[packages/shadow] Up to 4.20.3; enable bcrypt and yescrypt, ENCRYPT_METHOD YESCRYPT
arekm
arekm at pld-linux.org
Tue Oct 13 14:32:49 CEST 2026
commit a7c73b1937d335c92e7faec88ab50bf449ea40a0
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Tue Oct 13 12:46:06 2026 +0200
Up to 4.20.3; enable bcrypt and yescrypt, ENCRYPT_METHOD YESCRYPT
Drop expiry, groupmems and logoutd (removed upstream); --disable-logind,
only login/su use it and PLD ships neither.
groupmems.pamd | 6 ---
shadow-login.defs | 122 ++++++++++++++++++++++++++++++++++--------------------
shadow.spec | 48 +++------------------
3 files changed, 84 insertions(+), 92 deletions(-)
---
diff --git a/shadow.spec b/shadow.spec
index de886e3..ca8b6a8 100644
--- a/shadow.spec
+++ b/shadow.spec
@@ -13,13 +13,13 @@ Summary(pl.UTF-8): Narzędzia do obsługi mechanizmu ukrytych haseł
Summary(pt_BR.UTF-8): Utilitários para o arquivo de senhas Shadow
Summary(tr.UTF-8): Gölge parola dosyası araçları
Name: shadow
-Version: 4.18.0
+Version: 4.20.3
Release: 1
Epoch: 1
License: BSD
Group: Applications/System
Source0: https://github.com/shadow-maint/shadow/releases/download/%{version}/%{name}-%{version}.tar.xz
-# Source0-md5: 30ef46f54363db1d624587be68794ef2
+# Source0-md5: dd905c09b339e825b21512df7ba49063
Source2: %{name}-login.defs
Source3: %{name}.useradd
Source10: chage.pamd
@@ -29,7 +29,6 @@ Source13: chpasswd.pamd
Source14: chsh.pamd
Source15: groupadd.pamd
Source16: groupdel.pamd
-Source17: groupmems.pamd
Source18: groupmod.pamd
Source19: newusers.pamd
Source20: passwd.pamd
@@ -152,15 +151,16 @@ tworzyć mapowania uidów i gidów w przestrzeniach użytkowników.
--enable-man \
--enable-subordinate-ids \
--with-acl \
- --with-attr \
--with-audit \
--with-group-name-max-length=32 \
--with-libpam \
--with-nscd \
+ --disable-logind \
--without-su \
--without-libcrack \
%{?with_selinux:--with-selinux} \
- --with-sha-crypt \
+ --with-bcrypt \
+ --with-yescrypt \
--without-tcb
%{__make}
@@ -182,7 +182,6 @@ cp -p %{SOURCE13} $RPM_BUILD_ROOT/etc/pam.d/chpasswd
cp -p %{SOURCE14} $RPM_BUILD_ROOT/etc/pam.d/chsh
cp -p %{SOURCE15} $RPM_BUILD_ROOT/etc/pam.d/groupadd
cp -p %{SOURCE16} $RPM_BUILD_ROOT/etc/pam.d/groupdel
-cp -p %{SOURCE17} $RPM_BUILD_ROOT/etc/pam.d/groupmems
cp -p %{SOURCE18} $RPM_BUILD_ROOT/etc/pam.d/groupmod
cp -p %{SOURCE19} $RPM_BUILD_ROOT/etc/pam.d/newusers
cp -p %{SOURCE20} $RPM_BUILD_ROOT/etc/pam.d/passwd
@@ -237,7 +236,6 @@ fi
%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/pam.d/chsh
