the mode.
>HOME_MODE	0700
>
>#
># Password aging controls:
>#
>#	PASS_MAX_DAYS	Maximum number of days a password may be used.
>#	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
>#	PASS_WARN_AGE	Number of days warning given before a password expires.
>#
>PASS_MAX_DAYS	99999
>PASS_MIN_DAYS	0
>PASS_WARN_AGE	7
>
>#
># Min/max values for automatic uid selection in useradd(8)
>#
># SYS_UID_MIN to SYS_UID_MAX inclusive is the range for
># UIDs for dynamically allocated administrative and system accounts.
># UID_MIN to UID_MAX inclusive is the range of UIDs of dynamically
># allocated user accounts.
>#
>UID_MIN			 1000
>UID_MAX			60000
># System accounts
>SYS_UID_MIN		  100
>SYS_UID_MAX		  499
># Extra per user uids
>SUB_UID_MIN		   100000
>SUB_UID_MAX		600100000
>SUB_UID_COUNT		    65536
>
>#
># Min/max values for automatic gid selection in groupadd(8)
>#
># SYS_GID_MIN to SYS_GID_MAX inclusive is the range for
># GIDs for dynamically allocated administrative and system groups.
># GID_MIN to GID_MAX inclusive is the range of GIDs of dynamically
># allocated groups.
>#
>GID_MIN			 1000
>GID_MAX			60000
># System accounts
>SYS_GID_MIN		  100
>SYS_GID_MAX		  499
># Extra per user group ids
>SUB_GID_MIN		   100000
>SUB_GID_MAX		600100000
>SUB_GID_COUNT		    65536
>
>#
># Max number of login(1) retries if password is bad
>#
>LOGIN_RETRIES		3
>
>#
># Tell login to only re-prompt for the password if authentication
># failed, but the username is valid. The default value is no.
>#
>LOGIN_KEEP_USERNAME	no
>
>#
># Max time in seconds for login(1)
>#
>LOGIN_TIMEOUT		60
>
>#
># Which fields may be changed by regular users using chfn(1) - use
># any combination of letters "frwh" (full name, room number, work
># phone, home phone).  If not defined, no changes are allowed.
># For backward compatibility, "yes" = "rwh" and "no" = "frwh".
>#
>CHFN_RESTRICT		rwh
>
>#
># This variable is deprecated. Use ENCRYPT_METHOD instead!
>#
>#MD5_CRYPT_ENAB	DO_NOT_USE
>
>#
># If set to MD5, MD5-based algorithm will be used for encrypting password
># If set to SHA256, SHA256-based algorithm will be used for encrypting password
># If set to SHA512, SHA512-based algorithm will be used for encrypting password
># If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
># If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password
># If set to DES, DES-based algorithm will be used for encrypting password (default)
># MD5 and DES should not be used for new hashes, see crypt(5) for recommendations.
># Overrides the MD5_CRYPT_ENAB option
>#
># Note: If you use PAM, it is recommended to use a value consistent with
># the PAM modules configuration.
>#
>ENCRYPT_METHOD SHA512
>
>#
># Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
>#
># Define the number of SHA rounds.
># With a lot of rounds, it is more difficult to brute-force the password.
># However, more CPU resources will be needed to authenticate users if
># this value is increased.
>#
># If not specified, the libc will choose the default number of rounds (5000),
># which is orders of magnitude too low for modern hardware.
># The values must be within the 1000-999999999 range.
># If only one of the MIN or MAX values is set, then this value will be used.
># If MIN > MAX, the highest value will be used.
>#
>#SHA_CRYPT_MIN_ROUNDS 5000
>#SHA_CRYPT_MAX_ROUNDS 5000
>
>#
># Should login be allowed if we can't cd to the home directory?
># Default is no.
>#
>DEFAULT_HOME	yes
>
>#
># The pwck(8) utility emits a warning for any system account with a home
># directory that does not exist.  Some system accounts intentionally do
># not have a home directory.  Such accounts may have this string as
># their home directory in /etc/passwd to avoid a spurious warning.
>#
>NONEXISTENT	/nonexistent
>
>#
># If defined, this command is run when adding a user.
># It should rebuild any NIS database etc. to add the
># new created account.
>#
>USERADD_CMD             /usr/sbin/useradd.local
>
>#
># If defined, this command is run when removing a user.
># It should remove any at/cron/print jobs etc. owned by
># the user to be removed (passed as the first argument).
>#
># See also USERDEL_PRECMD and USERDEL_POSTCMD below.
>#
>#USERDEL_CMD	/usr/sbin/userdel_local
>
>#
># If defined, this command is run before removing a user.
># It should remove any at/cron/print jobs etc. owned by
># the user to be removed.
>#
>USERDEL_PRECMD          /usr/sbin/userdel-pre.local
>
>#
># If defined, this command is run after removing a user.
># It should rebuild any NIS database etc. to remove the
># account from it.
>#
>USERDEL_POSTCMD         /usr/sbin/userdel-post.local
>
>#
># Enable setting of the umask group bits to be the same as owner bits
># (examples: 022 -> 002, 077 -> 007) for non-root users, if the uid is
># the same as gid, and username is the same as the primary group name.
>#
># This also enables userdel(8) to remove user groups if no members exist.
>#
>USERGROUPS_ENAB yes
>
>#
># If set to a non-zero number, the shadow utilities will make sure that
># groups never have more than this number of users on one line.
># This permits to support split groups (groups split into multiple lines,
># with the same group ID, to avoid limitation of the line length in the
># group file).
>#
># 0 is the default value and disables this feature.
>#
>#MAX_MEMBERS_PER_GROUP	0
>
>#
># If useradd(8) should create home directories for users by default (non
># system users only).
># This option is overridden with the -M or -m flags on the useradd(8)
># command-line.
>#
>CREATE_HOME     yes
>
>#
># Force use shadow, even if shadow passwd & shadow group files are
># missing.
>#
>#FORCE_SHADOW    yes
>
>#
># Allow newuidmap and newgidmap when running under an alternative
># primary group.
>#
>#GRANT_AUX_GROUP_SUBIDS yes
>
>#
># Select the HMAC cryptography algorithm.
># Used in pam_timestamp module to calculate the keyed-hash message
># authentication code.
>#
># Note: It is recommended to check hmac(3) to see the possible algorithms
># that are available in your system.
>#
>#HMAC_CRYPTO_ALGO SHA512

Actions: View

Attachments on bug 1205783: 863173 | 863208 | 863209 | 863224