From e9cceb62ce5defb1a7059cf1f5d525b65b5fd337 Mon Sep 17 00:00:00 2001 From: Chris Hofstaedtler Date: Sun, 7 Jul 2024 15:22:58 +0200 Subject: [PATCH] login.defs: remove obscure, defaulted vars --- .../debian/Adapt-login.defs-for-Debian.patch | 56 ++++++++++--------- 1 file changed, 29 insertions(+), 27 deletions(-) diff --git a/debian/patches/debian/Adapt-login.defs-for-Debian.patch b/debian/patches/debian/Adapt-login.defs-for-Debian.patch index 9bb78aa7..983b60f5 100644 --- a/debian/patches/debian/Adapt-login.defs-for-Debian.patch +++ b/debian/patches/debian/Adapt-login.defs-for-Debian.patch @@ -4,12 +4,13 @@ Subject: Adapt login.defs for Debian Remove settings only applicable to shadow's su, which we do not use. Remove settings only applicable without PAM support enabled. +Remove obscure commented-out settings. --- - etc/login.defs | 358 +++++++++------------------------------------------------ - 1 file changed, 56 insertions(+), 302 deletions(-) + etc/login.defs | 372 ++++++++------------------------------------------------- + 1 file changed, 51 insertions(+), 321 deletions(-) diff --git a/etc/login.defs b/etc/login.defs -index 33622c2..579de9a 100644 +index 33622c2..f44f381 100644 --- a/etc/login.defs +++ b/etc/login.defs @@ -1,24 +1,38 @@ @@ -18,14 +19,14 @@ index 33622c2..579de9a 100644 # -# $Id$ -# -- + -# -# Delay in seconds before being allowed another attempt after a login failure -# Note: When PAM is used, some modules may enforce a minimum delay (e.g. -# pam_unix(8) enforces a 2s delay) -# -FAIL_DELAY 3 - +- -# -# Enable logging and display of /var/log/faillog login(1) failure info. -# @@ -334,22 +335,17 @@ index 33622c2..579de9a 100644 # # Which fields may be changed by regular users using chfn(1) - use # any combination of letters "frwh" (full name, room number, work -@@ -294,29 +157,14 @@ CHFN_AUTH yes +@@ -294,29 +157,6 @@ CHFN_AUTH yes CHFN_RESTRICT rwh # -# Password prompt (%s will be replaced by user name). -+# Instead of the real user shell, the program specified by this parameter -+# will be launched, although its visible name (argv[0]) will be the shell's. -+# The program may do whatever it wants (logging, additional authentification, -+# banner, ...) before running the actual shell. - # +-# -# XXX - it doesn't work correctly yet, for now leave it commented out -# to use the default which is just "Password: ". -#LOGIN_STRING "%s's Password: " -+# FAKE_SHELL /bin/fakeshell - - # +- +-# -# Only works if compiled with MD5_CRYPT defined: -# If set to "yes", new passwords will be encrypted using the MD5-based -# algorithm compatible with the one used by recent releases of FreeBSD. @@ -369,7 +365,7 @@ index 33622c2..579de9a 100644 # If set to MD5, MD5-based algorithm will be used for encrypting password # If set to SHA256, SHA256-based algorithm will be used for encrypting password # If set to SHA512, SHA512-based algorithm will be used for encrypting password -@@ -326,66 +174,10 @@ CHFN_RESTRICT rwh +@@ -326,66 +166,10 @@ CHFN_RESTRICT rwh # MD5 and DES should not be used for new hashes, see crypt(5) for recommendations. # Overrides the MD5_CRYPT_ENAB option # @@ -438,7 +434,7 @@ index 33622c2..579de9a 100644 # # Should login be allowed if we can't cd to the home directory? -@@ -401,12 +193,6 @@ DEFAULT_HOME yes +@@ -401,12 +185,6 @@ DEFAULT_HOME yes # NONEXISTENT /nonexistent @@ -451,7 +447,7 @@ index 33622c2..579de9a 100644 # # If defined, this command is run when removing a user. # It should remove any at/cron/print jobs etc. owned by -@@ -415,53 +201,21 @@ ENVIRON_FILE /etc/environment +@@ -415,59 +193,11 @@ ENVIRON_FILE /etc/environment #USERDEL_CMD /usr/sbin/userdel_local # @@ -467,7 +463,7 @@ index 33622c2..579de9a 100644 +# Debian. # USERGROUPS_ENAB yes - +- -# -# If set to a non-zero number, the shadow utilities will make sure that -# groups never have more than this number of users on one line. @@ -493,12 +489,12 @@ index 33622c2..579de9a 100644 -# -#FORCE_SHADOW yes - - # - # Allow newuidmap and newgidmap when running under an alternative - # primary group. - # - #GRANT_AUX_GROUP_SUBIDS yes - +-# +-# Allow newuidmap and newgidmap when running under an alternative +-# primary group. +-# +-#GRANT_AUX_GROUP_SUBIDS yes +- -# -# Prevents an empty password field to be interpreted as "no authentication -# required". @@ -507,6 +503,12 @@ index 33622c2..579de9a 100644 -# Set to "no" to not prevent for any account (dangerous, historical default) -PREVENT_NO_AUTH superuser - - # - # Select the HMAC cryptography algorithm. - # Used in pam_timestamp module to calculate the keyed-hash message +-# +-# Select the HMAC cryptography algorithm. +-# Used in pam_timestamp module to calculate the keyed-hash message +-# authentication code. +-# +-# Note: It is recommended to check hmac(3) to see the possible algorithms +-# that are available in your system. +-# +-#HMAC_CRYPTO_ALGO SHA512