Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 98)

98 Chapter 6. Users and Groups

6.5. Shadow Utilities

If you are in a multiuser environment and not using a networked authentication scheme such as Ker-

beros, you should consider using Shadow Utilities (also known as shadow passwords) for the en-

hanced protection offered for your system’s authentication ﬁles. During the installation of Red Hat

Linux, shadow password protection for your system is enabled by default, as are MD5 passwords (an

alternative and arguably more secure method of encrypting passwords for storage on your system).

Shadow passwords offer a few distinct advantages over the previous standard of storing passwords on

UNIX and Linux systems, including:

• Improved system security by moving the encrypted passwords (normally found in /etc/passwd)

to /etc/shadow which is readable only by root

• Information concerning password aging (how long it has been since a password was last changed)

• Control over how long a password can remain unchanged before the user is required to change it

• The ability to use the /etc/login.defs ﬁle to enforce a security policy, especially concerning

password aging

The shadow-utils package contains a number of utilities that support:

• Conversion from normal to shadow passwords and back (pwconv, pwunconv)

• Veriﬁcation of the password, group, and associated shadow ﬁles (pwck, grpck)

• Industry-standard methods of adding, deleting and modifying user accounts (useradd, usermod,

and userdel)

• Industry-standard methods of adding, deleting, and modifying user groups (groupadd, groupmod,

and groupdel)

• Industry-standard method of administering the /etc/group ﬁle using gpasswd

There are some additional points of interest concerning these utilities:

• The utilities will work properly whether shadowing is enabled or not.

• The utilities have been slightly modiﬁed to support Red Hat’s user private group scheme. For a

description of the modiﬁcations, see the useradd man page. For more information on user private

groups, turn to Section 6.4.

• The adduser script has been replaced with a symbolic link to /usr/sbin/useradd.

• The tools in the shadow-utils package are not Kerberos, NIS, hesiod, or LDAP enabled. New

users will be local only. For more information on Kerberos and LDAP, see Chapter 11 and Chapter

19.

1 2 ... 93 94 95 96 97 98 99 100 101 102 103 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 98