192 lines
5.8 KiB
Text
192 lines
5.8 KiB
Text
#
|
|
# /etc/login.defs - Configuration control definitions for the shadow package.
|
|
#
|
|
|
|
# REQUIRED for useradd/userdel/usermod
|
|
# Directory where mailboxes reside, _or_ name of file, relative to the
|
|
# home directory. If you _do_ define MAIL_DIR and MAIL_FILE,
|
|
# MAIL_DIR takes precedence.
|
|
#
|
|
# Essentially:
|
|
# - MAIL_DIR defines the location of users mail spool files
|
|
# (for mbox use) by appending the username to MAIL_DIR as defined
|
|
# below.
|
|
# - MAIL_FILE defines the location of the users mail spool files as the
|
|
# fully-qualified filename obtained by prepending the user home
|
|
# directory before $MAIL_FILE
|
|
#
|
|
# NOTE: This is no more used for setting up users MAIL environment variable
|
|
# which is, starting from shadow 4.0.12-1 in Debian, entirely the
|
|
# job of the pam_mail PAM modules
|
|
# See default PAM configuration files provided for
|
|
# login, su, etc.
|
|
#
|
|
# This is a temporary situation: setting these variables will soon
|
|
# move to /etc/default/useradd and the variables will then be
|
|
# no more supported
|
|
MAIL_DIR /var/mail
|
|
#MAIL_FILE .mail
|
|
|
|
#
|
|
# Enable display of unknown usernames when login(1) failures are recorded.
|
|
#
|
|
# WARNING: Unknown usernames may become world readable.
|
|
# See #290803 and #298773 for details about how this could become a security
|
|
# concern
|
|
LOG_UNKFAIL_ENAB no
|
|
|
|
#
|
|
# Enable logging of successful logins
|
|
#
|
|
LOG_OK_LOGINS yes
|
|
|
|
#
|
|
# If defined, file which maps tty line to TERM environment parameter.
|
|
# Each line of the file is in a format similar to "vt100 tty01".
|
|
#
|
|
#TTYTYPE_FILE /etc/ttytype
|
|
|
|
#
|
|
# If defined, file which inhibits all the usual chatter during the login
|
|
# sequence. If a full pathname, then hushed mode will be enabled if the
|
|
# user's name or shell are found in the file. If not a full pathname, then
|
|
# hushed mode will be enabled if the file exists in the user's home directory.
|
|
#
|
|
HUSHLOGIN_FILE .hushlogin
|
|
#HUSHLOGIN_FILE /etc/hushlogins
|
|
|
|
#
|
|
# *REQUIRED* The default PATH settings, for superuser and normal users.
|
|
#
|
|
# (they are minimal, add the rest in the shell startup files)
|
|
ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
ENV_PATH PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
|
|
|
|
#
|
|
# Terminal permissions for terminals after login(1).
|
|
# These settings are ignored for remote and other logins.
|
|
#
|
|
# TTYGROUP Login tty will be assigned this group ownership.
|
|
# TTYPERM Login tty will be set to this permission.
|
|
#
|
|
#TTYGROUP tty
|
|
TTYPERM 0600
|
|
|
|
#
|
|
# Login configuration initializations:
|
|
#
|
|
# ERASECHAR Terminal ERASE character ('\010' = backspace).
|
|
# KILLCHAR Terminal KILL character ('\025' = CTRL/U).
|
|
#
|
|
# The ERASECHAR and KILLCHAR are used only on System V machines.
|
|
#
|
|
ERASECHAR 0177
|
|
KILLCHAR 025
|
|
|
|
# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
|
|
# home directories.
|
|
HOME_MODE 0700
|
|
|
|
#
|
|
# Password aging controls:
|
|
#
|
|
# PASS_MAX_DAYS Maximum number of days a password may be used.
|
|
