Pisilinux/core
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Authentication & PAM Base rearranged from scratch

Browse Source
This commit is contained in:
Berk Çakar
2021-06-06 21:11:44 +03:00
parent b992e0fe55
commit 9ce7306e89
11 changed files with 281 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
system/base/shadow/actions.py
+45 -20
View File
@@ -10,37 +10,62 @@ from pisi.actionsapi import pisitools
from pisi.actionsapi import get
def setup():
autotools.configure("--enable-shadowgrp \
--without-selinux \
--without-audit \
--without-libcrack \
--with-libpam \
--with-sha-crypt \
--enable-nls \
--with-group-name-max-length=32 \
--disable-shared")
def build():
# Rebuild gmo catalogs
autotools.make("-C po update-gmo")
shelltools.system("sed -i 's/groups$(EXEEXT) //' src/Makefile.in && \
find man -name Makefile.in -exec sed -i 's/groups\.1 / /' {} \; && \
find man -name Makefile.in -exec sed -i 's/getspnam\.3 / /' {} \; && \
find man -name Makefile.in -exec sed -i 's/passwd\.5 / /' {} \; && \
sed -e 's@#ENCRYPT_METHOD DES@ENCRYPT_METHOD SHA512@' \
-e 's@/var/spool/mail@/var/mail@' \
-e '/PATH=/{s@/sbin:@@;s@/bin:@@}' \
-i etc/login.defs && \
sed -i 's/1000/999/' etc/useradd")
shelltools.system("./pisi-shadowbase.sh")
autotools.configure("--sysconfdir=/etc \
--with-group-name-max-length=32 \
--with-audit \
--with-libcrack \
--with-acl")
def build():
autotools.make()
def install():
autotools.rawInstall("DESTDIR=%s" % get.installDIR())
shelltools.system("sed -i 's/yes/no/' " + get.installDIR() + "/etc/default/useradd")
shelltools.system("install -v -m644 " + get.installDIR() + "/etc/login.defs{,.orig}")
for f in ["login", "passwd", "su", "chage", "system-login"]:
shelltools.system("chmod 755 " + f)
pisitools.insinto("/etc/pam.d/", "%s" % f)
for f in ["FAIL_DELAY", "FAILLOG_ENAB", "LASTLOG_ENAB", "MAIL_CHECK_ENAB", "OBSCURE_CHECKS_ENAB",
"PORTTIME_CHECKS_ENAB", "QUOTAS_ENAB", "CONSOLE MOTD_FILE", "FTMP_FILE NOLOGINS_FILE",
"ENV_HZ PASS_MIN_LEN", "SU_WHEEL_ONLY", "CRACKLIB_DICTPATH", "PASS_CHANGE_TRIES",
"PASS_ALWAYS_WARN", "CHFN_AUTH ENCRYPT_METHOD", "ENVIRON_FILE"]:
shelltools.system('sed -i "s/^' + f + '/# &/" ' + get.installDIR() + "/etc/login.defs")
### Pisi Linux specific preferences
shelltools.system("sed -i 's;PATH=/usr/sbin:/usr/bin;PATH=/sbin:/bin:/usr/sbin:/usr/bin;g' " + get.installDIR() + "/etc/login.defs")
shelltools.system("sed -i 's;PATH=/usr/bin;PATH=/sbin:/bin:/usr/sbin:/usr/bin;g' " + get.installDIR() + "/etc/login.defs")
shelltools.system("sed -i 's;/var/mail;/var/spool/mail;g' " + get.installDIR() + "/etc/login.defs")
shelltools.system("sed -i 's;#CREATE_HOME;CREATE_HOME;g' " + get.installDIR() + "/etc/login.defs")
###
for f in ["chfn", "chgpasswd", "chpasswd", "chsh" "groupadd", "groupdel",
"groupmems", "groupmod", "newusers", "useradd", "userdel", "usermod"]:
shelltools.system("install -v -m644 " + get.installDIR() + "/etc/pam.d/chage " + get.installDIR() + "/etc/pam.d/" + f)
shelltools.system('sed -i "s/chage/' + f + '/" ' + get.installDIR() + "/etc/pam.d/" + f)
pisitools.insinto("/etc/", "etc/login.access")
