f171d63b5b
Add support for conditionally including paragraphs. (e.g. to support the documentation of PAM and !PAM features).
nekral-guest2007-11-22 00:01:58 +00:00
a34110320f
* man/newusers.8.xml: Added /etc/gshadow, /etc/group, /etc/shadow, and /etc/passwd to section FILES. * man/newusers.8.xml: Mentions that PAM is not used to set the passwords. * man/chpasswd.8.xml: Added section FILES (/etc/passwd, /etc/shadow, /etc/login.defs). * man/chpasswd.8.xml: Use the same paragraph as in newusers.8.xml to indicate that PAM is not used. * man/chgpasswd.8.xml: Added section FILES (/etc/group, /etc/gshadow, /etc/login.defs).
nekral-guest2007-11-21 22:12:14 +00:00
46ae2113b6
* Try harder to get the GID equal to the UID. This was not the case when the GID is not specified, and a GID exist with an ID higher than the all the UIDs. * Typo in comment: contrained -> constrained.
nekral-guest2007-11-21 21:27:44 +00:00
6f7ed628e2
Compile fix (related to last commit on src/chgpasswd.c).
nekral-guest2007-11-21 20:28:13 +00:00
fd0b22cb55
If the shadow group file is not present, do not try to locate the group entry from /etc/gshadow, and set the password in /etc/group.
nekral-guest2007-11-20 20:59:42 +00:00
9aa40bb96d
* libmisc/obscure.c, libmisc/salt.c, src/passwd.c: Match DES, MD5, SHA256, and SHA512 exactly (not only the first 3/6 chars). * libmisc/salt.c (SHA_salt_rounds): Set rounds to the specified prefered_rounds value, if specified. * src/gpasswd.c, libmisc/salt.c: Fix compilation warnings (use size_t for lengths). * src/chpasswd.c, src/chgpasswd.c: Add missing parenthesis.
nekral-guest2007-11-20 20:00:16 +00:00
1d4b67c773
Ignore the generated manpages. Add *.[1358] to the svn:ignore property.
nekral-guest2007-11-20 19:15:34 +00:00
a30c0a8192
The -c, -e, and -m options are exclusives.
nekral-guest2007-11-20 13:09:55 +00:00
6e3ad7a275
* man/chpasswd.8.xml, man/chgpasswd.8.xml: Document how the encryption algorithm is chosen for the passwords. Document the new -c and -s options. Add a reference to login.defs(5). * man/login.defs.5.xml: Document the ENCRYPT_METHOD, MD5_CRYPT_ENAB, SHA_CRYPT_MIN_ROUNDS, and SHA_CRYPT_MAX_ROUNDS variables. * etc/login.defs: Indicate that MD5_CRYPT_ENAB is deprecated. Document the relationship with PAM for MD5_CRYPT_ENAB and ENCRYPT_METHOD.
nekral-guest2007-11-20 12:59:20 +00:00
5cb462d767
Increase the size of crypt_passwd from 128 to 256 to avoid overflow in case of SHA512 (161 should be sufficient).
nekral-guest2007-11-20 12:18:36 +00:00
0b695f5a76
* lib/prototypes.h, libmisc/salt.c: Add parameters to crypt_make_salt to force the crypt method and number of rounds. * libmisc/salt.c: Add parameter to SHA_salt_rounds to force the number of rounds. * libmisc/salt.c, lib/getdef.c: ENCRYPT_METHOD and MD5_CRYPT_ENAB are needed also when USE_PAM (e.g. for chpasswd). * src/newusers.c, src/gpasswd.c: Use the new crypt_make_salt prototype. * src/chpasswd.c, src/chgpasswd.c: Add option -c, --crypt-method and -s, --sha-rounds to specify the crypt method and number of rounds in case of one of the SHA methods. The new prototype of crypt_make_salt simplifies the handling of -m, --md5.
nekral-guest2007-11-20 09:33:52 +00:00
eb23bbfd98
Hopefully, I review my commits in the morning...
nekral-guest2007-11-20 09:20:34 +00:00
e406b7fe4a
* libmisc/salt.c: The salt has a random size (between 8 and 16 bytes). * lib/getdef.c, etc/login.defs: Add definitions for SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS. * libmisc/salt.c: Use SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS to add a random number of rounds if needed.
