LOGIN.DEFS | Début | Précédent | Suivant | Sommaire | Préc.page.lue | Accueil |
NOM | Début | Précédent | Suivant | Sommaire | Préc.page.lue | Accueil |
DESCRIPTION | Début | Précédent | Suivant | Sommaire | Préc.page.lue | Accueil |
Le fichier /etc/login.defs définit la configuration de la suite shadow password (mots de passe cachés) pour le système. Ce fichier est indispensable. Son absence n'empêchera pas le système de fonctionner, mais aura probablement des conséquences indésirables.
Ce fichier est un fichier texte, dont chaque ligne décrit un paramètre de configuration. Les lignes consistent en un nom et une valeur, séparés par un espace. Les lignes blanches et les lignes de commentaires sont ignorées. Les commentaires commencent par un caractère Fo # Fc, qui doit être le premier caractère non blanc de la ligne.
Parameter values may be of four types: strings, booleans, numbers, and long numbers. A string is comprised of any printable characters. A boolean should be either the value yes or no. An undefined boolean parameter or one with a value other than these will be given a no value. Numbers (both regular and long) may be either decimal values, octal values (precede the value with 0) or hexadecimal values (precede the value with 0x). The maximum value of the regular and long numeric parameters is machine-dependent.
Les paramètres de configuration suivants sont fournis :
CHFN_AUTH (boolean)
CHFN_RESTRICT (string)
CHSH_AUTH (boolean)
CONSOLE (string)
If not defined, root will be allowed on any device.
CONSOLE_GROUPS (string)
Use with caution - it is possible for users to gain permanent access to these groups, even when not logged in on the console.
DEFAULT_HOME (boolean)
If set to yes, the user will login in the root (/) directory if it is not possible to cd to her home directory.
ENCRYPT_METHOD (string)
It can take one of these values:
Note: this parameter overrides the MD5_CRYPT_ENAB variable.
Note: if you use PAM, it is recommended to set this variable consistently with the PAM modules configuration.
ENV_HZ (string)
ENV_PATH (string)
ENV_SUPATH (string)
ENV_TZ (string)
If a full path is specified but the file does not exist or cannot be read, the default is to use TZ=CST6CDT.
ENVIRON_FILE (string)
ERASECHAR (number)
The value can be prefixed "0" for an octal value, or "0x" for an hexadecimal value.
FAIL_DELAY (number)
FAILLOG_ENAB (boolean)
FAKE_SHELL (string)
FTMP_FILE (string)
GID_MAX (number), GID_MIN (number)
HUSHLOGIN_FILE (string)
ISSUE_FILE (string)
KILLCHAR (number)
The value can be prefixed "0" for an octal value, or "0x" for an hexadecimal value.
LASTLOG_ENAB (boolean)
LOG_OK_LOGINS (boolean)
LOG_UNKFAIL_ENAB (boolean)
Note: logging unknown usernames may be a security issue if an user enter her password instead of her login name.
LOGIN_RETRIES (number)
LOGIN_STRING (string)
If the string contains %s, this will be replaced by the user's name.
LOGIN_TIMEOUT (number)
MAIL_CHECK_ENAB (boolean)
You should disable it if the shell startup files already check for mail ("mailx -e" or equivalent).
MAIL_DIR (string)
MAIL_FILE (string)
The MAIL_DIR and MAIL_FILE variables are used by useradd, usermod, and userdel to create, move, or delete the user's mail spool.
If MAIL_CHECK_ENAB is set to yes, they are also used to define the MAIL environment variable.
MAX_MEMBERS_PER_GROUP (number)
The default value is 0, meaning that there are no limits in the number of members in a group.
This feature (split group) permits to limit the length of lines in the group file. This is useful to make sure that lines for NIS groups are not larger than 1024 characters.
If you need to enforce such limit, you can use 25.
Note: split groups may not be supported by all tools (even in the Shadow toolsuite. You should not use this variable unless you really need it.
MD5_CRYPT_ENAB (boolean)
This variable is superceded by the ENCRYPT_METHOD variable or by any command line option used to configure the encryption algorithm.
This variable is deprecated. You should use ENCRYPT_METHOD.
Note: if you use PAM, it is recommended to set this variable consistently with the PAM modules configuration.
