ShadowPasswordHowto

username:passwd:UID:GID:full_name:directory:shell

username:Npge08pfz4wuk:503:100:Full Name:/home/username:/bin/sh

username:x:503:100:Full Name:/home/username:/bin/sh

username:passwd:last:may:must:warn:expire:disable:reserved

username:Npge08pfz4wuk:9479:0:10000::::

"Applied Cryptography: Protocols, Algorithms, and Source Code in C"
by Bruce Schneier [email protected]>
ISBN: 0-471-59756-2

shadow-YYMMDD.tar.gz

tar -xzvf shadow-current.tar.gz

cd /usr/src/shadow-YYMMDD
cp Makefile.linux Makefile
cp config.h.linux config.h

#define HAVE_BASENAME

#undef HAVE_BASENAME

SOBJS = smain.o env.o entry.o susetup.o shell.o \
sub.o mail.o motd.o sulog.o age.o tz.o hushed.o
SSRCS = smain.c env.c entry.c setup.c shell.c \
pwent.c sub.c mail.c motd.c sulog.c shadow.c age.c pwpack.c rad64.c \
tz.c hushed.c

SOBJS = smain.o env.o entry.o susetup.o shell.o \
sub.o mail.o motd.o sulog.o age.o tz.o hushed.o basename.o
SSRCS = smain.c env.c entry.c setup.c shell.c \
pwent.c sub.c mail.c motd.c sulog.c shadow.c age.c pwpack.c rad64.c \
tz.c hushed.c basename.c

make all

make install

cp login.defs /etc
chmod 700 /etc/login.defs

cd /etc
/usr/sbin/pwconv

cd /etc
cp passwd ~passwd
chmod 600 ~passwd
mv npasswd passwd
mv nshadow shadow

chown root.root passwd
chown root.shadow shadow
chmod 0644 passwd
chmod 0640 shadow

cd /etc
cp ~passwd passwd
chmod 644 passwd

tar -xzvf adduser.shadow-1.4.tar.gz
cd adduser
make clean
make adduser
chmod 700 adduser
cp adduser /sbin

cd /usr/src
tar -xzvf wu-ftpd-2.4-fixed.tar.gz
cd wu-ftpd-2.4-fixed
cp ./src/config/config.lnx.shadow ./src/config/config.lnx

LIBES    = -lbsd -support

LIBES    = -lbsd -support -lshadow

cd /usr/src/wu-ftpd-2.4-fixed
/usr/src/wu-ftp-2.4.fixed/build lnx
cp /usr/sbin/wu.ftpd /usr/sbin/wu.ftpd.old
cp ./bin/ftpd /usr/sbin/wu.ftpd

cd /usr/include/netinet
ln -s in_systm.h in_system.h
cd -

cd /usr/src
tar -xzvf wu-ftpd-2.4.2-beta-9.tar.gz
cd wu-ftpd-beta-9
cd ./src/config

#undef SHADOW.PASSWORD

#define SHADOW.PASSWORD

cd ../Makefiles

LIBES = -lsupport -lbsd # -lshadow

LIBES = -lsupport -lbsd -lshadow

cd ..
build lnx
cp /usr/sbin/wu.ftpd /usr/sbin/wu.ftpd.old
cp ./bin/ftpd /usr/sbin/wu.ftpd

tar -xzvf xlockmore-3.7.tgz

#define HasShadowPasswd    NO
這一行到：
#define HasShadowPasswd    YES

cd /usr/src/xlockmore
xmkmf
make depend
make

cp xlock /usr/X11R6/bin/
cp XLock /var/X11R6/lib/app-defaults/
chown root.shadow /usr/X11R6/bin/xlock
chmod 2755 /usr/X11R6/bin/xlock
chown root.shadow /etc/shadow
chmod 640 /etc/shadow

tar -xzvf xdm.tar.gz

#define HasShadowPasswd    NO
這一行到：
#define HasShadowPasswd    YES

cd /usr/src/xdm
xmkmf
make depend
make

cp xdm /usr/X11R6/bin/

cd /usr/src
tar -xzvf sudo-1.2-shadow.tgz
cd sudo-1.2-shadow
make all
make install

useradd -D

GROUP=1
HOME=/home
INACTIVE=0
EXPIRE=0
SHELL=
SKEL=/etc/skel

useradd -D -g100 -e60 -f0 -s/bin/bash

GROUP=100
HOME=/home
INACTIVE=0
EXPIRE=60
SHELL=/bin/bash
SKEL=/etc/skel

useradd -m -c "Fred Flintstone" fred

fred:*:505:100:Fred Flintstone:/home/fred:/bin/bash

fred:!:0:0:60:0:0:0:0

passwd fred

Changing password for fred?Enter the new password (minimum of 5 characters)
Please use a combination of upper and lower case letters and numbers.
New Password: *******
Re-enter new password: *******