nekral-guest2007-11-20 00:05:54 +00:00
c214b26ee6
* libmisc/salt.c (MAGNUM): Terminate the array with nul (the array is then used with strcat). * libmisc/salt.c (crypt_make_salt): Initialize result[0] to nul at the beginning (was not initialized when USE_PAM). * libmisc/salt.c (crypt_make_salt): Check that ENCRYPT_METHOD is a valid crypt method.
nekral-guest2007-11-19 22:34:48 +00:00
b8d8d0de00
Add support for SHA256 and SHA512 encrypt methods. Apply RedHat's patch shadow-4.0.18.1-sha256.patch. Thanks to Peter Vrabec. Hardly no changes except re-indent and changes related to recent modifications (max_salt_len in crypt_make_salt). Changes in lib/defines.h not applied (definition of ENCRYPTMETHOD_SELECT). I will add a configure check or flag.
nekral-guest2007-11-19 22:14:19 +00:00
cfc3378a0b
All the manpages in de, fr, it, pl are auto-generated.
nekral-guest2007-11-19 20:33:39 +00:00
39e5c0a1ab
Fix some compilation warnings: * src/login.c: "dereferencing type-punned pointer will break strict-aliasing rules", add a variable indirection: ptr_pam_user. * lib/commonio.c: do not initialize the sb stat structure. * lib/pwio.c, lib/shadowio.c, lib/sgroupio.c, lib/groupio.c: initialize the security context if WITH_SELINUX. * lib/nscd.c: The service argument is not const (used in the exec* parameters). This matches with the prototype definition. * src/groupmems.c: Avoid ++i when i is also used in the same line. * src/newusers.c: i is positive every time it is compared. Add cast to unsigned int. * src/nologin.c: Use a main() prototype with no arguments. * libmisc/getdate.y: Initialize the type and value fields of the terminating entry for each TABLE. * libmisc/tz.c: Use "TZ=CST6CDT" as the default timezone.
nekral-guest2007-11-19 20:25:36 +00:00
d16cc1ea89
Add a NEWS entry to indicate the review of the usage of getpwnam(), getpwuid(), getgrnam(), getgrgid(), and getspnam().
nekral-guest2007-11-19 01:19:45 +00:00
6a0a7171d2
* man/pl/Makefile.am: Add getspnam.3 to EXTRA_DIST since it is generated with shadow.3. * man/generate_translations.mak: Clean all the manpages, based on $(EXTRA_DIST), not $(man_MANS).
nekral-guest2007-11-19 01:16:42 +00:00
03118ffb9b
Remove file. The vigr man page is generated from the vipw XML file.
nekral-guest2007-11-18 23:21:49 +00:00
dcedc12f36
Add forgotten files in the previous ChangeLog entry.
nekral-guest2007-11-18 23:20:02 +00:00
9adfc136b6
* lib/prototypes.h, configure.in, libmisc/Makefile.am, libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c, libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c: Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(), xgetgrgid(), and xgetspnam(). They allocate memory for the returned structure and are more robust to successive calls. They are implemented with the libc's getxxyyy_r() functions if available. * libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c, libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c, libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c, src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c, src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c, src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c, src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c, src/groupadd.c, src/chage.c, src/login.c, src/suauth.c, src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the usage of one of the getpwnam(), getpwuid(), getgrnam(), getgrgid(), and getspnam() functions. It was noticed on http://bugs.debian.org/341230 that chfn and chsh use a passwd structure after calling a pam function, which result in using information from the passwd structure requested by pam, not the original one. It is much easier to use the new xget... functions to avoid these issues. I've checked which call to the original get... functions could be left (reducing the scope of the structure if possible), and I've left comments to ease future reviews (e.g. /* local, no need for xgetpwnam */). Note: the getpwent/getgrent calls should probably be checked also. * src/groupdel.c, src/expiry.c: Fix typos in comments. * src/groupmod.c: Re-indent. * libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c, lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup functions (used by the xget... functions) from the <xx>io.c files to the new <xx>mem.c files. This avoid linking some utils against the SELinux library.