MOTD_FILE (string)
NOLOGINS_FILE (string)
OBSCURE_CHECKS_ENAB (boolean)
PASS_ALWAYS_WARN (boolean)
PASS_CHANGE_TRIES (number)
PASS_MAX_DAYS (number)
PASS_MIN_DAYS (number)
PASS_WARN_AGE (number)
PASS_MAX_DAYS, PASS_MIN_DAYS and PASS_WARN_AGE are only used at the time of account creation. Any changes to these settings won't affect existing accounts.
PASS_MAX_LEN (number), PASS_MIN_LEN (number)
PORTTIME_CHECKS_ENAB (boolean)
QUOTAS_ENAB (boolean)
SHA_CRYPT_MIN_ROUNDS (number), SHA_CRYPT_MAX_ROUNDS (number)
With a lot of rounds, it is more difficult to brute forcing the password. But note also that more CPU resources will be needed to authenticate users.
If not specified, the libc will choose the default number of rounds (5000).
The values must be inside the 1000-999999999 range.
If only one of the SHA_CRYPT_MIN_ROUNDS or SHA_CRYPT_MAX_ROUNDS values is set, then this value will be used.
If SHA_CRYPT_MIN_ROUNDS > SHA_CRYPT_MAX_ROUNDS, the highest value will be used.
SULOG_FILE (string)
SU_NAME (string)
SU_WHEEL_ONLY (boolean)
SYS_GID_MAX (number), SYS_GID_MIN (number)
SYS_UID_MAX (number), SYS_UID_MIN (number)
SYSLOG_SG_ENAB (boolean)
SYSLOG_SU_ENAB (boolean)
TTYGROUP (string), TTYPERM (string)
By default, the ownership of the terminal is set to the user's primary group and the permissions are set to 0600.
TTYGROUP can be either the name of a group or a numeric group identifier.
If you have a write program which is "setgid" to a special group which owns the terminals, define TTYGROUP to the group number and TTYPERM to 0620. Otherwise leave TTYGROUP commented out and assign TTYPERM to either 622 or 600.
TTYTYPE_FILE (string)
UID_MAX (number), UID_MIN (number)
ULIMIT (number)
UMASK (number)
USERDEL_CMD (string)
USERGROUPS_ENAB (boolean)
If set to yes, userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user.
CROSS REFERENCES | Début | Précédent | Suivant | Sommaire | Préc.page.lue | Accueil |
The following cross references show which programs in the shadow password suite use which parameters.
chfn
CHFN_AUTH CHFN_RESTRICT LOGIN_STRING
chgpasswd
chpasswd
chsh
gpasswd
groupadd
groupdel
groupmems
groupmod
grpck
grpconv
grpunconv
login
CONSOLE CONSOLE_GROUPS DEFAULT_HOME ENV_HZ ENV_PATH ENV_SUPATH ENV_TZ ENVIRON_FILE ERASECHAR FAIL_DELAY FAILLOG_ENAB FAKE_SHELL FTMP_FILE HUSHLOGIN_FILE ISSUE_FILE KILLCHAR LASTLOG_ENAB LOGIN_RETRIES LOGIN_STRING LOGIN_TIMEOUT LOG_OK_LOGINS LOG_UNKFAIL_ENAB MAIL_CHECK_ENAB MAIL_DIR MAIL_FILE MOTD_FILE NOLOGINS_FILE PORTTIME_CHECKS_ENAB QUOTAS_ENAB TTYGROUP TTYPERM TTYTYPE_FILE ULIMIT UMASK USERGROUPS_ENAB
newgrp
newusers
passwd
pwck
pwconv
su
CONSOLE CONSOLE_GROUPS DEFAULT_HOME ENV_HZ ENVIRON_FILE ENV_PATH ENV_SUPATH ENV_TZ LOGIN_STRING MAIL_CHECK_ENAB MAIL_DIR MAIL_FILE QUOTAS_ENAB SULOG_FILE SU_NAME SU_WHEEL_ONLY SYSLOG_SU_ENAB USERGROUPS_ENAB
sulogin
useradd
userdel
usermod
vipw
VOIR AUSSI | Début | Précédent | Suivant | Sommaire | Préc.page.lue | Accueil |
Sommaire | Début | Suivant | Sommaire | Préc.page.lue | Accueil |