# # /etc/login.defs - Configuration control definitions for the login package. # # $Id: login.defs 6 2005-03-20 15:34:28Z bubulle $ # # Three items must be defined: MAIL_DIR, ENV_SUPATH, and ENV_PATH. # If unspecified, some arbitrary (and possibly incorrect) value will # be assumed. All other items are optional - if not specified then # the described action or option will be inhibited. # # Comment lines (lines beginning with "#") and blank lines are ignored. # # Modified for Linux. --marekm # # *REQUIRED* # Directory where mailboxes reside, _or_ name of file, relative to the # home directory. If you _do_ define both, MAIL_DIR takes precedence. # QMAIL_DIR is for Qmail (or any maildir-compatible MTA, such as Exim or # Postfix when suitably configured). # # Essentially, MAIL_DIR defines the $MAIL environmental variable # (for mbox use) by appending the username to MAIL_DIR as defined # below. MAIL_FILE defines the $MAIL environment variable as the # fully-qualified filename obtained by prepending the user home # directory before $MAIL_FILE, and QMAIL_DIR defines the MAIL # environment variable as the fully-qualified directory name # obtained by prepending the user home directory before $QMAIL_DIR. # # NOTE: This is used to setup your MAIL environment variable, and also # used by userdel to determine if any mail spools need to be removed when # removing a user. If you change this, you should also change the # pam_mail.so module setup in /etc/pam.d/login, which affects the "You # have mail" message on login, and, in default setup, overrides this setting # in determining the $MAIL environmental variable. # #QMAIL_DIR Maildir/ MAIL_DIR /var/mail #MAIL_FILE .mail # # Delay in seconds before being allowed another attempt after a login failure # FAIL_DELAY 3 # # Enable logging and display of /var/log/faillog login failure info. # FAILLOG_ENAB yes # # Enable display of unknown usernames when login failures are recorded. # LOG_UNKFAIL_ENAB no # # Enable logging of successful logins # LOG_OK_LOGINS no # # Enable setting of ulimit, umask, and niceness from passwd gecos field. # QUOTAS_ENAB yes # # Enable "syslog" logging of su activity - in addition to sulog file logging. # SYSLOG_SG_ENAB does the same for newgrp and sg. # SYSLOG_SU_ENAB yes SYSLOG_SG_ENAB yes # # If defined, all su activity is logged to this file. # #SULOG_FILE /var/log/sulog # # If defined, file which maps tty line to TERM environment parameter. # Each line of the file is in a format something like "vt100 tty01". # #TTYTYPE_FILE /etc/ttytype # # If defined, login failures will be logged here in a utmp format. # last, when invoked as lastb, will read /var/log/btmp, so... # FTMP_FILE /var/log/btmp # # If defined, the command name to display when running "su -". For # example, if this is defined as "su" then a "ps" will display the # command is "-su". If not defined, then "ps" would display the # name of the shell actually being run, e.g. something like "-sh". # SU_NAME su # # If defined, file which inhibits all the usual chatter during the login # sequence. If a full pathname, then hushed mode will be enabled if the # user's name or shell are found in the file. If not a full pathname, then # hushed mode will be enabled if the file exists in the user's home directory. # HUSHLOGIN_FILE .hushlogin #HUSHLOGIN_FILE /etc/hushlogins # # If defined, the presence of this value in an /etc/passwd "shell" field will # disable logins for that user, although "su" will still be allowed. # # XXX this does not seem to be implemented yet... --marekm # no, it was implemented but I ripped it out ;-) -- jfh NOLOGIN_STR NOLOGIN # # If defined, either a TZ environment parameter spec or the # fully-rooted pathname of a file containing such a spec. # #ENV_TZ TZ=CST6CDT #ENV_TZ /etc/tzname # # If defined, an HZ environment parameter spec. # # for Linux/x86 ENV_HZ HZ=100 # For Linux/Alpha... #ENV_HZ HZ=1024 # # *REQUIRED* The default PATH settings, for superuser and normal users. # # (they are minimal, add the rest in the shell startup files) ENV_SUPATH PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/bin/X11:/usr/local/sbin:/usr/local/bin ENV_PATH PATH=/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games # # Terminal permissions # # TTYGROUP Login tty will be assigned this group ownership. # TTYPERM Login tty will be set to this permission. # # If you have a "write" program which is "setgid" to a special group # which owns the terminals, define TTYGROUP to the group number and # TTYPERM to 0620. Otherwise leave TTYGROUP commented out and assign # TTYPERM to either 622 or 600. # TTYGROUP tty TTYPERM 0600 # # Login configuration initializations: # # ERASECHAR Terminal ERASE character ('\010' = backspace). # KILLCHAR Terminal KILL character ('\025' = CTRL/U). # UMASK Default "umask" value. # ULIMIT Default "ulimit" value. # # The