%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/pam.d/groupadd
%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/pam.d/groupdel
-%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/pam.d/groupmems
%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/pam.d/groupmod
%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/pam.d/newusers
%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/pam.d/passwd
@@ -253,7 +251,6 @@ fi
%{?with_shared:%attr(755,root,root) %{_libdir}/lib*.so.*.*}
%attr(4755,root,root) %{_bindir}/chfn
%attr(4755,root,root) %{_bindir}/chsh
-%attr(4755,root,root) %{_bindir}/expiry
%attr(4755,root,root) %{_bindir}/gpasswd
%attr(4755,root,root) %{_bindir}/passwd
%attr(4755,root,root) %{_bindir}/chage
@@ -264,12 +261,10 @@ fi
%attr(755,root,root) %{_sbindir}/chpasswd
%attr(755,root,root) %{_sbindir}/groupadd
%attr(755,root,root) %{_sbindir}/groupdel
-%attr(755,root,root) %{_sbindir}/groupmems
%attr(755,root,root) %{_sbindir}/groupmod
%attr(755,root,root) %{_sbindir}/grpck
%attr(755,root,root) %{_sbindir}/grpconv
%attr(755,root,root) %{_sbindir}/grpunconv
-%attr(755,root,root) %{_sbindir}/logoutd
%attr(755,root,root) %{_sbindir}/newusers
%attr(755,root,root) %{_sbindir}/pwck
%attr(755,root,root) %{_sbindir}/pwconv
@@ -282,7 +277,6 @@ fi
%{_mandir}/man1/chage.1*
%{_mandir}/man1/chfn.1*
%{_mandir}/man1/chsh.1*
-%{_mandir}/man1/expiry.1*
%{_mandir}/man1/gpasswd.1*
%{_mandir}/man1/newgrp.1*
%{_mandir}/man1/passwd.1*
@@ -297,12 +291,10 @@ fi
%{_mandir}/man8/faillog.8*
%{_mandir}/man8/groupadd.8*
%{_mandir}/man8/groupdel.8*
-%{_mandir}/man8/groupmems.8*
%{_mandir}/man8/groupmod.8*
%{_mandir}/man8/grpck.8*
%{_mandir}/man8/grpconv.8*
%{_mandir}/man8/grpunconv.8*
-%{_mandir}/man8/logoutd.8*
%{_mandir}/man8/newusers.8*
%{_mandir}/man8/pwck.8*
%{_mandir}/man8/pwconv.8*
@@ -313,7 +305,6 @@ fi
%{_mandir}/man8/vigr.8*
%{_mandir}/man8/vipw.8*
-%lang(cs) %{_mandir}/cs/man1/expiry.1*
%lang(cs) %{_mandir}/cs/man1/gpasswd.1*
%lang(cs) %{_mandir}/cs/man5/faillog.5*
%lang(cs) %{_mandir}/cs/man5/gshadow.5*
@@ -331,14 +322,12 @@ fi
%lang(da) %{_mandir}/da/man1/sg.1*
%lang(da) %{_mandir}/da/man5/gshadow.5*
%lang(da) %{_mandir}/da/man8/groupdel.8*
-%lang(da) %{_mandir}/da/man8/logoutd.8*
%lang(da) %{_mandir}/da/man8/vigr.8
%lang(da) %{_mandir}/da/man8/vipw.8*
%lang(de) %{_mandir}/de/man1/chage.1*
%lang(de) %{_mandir}/de/man1/chfn.1*
%lang(de) %{_mandir}/de/man1/chsh.1*
-%lang(de) %{_mandir}/de/man1/expiry.1*
%lang(de) %{_mandir}/de/man1/gpasswd.1*
%lang(de) %{_mandir}/de/man1/newgrp.1*