nekral-guest2007-11-18 23:15:26 +00:00
ea63711c2c
Some fixes for the manpages: * man/pl/pl.po: Fix typo: chgpassw -> chgpasswd. * man/pl/Makefile.am: Fix typo: chgpassw -> chgpasswd. * man/de/de.po: groups shall not be translated (for command, refname, or refentrytitle).
nekral-guest2007-11-18 22:58:31 +00:00
311f4baa27
Do not document the behavior compared to old versions.
nekral-guest2007-11-17 23:11:02 +00:00
7b50ff67f9
Do not mention the patch names in the NEWS entries. They are mentioned in the ChangeLog.
nekral-guest2007-11-17 22:21:50 +00:00
a8aa7028f4
Add NEWS entries for the previous changes.
nekral-guest2007-11-17 22:17:42 +00:00
722941eae1
Document the differences between locking an account and locking a password.
nekral-guest2007-11-17 22:07:47 +00:00
0743a7236d
Same fixes as applied to usermod: refuse to unlock an account when it would result in a passwordless account.
nekral-guest2007-11-17 22:05:31 +00:00
85463e754d
Refuse to unlock an account when it would result in a passwordless account. Based on Openwall's patch shadow-4.0.4.1-owl-usermod-unlock.diff
nekral-guest2007-11-17 22:02:22 +00:00
5e438aa46c
Make sure that the prefix is the name of a directory (not only the beginning of a directory). Openwall patch shadow-4.0.4.1-owl-userdel-path_prefix.diff.
nekral-guest2007-11-17 21:24:06 +00:00
1f4488f963
* src/newgrp.c: Do not give an indication that the group has no password. * src/newgrp.c: Do not only bail on syslog if the password is not valid. Also give an indication to the user on stderr.
nekral-guest2007-11-17 21:03:33 +00:00
225b096838
Remove a comment which states that an user shall provide a password to switch to her group.
nekral-guest2007-11-17 20:41:49 +00:00
8e568ef697
Last parts of the Openwall patch shadow-4.0.4.1-owl-chage-drop-priv.diff: * src/chage.c: Make chage -l also drop the saved GID. * src/chage.c: Prefer setregid/setreuid to setgid/setuid.
nekral-guest2007-11-17 20:28:32 +00:00
24cfb1c158
* src/chage.c: Remove cleanup(). pw_lock is never called. Replace cleanup(2) by spw_unlock and remove the calls to cleanup(1). * src/chage.c: Remove variable pwrw. It is always set to 0. The password database is always read only.
nekral-guest2007-11-17 20:09:54 +00:00
cbb2911b7f
* man/generate_translations.mak: Generic rules for all the generated translated manpages (if ENABLE_REGENERATE_MAN). * man/Makefile.am: Removed rules for all the generated translated manpages. * man/sv/Makefile.am, man/de/Makefile.am, man/fr/Makefile.am, man/pl/Makefile.am, man/ru/Makefile.am, man/it/Makefile.am: Include generate_translations.mak to handle the generated translations (XML and roff files). * man/Makefile.am: Translated XML files moved from the CLEANFILES variable of man/Makefile.am to the various languages Makefiles.
nekral-guest2007-11-17 18:45:22 +00:00
a9f2f60c68
Fixes from Openwall patch shadow-4.0.4.1-alt-man.diff: * man/useradd.8.xml: Indicate that the NIS caveats is also valid for any external database as LDAP. * man/groupadd.8.xml: Likewise. * man/groupadd.8.xml: Reorder and reformat the caveats bullets.
nekral-guest2007-11-17 18:13:17 +00:00
1bcf56c8b2
Start applying Debian patch 409_man_generate_from_PO: * NEWS: Applied Debian patch 409_man_generate_from_PO to automatically generate the translated manpages from the POs. * man/Makefile.am: Replace the individual rules for the generation of the manpages (from XML) by a generic Makefile rule an dependencies for the linked manpages.
nekral-guest2007-11-17 17:47:02 +00:00
0fd1ed4517
Avoid terminating the PAM library in the forked child. This is done later in the parent after closing the PAM session. This fixes http://bugs.debian.org/412061. Debian patch 405_su_no_pam_end_before_exec.
