login.defs: remove obscure, defaulted vars

debian/patches/debian/Adapt-login.defs-for-Debian.patch

@@ -4,12 +4,13 @@ Subject: Adapt login.defs for Debian
 
 Remove settings only applicable to shadow's su, which we do not use.
 Remove settings only applicable without PAM support enabled.
+Remove obscure commented-out settings.
 ---
- etc/login.defs | 358 +++++++++------------------------------------------------
- 1 file changed, 56 insertions(+), 302 deletions(-)
+ etc/login.defs | 372 ++++++++-------------------------------------------------
+ 1 file changed, 51 insertions(+), 321 deletions(-)
 
 diff --git a/etc/login.defs b/etc/login.defs
-index 33622c2..579de9a 100644
+index 33622c2..f44f381 100644
 --- a/etc/login.defs
 +++ b/etc/login.defs
 @@ -1,24 +1,38 @@
@@ -18,14 +19,14 @@ index 33622c2..579de9a 100644
  #
 -#	$Id$
 -#
--
+ 
 -#
 -# Delay in seconds before being allowed another attempt after a login failure
 -# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
 -#       pam_unix(8) enforces a 2s delay)
 -#
 -FAIL_DELAY		3
- 
+-
 -#
 -# Enable logging and display of /var/log/faillog login(1) failure info.
 -#
@@ -334,22 +335,17 @@ index 33622c2..579de9a 100644
  #
  # Which fields may be changed by regular users using chfn(1) - use
  # any combination of letters "frwh" (full name, room number, work
-@@ -294,29 +157,14 @@ CHFN_AUTH		yes
+@@ -294,29 +157,6 @@ CHFN_AUTH		yes
  CHFN_RESTRICT		rwh
  
  #
 -# Password prompt (%s will be replaced by user name).
-+# Instead of the real user shell, the program specified by this parameter
-+# will be launched, although its visible name (argv[0]) will be the shell's.
-+# The program may do whatever it wants (logging, additional authentification,
-+# banner, ...) before running the actual shell.
- #
+-#
 -# XXX - it doesn't work correctly yet, for now leave it commented out
 -# to use the default which is just "Password: ".
 -#LOGIN_STRING		"%s's Password: "
-+# FAKE_SHELL /bin/fakeshell
- 
- #
+-
+-#
 -# Only works if compiled with MD5_CRYPT defined:
 -# If set to "yes", new passwords will be encrypted using the MD5-based
 -# algorithm compatible with the one used by recent releases of FreeBSD.
@@ -369,7 +365,7 @@ index 33622c2..579de9a 100644
  # If set to MD5, MD5-based algorithm will be used for encrypting password
  # If set to SHA256, SHA256-based algorithm will be used for encrypting password
  # If set to SHA512, SHA512-based algorithm will be used for encrypting password
-@@ -326,66 +174,10 @@ CHFN_RESTRICT		rwh
+@@ -326,66 +166,10 @@ CHFN_RESTRICT		rwh
  # MD5 and DES should not be used for new hashes, see crypt(5) for recommendations.
  # Overrides the MD5_CRYPT_ENAB option
  #
@@ -438,7 +434,7 @@ index 33622c2..579de9a 100644
  
  #
  # Should login be allowed if we can't cd to the home directory?
-@@ -401,12 +193,6 @@ DEFAULT_HOME	yes
+@@ -401,12 +185,6 @@ DEFAULT_HOME	yes
  #
  NONEXISTENT	/nonexistent
  
@@ -451,7 +447,7 @@ index 33622c2..579de9a 100644
  #
  # If defined, this command is run when removing a user.
  # It should remove any at/cron/print jobs etc. owned by
-@@ -415,53 +201,21 @@ ENVIRON_FILE	/etc/environment
+@@ -415,59 +193,11 @@ ENVIRON_FILE	/etc/environment
  #USERDEL_CMD	/usr/sbin/userdel_local
  
  #
@@ -467,7 +463,7 @@ index 33622c2..579de9a 100644
 +# Debian.
  #
  USERGROUPS_ENAB yes
- 
+-
 -#
 -# If set to a non-zero number, the shadow utilities will make sure that
 -# groups never have more than this number of users on one line.
@@ -493,12 +489,12 @@ index 33622c2..579de9a 100644
 -#
 -#FORCE_SHADOW    yes
 -
- #
- # Allow newuidmap and newgidmap when running under an alternative
- # primary group.
- #
- #GRANT_AUX_GROUP_SUBIDS yes
- 
+-#
+-# Allow newuidmap and newgidmap when running under an alternative
+-# primary group.
+-#
+-#GRANT_AUX_GROUP_SUBIDS yes
+-
 -#
 -# Prevents an empty password field to be interpreted as "no authentication
 -# required".
@@ -507,6 +503,12 @@ index 33622c2..579de9a 100644
 -# Set to "no" to not prevent for any account (dangerous, historical default)
 -PREVENT_NO_AUTH superuser
 -
- #
- # Select the HMAC cryptography algorithm.
- # Used in pam_timestamp module to calculate the keyed-hash message
+-#
+-# Select the HMAC cryptography algorithm.
+-# Used in pam_timestamp module to calculate the keyed-hash message
+-# authentication code.
+-#
+-# Note: It is recommended to check hmac(3) to see the possible algorithms
+-# that are available in your system.
+-#
+-#HMAC_CRYPTO_ALGO SHA512