fred:J0C.WDR1amIt6:9559:0:60:0:0:0:0

#!/bin/bash
#
# /sbin/newuser - A script to add users to the system using the Shadow
#                 Suite's useradd and passwd commands.
#
# Written my Mike Jackson [email protected]> as an example for the Linux
# Shadow Password Howto.  Permission to use and modify is expressly granted.
#
# This could be modified to show the defaults and allow modification similar
# to the Slackware Adduser program.  It could also be modified to disallow
# stupid entries.  (i.e. better error checking).
#
##
#  Defaults for the useradd command
##
GROUP=100        # Default Group
HOME=/home       # Home directory location (/home/username)
SKEL=/etc/skel   # Skeleton Directory
INACTIVE=0       # Days after password expires to disable account (0=never)
EXPIRE=60        # Days that a passwords lasts
SHELL=/bin/bash  # Default Shell (full path)
##
#  Defaults for the passwd command
##
PASSMIN=0        # Days between password changes
PASSWARN=14      # Days before password expires that a warning is given
##
#  Ensure that root is running the script.
##
WHOAMI=`/usr/bin/whoami`
if [ $WHOAMI != "root" ]; then
echo "You must be root to add news users!"
exit 1
fi
##
#  Ask for username and fullname.
##
echo ""
echo -n "Username: "
read USERNAME
echo -n "Full name: "
read FULLNAME
#
echo "Adding user: $USERNAME."
#
# Note that the "" around $FULLNAME is required because this field is
# almost always going to contain at least on space, and without the "'s
# the useradd command would think that you we moving on to the next
# parameter when it reached the SPACE character.
#
/usr/sbin/useradd -c"$FULLNAME" -d$HOME/$USERNAME -e$EXPIRE \
-f$INACTIVE -g$GROUP -m -k$SKEL -s$SHELL $USERNAME
##
#  Set password defaults
##
/bin/passwd -n $PASSMIN -w $PASSWARN $USERNAME >/dev/null 2>1
##
#  Let the passwd command actually ask for password (twice)
##
/bin/passwd $USERNAME
##
#  Show what was done.
##
echo ""
echo "Entry from /etc/passwd:"
echo -n "   "
grep "$USERNAME:" /etc/passwd
echo "Entry from /etc/shadow:"
echo -n "   "
grep "$USERNAME:" /etc/shadow
echo "Summary output of the passwd command:"
echo -n "   "
passwd -S $USERNAME
echo ""

usermod -s /bin/tcsh fred

fred:*:505:100:Fred Flintstone:/home/fred:/bin/tcsh

usermod -e 09/15/97 fred

fred:J0C.WDR1amIt6:9559:0:60:0:0:10119:0

userdel -r username

passwd -S fred
fred P 03/04/96 0 60 0 0

passwd -w14 -i14 fred

fred P 03/04/96 0 60 14 14

touch /etc/gshadow
chown root.root /etc/gshadow
chmod 700 /etc/gshadow

groupname:!:GID:member,member,...

groupname:password:admin,admin,...:member,member,...

#include shadow/shadow.h>
#include shadow/pwauth.h>

gcc program.c -o program -lshadow

struct spwd
{
char *sp_namp;                /* login name */
char *sp_pwdp;                /* encrypted password */
sptime sp_lstchg;             /* date of last change */
sptime sp_min;                /* minimum number of days between changes */
sptime sp_max;                /* maximum number of days between changes */
sptime sp_warn;               /* number of days of warning before password
expires */
sptime sp_inact;              /* number of days after password expires
until the account becomes unusable. */
sptime sp_expire;             /* days since 1/1/70 until account expires
*/
unsigned long sp_flag;        /* reserved for future use */
};

username:Npge08pfz4wuk;@/sbin/extra:9479:0:10000::::

extern void setspent __P ((void));
extern void endspent __P ((void));
extern struct spwd *sgetspent __P ((__const char *__string));
extern struct spwd *fgetspent __P ((FILE *__fp));
extern struct spwd *getspent __P ((void));
extern struct spwd *getspnam __P ((__const char *__name));
extern int putspent __P ((__const struct spwd *__sp, FILE *__fp));

#ifdef HAS_SHADOW
#include shadow.h>
#include shadow/pwauth.h>
#endif

/*
* login - Check the user name and password against the system
* password database, and login the user if OK.
*
* returns:
*      UPAP_AUTHNAK: Login failed.
*      UPAP_AUTHACK: Login succeeded.
* In either case, msg points to an appropriate message.
*/
static int
login(user, passwd, msg, msglen)
char *user;
char *passwd;
char **msg;
int *msglen;
{
struct passwd *pw;
char *epasswd;
char *tty;
if ((pw = getpwnam(user)) == NULL) {
return (UPAP_AUTHNAK);
}
/*
* XXX If no passwd, let them login without one.
*/
if (pw->pw_passwd == '\0') {
return (UPAP_AUTHACK);
}
epasswd = crypt(passwd, pw->pw_passwd);
if (strcmp(epasswd, pw->pw_passwd)) {
return (UPAP_AUTHNAK);
}
syslog(LOG_INFO, "user %s logged in", user);
/*
* Write a wtmp entry for this user.
*/
tty = strrchr(devname, '/');
if (tty == NULL)
tty = devname;
else
tty++;
logwtmp(tty, user, "");             /* Add wtmp login entry */
logged_in = TRUE;
return (UPAP_AUTHACK);
}