nekral-guest2007-11-17 17:19:44 +00:00
7503c8a029
Mention sg in the newgrp manpage. Debian patch 410_newgrp_man_mention_sg.
nekral-guest2007-11-17 17:03:01 +00:00
be972d7db3
Fix typo: the warndays option was called warning. This is now warndays, as documented in the manpage and usage. Debian patch 417_passwd_warndays.
nekral-guest2007-11-17 16:57:37 +00:00
fb6cb07a60
Remove the preprocessor check SHADOWPWD. The variable is no more defined (and always assumed). Debian patch 493_pwck_no_SHADOWPWD.
nekral-guest2007-11-17 16:50:26 +00:00
5bcc89ffe7
Add NEWS entries for the last 2 changes.
nekral-guest2007-11-17 16:43:00 +00:00
e47ee90033
-l/-u options: edit the shadow account expiry field *in addition* to editing the password field. Debian patch 494_passwd_lock.
nekral-guest2007-11-17 16:40:39 +00:00
5d2ca8b240
Do not request a password when a user uses newgrp to switch to her primary group. Debian patch 497_newgrp_primary_group.
nekral-guest2007-11-17 16:19:00 +00:00
90ef765c2e
Log an error if the password entry could not be found (respect LOG_UNKFAIL_ENAB to avoid logging a password). This fixes the Debian bug http://bugs.debian.org/451521nekral-guest2007-11-17 16:05:54 +00:00
ca875647b9
-b documenation: Use the same notation for the -d argument as in the -d documentation.
nekral-guest2007-11-17 15:27:12 +00:00
e39a941413
Allow the -b option even without the -D option.
nekral-guest2007-11-17 15:07:59 +00:00
87b5ce3036
Use the same error message for the below errors. (option working ONLY if another is specified).
nekral-guest2007-11-17 14:49:39 +00:00
af045a0733
Make usermod -o and -u work independently of the argument order.
nekral-guest2007-11-17 14:40:54 +00:00
488184394e
Validate that two of the -L, -p, and -U options are not used at the same time after the parsing of options. -U used to be allowed after -p or -L, but not before.
nekral-guest2007-11-17 14:33:26 +00:00
71392cdc8f
Make usermod -d and -m work independant of the argument order. Thanks to Justin Pryzby <jpryzby+d@quoininc.com> for the patch. This fixes Debian's bug #451518.
nekral-guest2007-11-17 14:21:05 +00:00
4aafb131ca
* NEWS, lib/nscd.c: Execute nscd -i instead of using the private glibc socket to flush the nscd tables. This comes from the RedHat patch shadow-4.0.16-nscd.c. * lib/commonio.c: Forbid inheritance of the passwd and group files to the spawed processes (like nscd). This comes from the RedHat patch shadow-4.0.17-notInheritFd.patch. * lib/nscd.h: Update header.
nekral-guest2007-11-17 14:04:05 +00:00
6c2e7c124f
Remove remaining return value in update_group.
nekral-guest2007-11-17 13:48:56 +00:00
24e742d202
* src/usermod.c (fail_exit): Add static variables pw_locked, spw_locked, gr_locked, and sgr_locked to indicate which files must be unlocked. * src/usermod.c (open_files, close_files): Open and close the group files as well as the passwd files. This permit to check if the group files modification are allowed before writing the passwd files. * src/usermod.c (grp_update, update_gshadow, update_group): Do not return a status code, but call fail_exit() in case of error. The group files are no more opened and closed in update_gshadow() and update_group(). * src/usermod.c (main): move the call to grp_update between open_files and close_files. * src/usermod.c: Differentiate failure to add a group entry and failure to add a shadow group entry.
nekral-guest2007-11-17 11:42:47 +00:00
326074388c
Differentiate failure to update a group entry and failure to update a shadow group entry.
nekral-guest2007-11-17 11:31:06 +00:00
9afe59af3e
Inform the user if out of memory while updating a group database.
nekral-guest2007-11-16 23:39:42 +00:00
7ecdf9b71f
Update the group database before flushing the nscd caches.