# PASS_MIN_DAYS Minimum number of days allowed between password changes.
|
|
# PASS_WARN_AGE Number of days warning given before a password expires.
|
|
#
|
|
PASS_MAX_DAYS 99999
|
|
PASS_MIN_DAYS 0
|
|
PASS_WARN_AGE 7
|
|
|
|
#
|
|
# Min/max values for automatic uid selection in useradd(8)
|
|
#
|
|
UID_MIN 1000
|
|
UID_MAX 60000
|
|
# System accounts
|
|
#SYS_UID_MIN 101
|
|
#SYS_UID_MAX 999
|
|
# Extra per user uids
|
|
SUB_UID_MIN 100000
|
|
SUB_UID_MAX 600100000
|
|
SUB_UID_COUNT 65536
|
|
|
|
#
|
|
# Min/max values for automatic gid selection in groupadd(8)
|
|
#
|
|
GID_MIN 1000
|
|
GID_MAX 60000
|
|
# System accounts
|
|
#SYS_GID_MIN 101
|
|
#SYS_GID_MAX 999
|
|
# Extra per user group ids
|
|
SUB_GID_MIN 100000
|
|
SUB_GID_MAX 600100000
|
|
SUB_GID_COUNT 65536
|
|
|
|
#
|
|
# Max number of login(1) retries if password is bad
|
|
# This will most likely be overriden by PAM, since the default pam_unix module
|
|
# has it's own built in of 3 retries. However, this is a safe fallback in case
|
|
# you are using an authentication module that does not enforce PAM_MAXTRIES.
|
|
#
|
|
LOGIN_RETRIES 3
|
|
|
|
#
|
|
# Max time in seconds for login(1)
|
|
#
|
|
LOGIN_TIMEOUT 30
|
|
|
|
#
|
|
# Which fields may be changed by regular users using chfn(1) - use
|
|
# any combination of letters "frwh" (full name, room number, work
|
|
# phone, home phone). If not defined, no changes are allowed.
|
|
# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
|
|
#
|
|
CHFN_RESTRICT rwh
|
|
|
|
#
|
|
# If set to MD5, MD5-based algorithm will be used for encrypting password
|
|
# If set to SHA256, SHA256-based algorithm will be used for encrypting password
|
|
# If set to SHA512, SHA512-based algorithm will be used for encrypting password
|
|
# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
|
|
# If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password
|
|
# If set to DES, DES-based algorithm will be used for encrypting password (default)
|
|
# MD5 and DES should not be used for new hashes, see crypt(5) for recommendations.
|
|
# Overrides the MD5_CRYPT_ENAB option
|
|
#
|
|
# Note: It is recommended to use a value consistent with
|
|
# the PAM modules configuration.
|
|
#
|
|
ENCRYPT_METHOD YESCRYPT
|
|
|
|
#
|
|
# Should login be allowed if we can't cd to the home directory?
|
|
# Default is no.
|
|
#
|
|
DEFAULT_HOME yes
|
|
|
|
#
|
|
# The pwck(8) utility emits a warning for any system account with a home
|
|
# directory that does not exist. Some system accounts intentionally do
|
|
# not have a home directory. Such accounts may have this string as
|
|
# their home directory in /etc/passwd to avoid a spurious warning.
|
|
#
|
|
NONEXISTENT /nonexistent
|
|
|
|
#
|
|
# If defined, this command is run when removing a user.
|
|
# It should remove any at/cron/print jobs etc. owned by
|
|
# the user to be removed (passed as the first argument).
|
|
#
|
|
#USERDEL_CMD /usr/sbin/userdel_local
|
|
|
|
#
|
|
# If set to yes, userdel(8) will remove the user's group if it contains no more
|
|
# members, and useradd(8) will create by default a group with the name of the
|
|
# user.
|
|
#
|
|
# Other former uses of this variable are not used in PAM environments, such as
|
|
# Debian.
|
|
#
|
|
USERGROUPS_ENAB yes
|