ERASECHAR and KILLCHAR are used only on System V machines. # The ULIMIT is used only if the system supports it. # (now it works with setrlimit too; ulimit is in 512-byte units) # # Prefix these values with "0" to get octal, "0x" to get hexadecimal. # ERASECHAR 0177 KILLCHAR 025 UMASK 022 #ULIMIT 2097152 # # Password aging controls: # # PASS_MAX_DAYS Maximum number of days a password may be used. # PASS_MIN_DAYS Minimum number of days allowed between password changes. # PASS_WARN_AGE Number of days warning given before a password expires. # PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 PASS_WARN_AGE 7 # # Min/max values for automatic uid selection in useradd # UID_MIN 1000 UID_MAX 60000 # # Min/max values for automatic gid selection in groupadd # GID_MIN 100 GID_MAX 60000 # # Max number of login retries if password is bad. This will most likely be # overriden by PAM, since the default pam_unix module has it's own built # in of 3 retries However, this is a safe fallback in case you are using # and authentication module that does not enforce PAM_MAXTRIES. # LOGIN_RETRIES 5 # # Max time in seconds for login # LOGIN_TIMEOUT 60 # # Number of significant characters in the password for crypt(). # Default is 8, don't change unless your crypt() is better. # If using MD5 in your PAM configuration, set this higher. # PASS_MAX_LEN 8 # # Require password before chfn/chsh can make any changes. # CHFN_AUTH yes # # Which fields may be changed by regular users using chfn - use # any combination of letters "frwh" (full name, room number, work # phone, home phone). If not defined, no changes are allowed. # For backward compatibility, "yes" = "rwh" and "no" = "frwh". # CHFN_RESTRICT rwh # # Password prompt (%s will be replaced by user name). # # XXX - it doesn't work correctly yet, for now leave it commented out # to use the default which is just "Password: ". #LOGIN_STRING "%s's Password: " # # Should login be allowed if we can't cd to the home directory? # Default in no. # DEFAULT_HOME yes # # If defined, this command is run when removing a user. # It should remove any at/cron/print jobs etc. owned by # the user to be removed (passed as the first argument). # #USERDEL_CMD /usr/sbin/userdel_local # # If defined, either full pathname of a file containing device names or # a ":" delimited list of device names. No password is required to log in # as a non-root user on these devices. # #NO_PASSWORD_CONSOLE tty1:tty2:tty3:tty4:tty5:tty6 # # When prompting for password without echo, getpass() can optionally # display a random number (in the range 1 to GETPASS_ASTERISKS) of '*' # characters for each character typed. This feature is designed to # confuse people looking over your shoulder when you enter a password :-). # Also, the new getpass() accepts both Backspace (8) and Delete (127) # keys to delete previous character (to cope with different terminal # types), Control-U to delete all characters, and beeps when there are # no more characters to delete, or too many characters entered. # # Setting GETPASS_ASTERISKS to 1 results in more traditional behaviour - # exactly one '*' displayed for each character typed. # # Setting GETPASS_ASTERISKS to 0 disables the '*' characters (Backspace, # Delete, Control-U and beep continue to work as described above). # # Setting GETPASS_ASTERISKS to -1 reverts to the traditional getpass() # without any new features. This is the default. # #GETPASS_ASTERISKS 1 # # Enable setting of the umask group bits to be the same as owner bits # (examples: 022 -> 002, 077 -> 007) for non-root users, if the uid is # the same as gid, and username is the same as the primary group name. # # This also enables userdel to remove user groups if no members exist. # USERGROUPS_ENAB yes # # Instead of the real user shell, the program specified by this parameter # will be launched, although its visible name (argv[0]) will be the shell's. # The program may do whatever it wants (logging, additional authentification, # banner, ...) before running the actual shell. # # FAKE_SHELL /bin/fakeshell # # Enable pam_close_session() calling. When using normal (pam_unix.so) # session handling modules, this is not needed. However with modules # (such as kerberos or other persistent session models), login and su # need to fork and wait for the shell to exit so that sessions can be # cleaned up. # CLOSE_SESSIONS no ################# OBSOLETED BY PAM ############## # # # These options are now handled by PAM. Please # # edit the appropriate file in /etc/pam.d/ to # # enable the equivelants of them. # ############### #MOTD_FILE #DIALUPS_CHECK_ENAB #LASTLOG_ENAB #MAIL_CHECK_ENAB #OBSCURE_CHECKS_ENAB #PORTTIME_CHECKS_ENAB #CONSOLE #SU_WHEEL_ONLY #CRACKLIB_DICTPATH #PASS_CHANGE_TRIES #PASS_ALWAYS_WARN #MD5_CRYPT_ENAB #CONSOLE_GROUPS #ENVIRON_FILE #NOLOGINS_FILE #ISSUE_FILE #PASS_MIN_LEN