File shadow-login_defs-suse.patch of Package shadow
Set login.defs defaults for SUSE Linux. Index: etc/login.defs =================================================================== --- etc/login.defs.orig +++ etc/login.defs @@ -3,6 +3,9 @@ # Some variables are used by login(1), su(1) and runuser(1) from util-linux # package as well pam pam_unix(8) from pam package. # +# For more, see login.defs(5). Please note that SUSE supports only variables +# listed here! Not listed variables from login.defs(5) have no effect. +# # # Delay in seconds before being allowed another attempt after a login failure @@ -52,8 +55,8 @@ CONSOLE /etc/securetty # If defined, ":" delimited list of "message of the day" files to # be displayed upon login. # -MOTD_FILE /etc/motd -#MOTD_FILE /etc/motd:/usr/lib/news/news-motd +MOTD_FILE "" +#MOTD_FILE /etc/motd:/usr/share/misc/motd # # If set to "yes", login stops display content specified by MOTD_FILE after @@ -73,8 +76,8 @@ MOTD_FILE /etc/motd # user's name or shell are found in the file. If not a full pathname, then # hushed mode will be enabled if the file exists in the user's home directory. # -HUSHLOGIN_FILE .hushlogin -#HUSHLOGIN_FILE /etc/hushlogins +#HUSHLOGIN_FILE .hushlogin +HUSHLOGIN_FILE /etc/hushlogins # If this variable is set to "yes", hostname will be suppressed in the # login: prompt. @@ -93,9 +96,9 @@ HUSHLOGIN_FILE .hushlogin # ENV_SUPATH is an ENV_ROOTPATH override for su and runuser # (and falback for login). # -ENV_PATH /bin:/usr/bin -ENV_ROOTPATH /sbin:/bin:/usr/sbin:/usr/bin -#ENV_SUPATH /sbin:/bin:/usr/sbin:/usr/bin +ENV_PATH /usr/local/bin:/bin:/usr/bin +ENV_ROOTPATH /usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin +#ENV_SUPATH /usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin # If this variable is set to "yes" (default is "no"), su will always set # path. every su call will overwrite the PATH variable. @@ -105,7 +108,7 @@ ENV_ROOTPATH /sbin:/bin:/usr/sbin:/usr/b # The recommended value is "yes". The default "no" behavior could have # a security implication in applications that use commands without path. # -ALWAYS_SET_PATH no +ALWAYS_SET_PATH yes # # Terminal permissions @@ -119,7 +122,7 @@ ALWAYS_SET_PATH no # set TTYPERM to either 622 or 600. # TTYGROUP tty -TTYPERM 0600 +TTYPERM 0620 # Default initial "umask" value used by login(1) on non-PAM enabled systems. # Default "umask" value for pam_umask(8) on PAM enabled systems. @@ -133,7 +136,7 @@ UMASK 022 # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new # home directories. # If HOME_MODE is not set, the value of UMASK is used to create the mode. -#HOME_MODE 0700 +HOME_MODE 0700 # # Password aging controls: @@ -157,8 +160,8 @@ PASS_WARN_AGE 7 UID_MIN 1000 UID_MAX 60000 # System accounts -SYS_UID_MIN 101 -SYS_UID_MAX 999 +SYS_UID_MIN 100 +SYS_UID_MAX 499 # Extra per user uids SUB_UID_MIN 100000 SUB_UID_MAX 600100000 @@ -175,8 +178,8 @@ SUB_UID_COUNT 65536 GID_MIN 1000 GID_MAX 60000 # System accounts -SYS_GID_MIN 101 -SYS_GID_MAX 999 +SYS_GID_MIN 100 +SYS_GID_MAX 499 # Extra per user group ids SUB_GID_MIN 100000 SUB_GID_MAX 600100000 @@ -185,7 +188,7 @@ SUB_GID_COUNT 65536 # # Max number of login(1) retries if password is bad # -LOGIN_RETRIES 5 +LOGIN_RETRIES 3 # # Tell login to only re-prompt for the password if authentication @@ -207,18 +210,9 @@ LOGIN_TIMEOUT 60 CHFN_RESTRICT rwh # -# If set to "yes", new passwords will be encrypted using the MD5-based -# algorithm compatible with the one used by recent releases of FreeBSD. -# It supports passwords of unlimited length and longer salt strings. -# Set to "no" if you need to copy encrypted passwords to other systems -# which don't understand the new algorithm. Default is "no". -# -# Note: If you use PAM, it is recommended to use a value consistent with -# the PAM modules configuration. -# -# This variable is deprecated. You should use ENCRYPT_METHOD instead. +# This variable is deprecated. Use ENCRYPT_METHOD instead! # -#MD5_CRYPT_ENAB no +#MD5_CRYPT_ENAB DO_NOT_USE # # If set to MD5, MD5-based algorithm will be used for encrypting password @@ -233,7 +227,7 @@ CHFN_RESTRICT rwh # Note: If you use PAM, it is recommended to use a value consistent with # the PAM modules configuration. # -#ENCRYPT_METHOD DES +ENCRYPT_METHOD SHA512 # # Only works if ENCRYPT_METHOD is set to SHA256 or SHA512. @@ -322,7 +316,7 @@ USERGROUPS_ENAB yes # This option is overridden with the -M or -m flags on the useradd(8) # command-line. # -#CREATE_HOME yes +CREATE_HOME yes # # Force use shadow, even if shadow passwd & shadow group files are