/*
* login - Check the user name and password against the system
* password database, and login the user if OK.
*
* This function has been modified to support the Linux Shadow Password
* Suite if USE_SHADOW is defined.
*
* returns:
*      UPAP_AUTHNAK: Login failed.
*      UPAP_AUTHACK: Login succeeded.
* In either case, msg points to an appropriate message.
*/
static int
login(user, passwd, msg, msglen)
char *user;
char *passwd;
char **msg;
int *msglen;
{
struct passwd *pw;
char *epasswd;
char *tty;
#ifdef USE_SHADOW
struct spwd *spwd;
struct spwd *getspnam();
#endif
if ((pw = getpwnam(user)) == NULL) {
return (UPAP_AUTHNAK);
}
#ifdef USE_SHADOW
spwd = getspnam(user);
if (spwd)
pw->pw_passwd = spwd->sp-pwdp;
#endif
/*
* XXX If no passwd, let NOT them login without one.
*/
if (pw->pw_passwd == '\0') {
return (UPAP_AUTHNAK);
}
#ifdef HAS_SHADOW
if ((pw->pw_passwd  pw->pw_passwd[0] == '@'
 pw_auth (pw->pw_passwd+1, pw->pw_name, PW_LOGIN, NULL))
|| !valid (passwd, pw)) {
return (UPAP_AUTHNAK);
}
#else
epasswd = crypt(passwd, pw->pw_passwd);
if (strcmp(epasswd, pw->pw_passwd)) {
return (UPAP_AUTHNAK);
}
#endif
syslog(LOG_INFO, "user %s logged in", user);
/*
* Write a wtmp entry for this user.
*/
tty = strrchr(devname, '/');
if (tty == NULL)
tty = devname;
else
tty++;
logwtmp(tty, user, "");             /* Add wtmp login entry */
logged_in = TRUE;
return (UPAP_AUTHACK);
}

LIBS = -lshadow

COMPILE_FLAGS = -I.. -D_linux_=1 -DGIDSET_TYPE=gid_t

COMPILE_FLAGS = -I.. -D_linux_=1 -DGIDSET_TYPE=gid_t -DUSE_SHADOW

ShadowPasswordHowto

Wiki Links

Latest Blogs

OSS News

1. 簡介

1.1. 更改上一版本部分

1.2. 回覆

2. 版權聲明(暫不翻譯)

3. Miscellaneous and Acknowledgments.

4. 為何 shadow 你的 passwd 檔?

4.1. 為何您不要 shadow 你的 passwd 檔

4.2. 格式化 /etc/passwd 檔

4.3. 格式化 shadow 檔

4.4. 回顧 crypt(3).

5. 取得 Shadow Suite.

5.1. Shadow Suite for Linux 的歷史(暫不翻譯)

5.2. History of the Shadow Suite for Linux

5.3. 如何取得 Shadow Suite？

5.4. Shadow Suite包含什麼？

6. 編譯程式

6.1. 解壓縮

6.2. 設定 config.h 檔

6.3. 備份原始程式

6.4. 執行 make

7. 安裝

7.1. 手邊準備一個開機片

7.2. 移除複製的 man pages

7.3. 執行 make install

7.4. 執行 pwconv

7.5. 重新命名 npasswd 和 nshadow

8. 其他你需要升級(upgrade)或補強(patch)程式

8.1. Slackware adduser 程式

8.2. wu_ftpd Server

8.3. 標準 ftpd

8.4. pop3d (Post Office Protocol 3)

8.5. xlock

8.6. xdm

8.7. sudo

8.8. imapd (E-Mail [pine package])

8.9. pppd (Point-to-Point Protocol Server)

9. 將 Shadow Suite 放進來使用。

9.1. 新增、修改和刪除使用者

9.1.1. useradd

9.1.2. usermod

9.1.3. userdel

9.2. passwd 指令和 passwd 老化

9.3. login.defs 檔

9.4. 群組密碼

9.5. 檢查程式一致性

9.5.1. pwck

9.5.2. grpck

9.6. Dial-up 密碼

10. 加入 shadow 支援 C 語言

10.1. 標頭檔(Header files)

10.2. libshadow.a 函式庫(library)

10.3. Shadow 結構(Structure)

10.4. Shadow 函式(Functions)

10.5. 範例

11. 常問問題及答案