%lang(de) %{_mandir}/de/man1/passwd.1*
@@ -353,12 +342,10 @@ fi
%lang(de) %{_mandir}/de/man8/faillog.8*
%lang(de) %{_mandir}/de/man8/groupadd.8*
%lang(de) %{_mandir}/de/man8/groupdel.8*
-%lang(de) %{_mandir}/de/man8/groupmems.8*
%lang(de) %{_mandir}/de/man8/groupmod.8*
%lang(de) %{_mandir}/de/man8/grpck.8*
%lang(de) %{_mandir}/de/man8/grpconv.8*
%lang(de) %{_mandir}/de/man8/grpunconv.8*
-%lang(de) %{_mandir}/de/man8/logoutd.8*
%lang(de) %{_mandir}/de/man8/newusers.8*
%lang(de) %{_mandir}/de/man8/pwck.8*
%lang(de) %{_mandir}/de/man8/pwconv.8*
@@ -375,7 +362,6 @@ fi
%lang(fr) %{_mandir}/fr/man1/chage.1*
%lang(fr) %{_mandir}/fr/man1/chfn.1*
%lang(fr) %{_mandir}/fr/man1/chsh.1*
-%lang(fr) %{_mandir}/fr/man1/expiry.1*
%lang(fr) %{_mandir}/fr/man1/gpasswd.1*
%lang(fr) %{_mandir}/fr/man1/newgrp.1*
%lang(fr) %{_mandir}/fr/man1/passwd.1*
@@ -390,12 +376,10 @@ fi
%lang(fr) %{_mandir}/fr/man8/faillog.8*
%lang(fr) %{_mandir}/fr/man8/groupadd.8*
%lang(fr) %{_mandir}/fr/man8/groupdel.8*
-%lang(fr) %{_mandir}/fr/man8/groupmems.8*
%lang(fr) %{_mandir}/fr/man8/groupmod.8*
%lang(fr) %{_mandir}/fr/man8/grpck.8*
%lang(fr) %{_mandir}/fr/man8/grpconv.8*
%lang(fr) %{_mandir}/fr/man8/grpunconv.8*
-%lang(fr) %{_mandir}/fr/man8/logoutd.8*
%lang(fr) %{_mandir}/fr/man8/newusers.8*
%lang(fr) %{_mandir}/fr/man8/pwck.8*
%lang(fr) %{_mandir}/fr/man8/pwconv.8*
@@ -419,7 +403,6 @@ fi
%lang(it) %{_mandir}/it/man1/chage.1*
%lang(it) %{_mandir}/it/man1/chfn.1*
%lang(it) %{_mandir}/it/man1/chsh.1*
-%lang(it) %{_mandir}/it/man1/expiry.1*
%lang(it) %{_mandir}/it/man1/gpasswd.1*
%lang(it) %{_mandir}/it/man1/newgrp.1*
%lang(it) %{_mandir}/it/man1/passwd.1*
@@ -434,12 +417,10 @@ fi
%lang(it) %{_mandir}/it/man8/faillog.8*
%lang(it) %{_mandir}/it/man8/groupadd.8*
%lang(it) %{_mandir}/it/man8/groupdel.8*
-%lang(it) %{_mandir}/it/man8/groupmems.8*
%lang(it) %{_mandir}/it/man8/groupmod.8*
%lang(it) %{_mandir}/it/man8/grpck.8*
%lang(it) %{_mandir}/it/man8/grpconv.8*
%lang(it) %{_mandir}/it/man8/grpunconv.8*
-%lang(it) %{_mandir}/it/man8/logoutd.8*
%lang(it) %{_mandir}/it/man8/newusers.8*
%lang(it) %{_mandir}/it/man8/pwck.8*
%lang(it) %{_mandir}/it/man8/pwconv.8*
@@ -453,7 +434,6 @@ fi
%lang(ja) %{_mandir}/ja/man1/chage.1*
%lang(ja) %{_mandir}/ja/man1/chfn.1*
%lang(ja) %{_mandir}/ja/man1/chsh.1*
-%lang(ja) %{_mandir}/ja/man1/expiry.1*
%lang(ja) %{_mandir}/ja/man1/gpasswd.1*
%lang(ja) %{_mandir}/ja/man1/newgrp.1*
%lang(ja) %{_mandir}/ja/man1/passwd.1*
@@ -470,7 +450,6 @@ fi
%lang(ja) %{_mandir}/ja/man8/grpck.8*
%lang(ja) %{_mandir}/ja/man8/grpconv.8*