shelltools.chmod("%s/etc/login.access" % get.installDIR(), 0600)
pisitools.insinto("/etc/", "etc/limits")
shelltools.chmod("%s/etc/limits" % get.installDIR(), 0644)
# groups come from coreutils package
pisitools.remove("/usr/share/man/man1/groups.1")
pisitools.remove("/bin/groups")
# Conflicts with man-pages
pisitools.remove("/usr/share/man/man3/getspnam.3")
pisitools.remove("/usr/share/man/man5/passwd.5")
shelltools.system("[ -f " + get.installDIR() + "/etc/login.access ]" + " && mv -v " + get.installDIR() + "/etc/login.access{,.NOUSE}")
shelltools.system("[ -f " + get.installDIR() + "/etc/limits ]" + " && mv -v " + get.installDIR() + "/etc/limits{,.NOUSE}")
pisitools.dodoc("ChangeLog","README","NEWS")
system/base/shadow/files/pisi-shadowbase.sh
Executable
+150
View File
@@ -0,0 +1,150 @@
#!/bin/bash
cat > login << "EOF"
# Begin /etc/pam.d/login
# Set failure delay before next prompt to 3 seconds
auth optional pam_faildelay.so delay=3000000
# Check to make sure that the user is allowed to login
auth requisite pam_nologin.so
# Check to make sure that root is allowed to login
# Disabled by default. You will need to create /etc/securetty
# file for this module to function. See man 5 securetty.
#auth required pam_securetty.so
# Additional group memberships - disabled by default
#auth optional pam_group.so
# include system auth settings
auth include system-auth
# check access for the user
account required pam_access.so
# include system account settings
account include system-account
# Set default environment variables for the user
session required pam_env.so
# Set resource limits for the user
session required pam_limits.so
# Display date of last login - Disabled by default
#session optional pam_lastlog.so
# Display the message of the day - Disabled by default
#session optional pam_motd.so
# Check user's mail - Disabled by default
#session optional pam_mail.so standard quiet
# include system session and password settings
session include system-session
password include system-password
# End /etc/pam.d/login
EOF
cat > passwd << "EOF"
# Begin /etc/pam.d/passwd
password include system-password
# End /etc/pam.d/passwd
EOF
cat > su << "EOF"
# Begin /etc/pam.d/su
# always allow root
auth sufficient pam_rootok.so
# Allow users in the wheel group to execute su without a password
# disabled by default
#auth sufficient pam_wheel.so trust use_uid
# include system auth settings
auth include system-auth
# limit su to users in the wheel group
auth required pam_wheel.so use_uid
# include system account settings
account include system-account
# Set default environment variables for the service user
session required pam_env.so
# include system session settings
session include system-session
# End /etc/pam.d/su
EOF
cat > chage << "EOF"
# Begin /etc/pam.d/chage
# always allow root
auth sufficient pam_rootok.so
# include system auth, account, and session settings
auth include system-auth
account include system-account
session include system-session
# Always permit for authentication updates
password required pam_permit.so
# End /etc/pam.d/chage
EOF
cat > system-login << "EOF"