nekral-guest2007-11-16 23:29:41 +00:00
0325483ee4
Abort if an error is found while updating the user or group database. No changes will be written in the databases.
nekral-guest2007-11-16 23:26:56 +00:00
b370e1502e
It is no more needed to check that the user's groups are specified only once in the group file. This is checked by gr_update().
nekral-guest2007-11-16 23:05:24 +00:00
07c2610170
* lib/commonio.c (next_entry_by_name): New function. * NEWS, lib/commonio.c (commonio_update): When an entry is updated, make sure that there are no other entry with the same name. This fixes an infinite loop in userdel and usermod when an (erroneous) group file contains two entries with the same name. (https://bugzilla.redhat.com/show_bug.cgi?id=240915)
nekral-guest2007-11-16 22:59:14 +00:00
449f17385a
* libmisc/salt.c: Make sure the salt string is terminated at the right place (either 8th, or 11th position). * NEWS, src/chgpasswd.c, src/chpasswd.c: The protocol + salt does not need 15 chars. No need for a temporary buffer. This change the fix committed on 2007-11-10. The salt provided to pw_encrypt could have been too long.
nekral-guest2007-11-16 19:02:00 +00:00
e163c5fe9c
Fix typo: missing / in <placeholder-1/>. This caused the gpasswd title to be incomplete in the French manpage.
nekral-guest2007-11-16 14:10:29 +00:00
f55e00dc4e
Add support for uClibc with no l64a().
nekral-guest2007-11-16 12:36:21 +00:00
e0edb7db17
Add support for systems with no innetgr(). On those systems, username with an @ will be treated like any other username (i.e. lookup in the local database for an user with an @). Thanks to Mike Frysinger for the patch.
nekral-guest2007-11-16 11:32:42 +00:00
8d527f156d
Declare the child and pid variable at the beginning of a block. This fixes a compilation issue with gcc 2.95. The intent is the same as Gentoo's patch shadow-4.0.12-gcc2.patch.
nekral-guest2007-11-14 13:46:15 +00:00
15f43716c1
Add a variable to set the suid permissions. This should simplify Gentoo's patch shadow-4.0.11.1-perms.patch.
nekral-guest2007-11-14 13:32:25 +00:00
b2120265fd
Added the subversion svn:keywords property (Id) for proper identification.
nekral-guest2007-11-10 23:46:11 +00:00
fb3b2ddbff
Restore the ignore patterns from the previous repository.
nekral-guest2007-11-10 23:34:37 +00:00
f9de15fdcf
Don't ask for a password if there are no group passwords. Just directly give up. This comes from the Fedora's patch shadow-4.0.13-newgrpPwd.patch, and seems to be the only part with an effect.
nekral-guest2007-11-10 18:54:40 +00:00
1bdb92706e
Fix chpasswd and chgpasswd stack overflow. Based on Fedora's shadow-4.0.18.1-overflow.patch.
nekral-guest2007-11-10 18:48:23 +00:00
6a051e1544
Allow non numerical group identifier to be specified with useradd's -g option. Applied Debian patch 397_non_numerical_identifier. Thanks also to Greg Schafer <gschafer@zip.com.au>.
nekral-guest2007-11-10 15:51:38 +00:00
8609e24880
Update the version number to 4.0.18.2 and the gettext version to 0.16.
nekral-guest2007-10-27 23:22:11 +00:00
4bb174fa8c
Remove the generate_translations.mak inclusion. This file does not exist and will be introduced later when the Debian patch 409_man_generate_from_PO will be included.
nekral-guest2007-10-27 23:19:32 +00:00
a8856cbfbd
Remove a plural form. nplurals=1 for japanese. Moreover, msgstr[0] was identical to msgstr[1].
nekral-guest2007-10-27 23:18:08 +00:00
16285e6768
Add support for 2 new resource limits. Thanks to Justin Bronder for the patch. This was reported in the Debian bug #442334. This only impact shadow when it is not compiled with PAM support.
nekral-guest2007-10-27 19:45:21 +00:00
93acdeb8ff
Document all gpasswd.1 options separately. This clarify the gpasswd.1 manpages (reported in debian bug #445480).
nekral-guest2007-10-27 14:00:31 +00:00
nekral-guest