%lang(ja) %{_mandir}/ja/man8/grpunconv.8*
-%lang(ja) %{_mandir}/ja/man8/logoutd.8*
%lang(ja) %{_mandir}/ja/man8/newusers.8*
%lang(ja) %{_mandir}/ja/man8/pwck.8*
%lang(ja) %{_mandir}/ja/man8/pwconv.8*
@@ -489,17 +468,14 @@ fi
%lang(pl) %{_mandir}/pl/man1/chage.1*
%lang(pl) %{_mandir}/pl/man1/chsh.1*
-%lang(pl) %{_mandir}/pl/man1/expiry.1*
%lang(pl) %{_mandir}/pl/man1/newgrp.1*
%lang(pl) %{_mandir}/pl/man1/sg.1*
%lang(pl) %{_mandir}/pl/man5/faillog.5*
%lang(pl) %{_mandir}/pl/man8/faillog.8*
%lang(pl) %{_mandir}/pl/man8/groupadd.8*
%lang(pl) %{_mandir}/pl/man8/groupdel.8*
-%lang(pl) %{_mandir}/pl/man8/groupmems.8*
%lang(pl) %{_mandir}/pl/man8/groupmod.8*
%lang(pl) %{_mandir}/pl/man8/grpck.8*
-%lang(pl) %{_mandir}/pl/man8/logoutd.8*
%lang(pl) %{_mandir}/pl/man8/userdel.8*
%lang(pl) %{_mandir}/pl/man8/usermod.8*
%lang(pl) %{_mandir}/pl/man8/vigr.8*
@@ -515,7 +491,6 @@ fi
%lang(ru) %{_mandir}/ru/man1/chage.1*
%lang(ru) %{_mandir}/ru/man1/chfn.1*
%lang(ru) %{_mandir}/ru/man1/chsh.1*
-%lang(ru) %{_mandir}/ru/man1/expiry.1*
%lang(ru) %{_mandir}/ru/man1/gpasswd.1*
%lang(ru) %{_mandir}/ru/man1/newgrp.1*
%lang(ru) %{_mandir}/ru/man1/passwd.1*
@@ -530,12 +505,10 @@ fi
%lang(ru) %{_mandir}/ru/man8/faillog.8*
%lang(ru) %{_mandir}/ru/man8/groupadd.8*
%lang(ru) %{_mandir}/ru/man8/groupdel.8*
-%lang(ru) %{_mandir}/ru/man8/groupmems.8*
%lang(ru) %{_mandir}/ru/man8/groupmod.8*
%lang(ru) %{_mandir}/ru/man8/grpck.8*
%lang(ru) %{_mandir}/ru/man8/grpconv.8*
%lang(ru) %{_mandir}/ru/man8/grpunconv.8*
-%lang(ru) %{_mandir}/ru/man8/logoutd.8*
%lang(ru) %{_mandir}/ru/man8/newusers.8*
%lang(ru) %{_mandir}/ru/man8/pwck.8*
%lang(ru) %{_mandir}/ru/man8/pwconv.8*
@@ -548,7 +521,6 @@ fi
%lang(sv) %{_mandir}/sv/man1/chage.1*
%lang(sv) %{_mandir}/sv/man1/chsh.1*
-%lang(sv) %{_mandir}/sv/man1/expiry.1*
%lang(sv) %{_mandir}/sv/man1/newgrp.1*
%lang(sv) %{_mandir}/sv/man1/passwd.1*
%lang(sv) %{_mandir}/sv/man1/sg.1*
@@ -558,10 +530,8 @@ fi
%lang(sv) %{_mandir}/sv/man8/faillog.8*
%lang(sv) %{_mandir}/sv/man8/groupadd.8*
%lang(sv) %{_mandir}/sv/man8/groupdel.8*
-%lang(sv) %{_mandir}/sv/man8/groupmems.8*
%lang(sv) %{_mandir}/sv/man8/groupmod.8*
%lang(sv) %{_mandir}/sv/man8/grpck.8*
-%lang(sv) %{_mandir}/sv/man8/logoutd.8*
%lang(sv) %{_mandir}/sv/man8/pwck.8*
%lang(sv) %{_mandir}/sv/man8/userdel.8*
%lang(sv) %{_mandir}/sv/man8/vigr.8*
@@ -582,7 +552,6 @@ fi
%lang(uk) %{_mandir}/uk/man1/chage.1*
%lang(uk) %{_mandir}/uk/man1/chfn.1*
%lang(uk) %{_mandir}/uk/man1/chsh.1*
-%lang(uk) %{_mandir}/uk/man1/expiry.1*