# Begin /etc/pam.d/system-login
# Set failure delay before next prompt to 3 seconds
auth optional pam_faildelay.so delay=3000000
# Check to make sure that the user is allowed to login
auth requisite pam_nologin.so
# Check to make sure that root is allowed to login
# Disabled by default. You will need to create /etc/securetty
# file for this module to function. See man 5 securetty.
#auth required pam_securetty.so
# Additional group memberships - disabled by default
#auth optional pam_group.so
# include the default auth settings
auth include system-auth
# check access for the user
account required pam_access.so
# include the default account settings
account include system-account
# Set default environment variables for the user
session required pam_env.so
# Set resource limits for the user
session required pam_limits.so
# Display date of last login - Disabled by default
#session optional pam_lastlog.so
# Display the message of the day - Disabled by default
#session optional pam_motd.so
# Check user's mail - Disabled by default
#session optional pam_mail.so standard quiet
# include the default session and password settings
session include system-session
password include system-password
# End /etc/pam.d/system-login
EOF
system/base/shadow/pspec.xml
+21 -11
View File
@@ -13,27 +13,29 @@
<Summary>Utilities to deal with user accounts</Summary>
<Description>The Shadow password file utilities package includes programs necessary to convert traditional V7 *NIX password files to the SVR4 shadow password format, and additional tools to maintain password and group files (that work with both shadow and non-shadow passwords).</Description>
<Archive sha1sum="63457a0ba58dc4e81b2663b839dc6c89d3343f12" type="tarxz">https://github.com/shadow-maint/shadow/releases/download/4.8.1/shadow-4.8.1.tar.xz</Archive>
<AdditionalFiles>
<AdditionalFile target="pisi-shadowbase.sh" permission="0755">pisi-shadowbase.sh</AdditionalFile>
</AdditionalFiles>
<BuildDependencies>
<Dependency>pam-devel</Dependency>
<Dependency>gettext-devel</Dependency>
<Dependency>cracklib-devel</Dependency>
<Dependency>acl-devel</Dependency>
<Dependency>audit-devel</Dependency>
<Dependency>attr-devel</Dependency>
<!--<Dependency>skey-devel</Dependency>-->
</BuildDependencies>
<Patches>
<!--Patches>
<Patch level="1">fedora/shadow-4.8-crypt_h.patch</Patch>
<Patch level="1">fedora/shadow-4.8-goodname.patch</Patch>
<Patch level="1">fedora/shadow-4.8-ignore-login-prompt.patch</Patch>
<Patch level="1">fedora/shadow-4.8-long-entry.patch</Patch>
<!-- <Patch level="1">fedora/shadow-4.8.1-audit-update.patch</Patch> -->
<!-- <Patch level="1">fedora/shadow-4.8.1-check-local-groups.patch</Patch> -->
<Patch level="1">fedora/shadow-4.8.1-audit-update.patch</Patch>
<Patch level="1">fedora/shadow-4.8.1-check-local-groups.patch</Patch>
<Patch level="1">fedora/shadow-4.8.1-commonio-force-lock-file-sync.patch</Patch>
<Patch level="1">fedora/shadow-4.8.1-manfix.patch</Patch>
<Patch level="1">fedora/shadow-4.8.1-useradd-man-clarification.patch</Patch>
<Patch level="1">shadow-strncpy-usage.patch</Patch>
<Patch level="1">xstrdup.patch</Patch>
</Patches>
<Patch level="1">shadow-strncpy-usage.patch</Patch>
<Patch level="1">xstrdup.patch</Patch>
</Patches-->
</Source>
<Package>
@@ -42,6 +44,7 @@
<Dependency>acl</Dependency>
<Dependency>attr</Dependency>
<Dependency>pam</Dependency>
<Dependency>audit</Dependency>
</RuntimeDependencies>
<Files>
<Path fileType="executable">/bin</Path>
@@ -55,7 +58,7 @@
<Path fileType="info">/usr/share/info</Path>
<Path fileType="localedata">/usr/share/locale</Path>
</Files>
<AdditionalFiles>
<!--AdditionalFiles>
<AdditionalFile owner="root" permission="0600" target="/etc/securetty">securetty</AdditionalFile>
<AdditionalFile owner="root" permission="0600" target="/etc/default/useradd">default/useradd</AdditionalFile>
<AdditionalFile owner="root" permission="0644" target="/etc/pam.d/login">pam.d/login</AdditionalFile>
@@ -76,10 +79,17 @@
<AdditionalFile owner="root" permission="0644" target="/etc/pam.d/su">pam.d/su</AdditionalFile>
<AdditionalFile owner="root" permission="0644" target="/etc/pam.d/system-auth">pam.d/system-auth</AdditionalFile>
<AdditionalFile owner="root" permission="0644" target="/etc/login.defs">login.defs</AdditionalFile>
</AdditionalFiles>
</AdditionalFiles-->
</Package>
<History>
<Update release="11">
<Date>2021-06-03</Date>
<Version>4.8.1</Version>
<Comment>Shadow rebuild.</Comment>
<Name>Berk Çakar</Name>
<Email>berk2238@hotmail.com</Email>
</Update>
<Update release="10">
<Date>2021-02-18</Date>
<Version>4.8.1</Version>