%lang(uk) %{_mandir}/uk/man1/gpasswd.1*
%lang(uk) %{_mandir}/uk/man1/newgrp.1*
%lang(uk) %{_mandir}/uk/man1/passwd.1*
@@ -597,12 +566,10 @@ fi
%lang(uk) %{_mandir}/uk/man8/faillog.8*
%lang(uk) %{_mandir}/uk/man8/groupadd.8*
%lang(uk) %{_mandir}/uk/man8/groupdel.8*
-%lang(uk) %{_mandir}/uk/man8/groupmems.8*
%lang(uk) %{_mandir}/uk/man8/groupmod.8*
%lang(uk) %{_mandir}/uk/man8/grpck.8*
%lang(uk) %{_mandir}/uk/man8/grpconv.8*
%lang(uk) %{_mandir}/uk/man8/grpunconv.8*
-%lang(uk) %{_mandir}/uk/man8/logoutd.8*
%lang(uk) %{_mandir}/uk/man8/newusers.8*
%lang(uk) %{_mandir}/uk/man8/pwck.8*
%lang(uk) %{_mandir}/uk/man8/pwconv.8*
@@ -616,7 +583,6 @@ fi
%lang(zh_CN) %{_mandir}/zh_CN/man1/chage.1*
%lang(zh_CN) %{_mandir}/zh_CN/man1/chfn.1*
%lang(zh_CN) %{_mandir}/zh_CN/man1/chsh.1*
-%lang(zh_CN) %{_mandir}/zh_CN/man1/expiry.1*
%lang(zh_CN) %{_mandir}/zh_CN/man1/gpasswd.1*
%lang(zh_CN) %{_mandir}/zh_CN/man1/newgrp.1*
%lang(zh_CN) %{_mandir}/zh_CN/man1/passwd.1*
@@ -631,12 +597,10 @@ fi
%lang(zh_CN) %{_mandir}/zh_CN/man8/faillog.8*
%lang(zh_CN) %{_mandir}/zh_CN/man8/groupadd.8*
%lang(zh_CN) %{_mandir}/zh_CN/man8/groupdel.8*
-%lang(zh_CN) %{_mandir}/zh_CN/man8/groupmems.8*
%lang(zh_CN) %{_mandir}/zh_CN/man8/groupmod.8*
%lang(zh_CN) %{_mandir}/zh_CN/man8/grpck.8*
%lang(zh_CN) %{_mandir}/zh_CN/man8/grpconv.8*
%lang(zh_CN) %{_mandir}/zh_CN/man8/grpunconv.8*
-%lang(zh_CN) %{_mandir}/zh_CN/man8/logoutd.8*
%lang(zh_CN) %{_mandir}/zh_CN/man8/newusers.8*
%lang(zh_CN) %{_mandir}/zh_CN/man8/pwck.8*
%lang(zh_CN) %{_mandir}/zh_CN/man8/pwconv.8*
@@ -673,5 +637,5 @@ fi
%lang(fr) %{_mandir}/fr/man1/newuidmap.1*
%lang(fr) %{_mandir}/fr/man5/subgid.5*
%lang(fr) %{_mandir}/fr/man5/subuid.5*
-%ghost %{_libdir}/libsubid.so.5
+%ghost %{_libdir}/libsubid.so.6
%attr(755,root,root) %{_libdir}/libsubid.so.*.*.*
diff --git a/groupmems.pamd b/groupmems.pamd
deleted file mode 100644
index 0aa09c4..0000000
--- a/groupmems.pamd
+++ /dev/null
@@ -1,6 +0,0 @@
-#%PAM-1.0
-auth sufficient pam_rootok.so
-auth required pam_listfile.so item=user sense=allow file=/etc/security/chfn.allow onerr=fail
-auth include system-auth
-account include system-auth
-password include system-auth
diff --git a/shadow-login.defs b/shadow-login.defs
index d1c1570..a6624ac 100644
--- a/shadow-login.defs
+++ b/shadow-login.defs
@@ -6,7 +6,7 @@
#
# Delay in seconds before being allowed another attempt after a login failure
-# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
+# Note: when PAM is used, some modules may enforce a minimum delay (e.g.
# pam_unix(8) enforces a 2s delay)
#
FAIL_DELAY 3
@@ -206,19 +206,6 @@ UMASK 022
# If HOME_MODE is not set, the value of UMASK is used to create the mode.
#HOME_MODE 0700
-#
-# Password aging controls:
-#
-# PASS_MAX_DAYS Maximum number of days a password may be used.
-# PASS_MIN_DAYS Minimum number of days allowed between password changes.
-# PASS_MIN_LEN Minimum acceptable password length.
-# PASS_WARN_AGE Number of days warning given before a password expires.
-#
-PASS_MAX_DAYS 99999
-PASS_MIN_DAYS 0
-PASS_MIN_LEN 5
-PASS_WARN_AGE 7
-
#
# If "yes", the user must be listed as a member of the first gid 0 group
# in /etc/group (called "root" on most Linux systems) to be able to "su"
@@ -239,6 +226,41 @@ SYS_UID_MAX 999
SUB_UID_MIN 100000
SUB_UID_MAX 600100000
SUB_UID_COUNT 65536
+#
+# If set to yes, subordinate user ID entries in /etc/subuid are stored
+# using the numeric user ID rather than the username.
+#SUB_UID_STORE_BY_UID no
+
+#
+# Enable deterministic subordinate UID allocation based on the user's UID.
+# When set to "yes", subordinate UID ranges are calculated using a
+# deterministic formula instead of searching for the next free range:
+#
+# WARNING: Do not mix deterministic and linear (default) allocation
+# on the same system or across systems sharing /etc/subuid. Mixing
+# methods will cause subordinate ID range conflicts and overlaps.
+#
+# Default: no
+#
+#SUB_UID_DETERMINISTIC no
+
+#
+# Allow deterministic subordinate UID calculation to wrap around using
+# modulo arithmetic when a UID would overflow the configured subordinate
+# ID space. Only effective when SUB_UID_DETERMINISTIC is "yes".
+#
+# When disabled (default), any arithmetic overflow is a hard error,
+# ensuring non-overlapping monotonic allocation.
+#
+# WARNING: SECURITY RISK - MAY CAUSE RANGE OVERLAPS AND PRIVILEGE ESCALATION!
+#
+# When enabled (WRAP MODE), the subordinate ID space is treated as a ring
+# buffer. Uses modulo arithmetic to handle overflow. May cause range
+# overlaps between users.
+#
+# Default: no
+#
+#UNSAFE_SUB_UID_DETERMINISTIC_WRAP no
#
# Min/max values for automatic gid selection in groupadd(8)
@@ -252,6 +274,41 @@ SYS_GID_MAX 999
SUB_GID_MIN 100000
SUB_GID_MAX 600100000
SUB_GID_COUNT 65536
+#
+# If set to yes, subordinate group ID entries in /etc/subgid are stored
+# using the numeric user ID rather than the username.
+#SUB_GID_STORE_BY_UID no
+
+#
+# Enable deterministic subordinate GID allocation based on the user's UID.
+# When set to "yes", subordinate GID ranges are calculated using a
+# deterministic formula instead of searching for the next free range:
+#
+# WARNING: Do not mix deterministic and linear (default) allocation
+# on the same system or across systems sharing /etc/subgid. Mixing
+# methods will cause subordinate ID range conflicts and overlaps.
+#
+# Default: no
+#
+#SUB_GID_DETERMINISTIC no
+
+#
+# Allow deterministic subordinate GID calculation to wrap around using
+# modulo arithmetic when a UID would overflow the configured subordinate
+# ID space. Only effective when SUB_GID_DETERMINISTIC is "yes".
+#
+# When disabled (default), any arithmetic overflow is a hard error,
+# ensuring non-overlapping monotonic allocation.
+#
+# WARNING: SECURITY RISK - MAY CAUSE RANGE OVERLAPS AND PRIVILEGE ESCALATION!
+#
+# When enabled (WRAP MODE), the subordinate ID space is treated as a ring
+# buffer. Uses modulo arithmetic to handle overflow. May cause range
+# overlaps between users.
+#
+# Default: no
+#
+#UNSAFE_SUB_GID_DETERMINISTIC_WRAP no
#
# Max number of login(1) retries if password is bad
@@ -269,16 +326,12 @@ LOGIN_TIMEOUT 180
PASS_CHANGE_TRIES 5
#
-# Warn about weak passwords (but still allow them) if you are root.
+# Password strength controls:
#
+# Warn about weak passwords (but still allow them) if you are root.
PASS_ALWAYS_WARN yes
-
-#
-# Number of significant characters in the password for crypt().
-# Default is 8, don't change unless your crypt() is better.
-# Ignored if MD5_CRYPT_ENAB set to "yes".
-#
-#PASS_MAX_LEN 8
+# Minimum acceptable password length.
+PASS_MIN_LEN 5
#
# Require password before chfn(1)/chsh(1) can make any changes.
@@ -300,36 +353,17 @@ CHFN_RESTRICT rwh
# to use the default which is just "Password: ".
#LOGIN_STRING "%s's Password: "
-#
-# Only works if compiled with MD5_CRYPT defined:
-# If set to "yes", new passwords will be encrypted using the MD5-based
-# algorithm compatible with the one used by recent releases of FreeBSD.
-# It supports passwords of unlimited length and longer salt strings.
-# Set to "no" if you need to copy encrypted passwords to other systems
-# which don't understand the new algorithm. Default is "no".
-#
-# Note: If you use PAM, it is recommended to use a value consistent with
-# the PAM modules configuration.
-#
-# This variable is deprecated. You should use ENCRYPT_METHOD instead.
-#
-#MD5_CRYPT_ENAB no
-
#
# Only works if compiled with ENCRYPTMETHOD_SELECT defined:
-# If set to MD5, MD5-based algorithm will be used for encrypting password
# If set to SHA256, SHA256-based algorithm will be used for encrypting password
# If set to SHA512, SHA512-based algorithm will be used for encrypting password
# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
# If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password
-# If set to DES, DES-based algorithm will be used for encrypting password (default)
-# MD5 and DES should not be used for new hashes, see crypt(5) for recommendations.
-# Overrides the MD5_CRYPT_ENAB option
#
-# Note: If you use PAM, it is recommended to use a value consistent with
+# Note: if you use PAM, it is recommended to use a value consistent with
# the PAM modules configuration.
#
-#ENCRYPT_METHOD DES
+ENCRYPT_METHOD YESCRYPT
#
# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
@@ -467,7 +501,7 @@ PREVENT_NO_AUTH yes
# Used in pam_timestamp module to calculate the keyed-hash message
# authentication code.
#
-# Note: It is recommended to check hmac(3) to see the possible algorithms
+# Note: it is recommended to check hmac(3) to see the possible algorithms
# that are available in your system.
#
#HMAC_CRYPTO_ALGO SHA512
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/shadow.git/commitdiff/a7c73b1937d335c92e7faec88ab50bf449ea40a0
More information about the pld-cvs-commit
mailing list