elaborate on the editor selection of the programs

(Helmut Grohne) move login and shadowconfig to /usr

See merge request debian/shadow!19

AUTHORS.md

@@ -3,20 +3,11 @@ reports and various comments. This list may be incomplete, I received
 a lot of mail...
 
 # Maintainers
-* Marek Michałkiewicz <marekm72@gmail.com> (1995-2000)
 * Tomasz Kłoczko <kloczek@pld.org.pl> (2000-2007)
 * Nicolas François <nicolas.francois@centraliens.net> (2007-2014)
 * Serge E. Hallyn <serge@hallyn.com> (2014-now)
 * Christian Brauner <christian@brauner.io> (2019-now)
 * Iker Pedrosa <ipedrosa@redhat.com> (2022-now)
-* Alejandro Colomar <alx@kernel.org> (2023-now) (4.14 stable)
-
-To verify signatures on releases, use the following keys under keys/ :
-
-* Serge Hallyn: keys/66D0387DB85D320F8408166DB175CFA98F192AF2.asc
-* Christian Brauner: keys/4880B8C9BD0E5106FC070F4F7B3C391EFEA93624.asc
-* Iker Pedrosa: keys/4E80EF49C7987B6DE2F81F5005079C6C3A653E57.asc
-* Alejandro Colomar: keys/A9348594CE31283A826FBDD8D57633D441E25BB5.asc
 
 # Authors and contributors
 * Adam Rudnicki <adam@v-lo.krakow.pl>

ChangeLog

@@ -9558,7 +9558,7 @@
 	* NEWS: release date corrected.
 
 	* NEWS, src/su.c:
-	fixed set environment too early when using PAM, so move it to !USE_PAM
+	fixed set enviroment too early when using PAM, so move it to !USE_PAM
 	(patch submitted by Mike Frysinger <vapier@gentoo.org>).
 
 2006-07-30  Tomasz Kłoczko  <kloczek@pld.org.pl>
@@ -10245,7 +10245,7 @@
 	* NEWS: cleanups.
 
 	* autogen.sh:
-	by default in development environment use CFLAGS="-O2 -Wall".
+	by default in development enviroment use CFLAGS="-O2 -Wall".
 
 	* src/chgpasswd.c (main): remove two unused variables (newgr and now).
 
@@ -11654,7 +11654,7 @@
 	in OPTIONS section). Describe -a and -k options.
 
 	* NEWS, src/su.c:
-	fixed twice copy environment which causes auth problems (bug was introduced in 4.0.12;
+	fixed twice copy enviroment which causes auth problems (bug was introduced in 4.0.12;
 	fix by Nicolas François <nicolas.francois@centraliens.net>).
 
 	* src/passwd.c, po/ja.po, po/ko.po, po/nb.po, po/nl.po, po/nn.po, po/pl.po, po/pt.po, po/pt_BR.po, po/ro.po, po/ru.po, po/sk.po, po/sq.po, po/sv.po, po/tl.po, po/tr.po, po/uk.po, po/vi.po, po/zh_CN.po, po/zh_TW.po, po/bs.po, po/ca.po, po/cs.po, po/da.po, po/de.po, po/el.po, po/es.po, po/eu.po, po/fi.po, po/fr.po, po/he.po, po/id.po, po/it.po:
@@ -12584,7 +12584,7 @@
 	http://bugs.debian.org/48002
 
 	* src/login.c, NEWS:
-	fixed loggin of username on successful login (was using the normal username,
+	fixed loggin of username on succesful login (was using the normal username,
 	when it should have used pam_user) http://bugs.debian.org/47819
 
 2005-06-02  Tomasz Kłoczko  <kloczek@pld.org.pl>
@@ -13029,7 +13029,7 @@
 	* man/pl/usermod.8: finish sync with english version.
 
 	* man/hu/login.1, man/pl/login.1, NEWS, man/Attic/login.1, man/de/login.1:
-	removed fragment about abilities pass environment variables in login prompt.
+	removed fragment about abilities pass enviroment variables in login prompt.
 
 	* man/Attic/gpasswd.1, man/Attic/newgrp.1:
 	fixes by Nicolas Nicolas François <nicolas.francois@centraliens.net> (not all
@@ -13508,7 +13508,7 @@
 	removed not used translations.
 
 	* NEWS, src/su.c:
-	fix adding of pam_env env variables to environment (Martin Schlemmer <azarah@nosferatu.za.org>).
+	fix adding of pam_env env variables to enviroment (Martin Schlemmer <azarah@nosferatu.za.org>).
 
 	* NEWS, configure.in:
 	fixed filling MAIL_SPOOL_DIR and MAIL_SPOOL_FILE variables which was allways
@@ -13605,7 +13605,7 @@
 
 	* NEWS, src/su.c:
 	add pam_open_session() support. If builded without PAM support
-	propagate $DISPLAY and $XAUTHORITY environment variables.
+	propagate $DISPLAY and $XAUTHORITY enviroment variables.
 	Based on http://www.gentoo.org/cgi-bin/viewcvs.cgi/sys-apps/shadow/files/shadow-4.0.4.1-su-pam_open_session.patch?rev=1.1
 
 2004-10-23  Tomasz Kłoczko  <kloczek@pld.org.pl>

Makefile.am

@@ -1,28 +1,15 @@
 ## Process this file with automake to produce Makefile.in
-ACLOCAL_AMFLAGS = -I m4
 
-SUBDIRS = lib
+EXTRA_DIST = NEWS README TODO shadow.spec.in
+
+SUBDIRS = libmisc lib
 
 if ENABLE_SUBIDS
 SUBDIRS += libsubid
 endif
 
-SUBDIRS += src po doc etc tests/unit
+SUBDIRS += src po contrib doc etc
 
 if ENABLE_REGENERATE_MAN
 SUBDIRS += man
 endif
-
-CLEANFILES = man/8.out man/po/remove-potcdate.* man/*/login.defs.d man/*/*.mo
-
-EXTRA_DIST = NEWS README tests/
-
-dist-hook:
-	chmod -R u+w $(distdir)/tests
-	chmod u+w $(distdir)
-	mv $(distdir)/tests/unit $(distdir)/realunittest
-	mv $(distdir)/tests/tests $(distdir)/realtests
-	rm -rf $(distdir)/tests
-	mv $(distdir)/realtests $(distdir)/tests
-	rm -rf $(distdir)/tests/unit $(distdir)/tests/Makefile*
-	mv $(distdir)/realunittest $(distdir)/tests/unit

Makefile.in

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.18.1 from Makefile.am.
+# Makefile.in generated by automake 1.16.5 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2025 Free Software Foundation, Inc.
+# Copyright (C) 1994-2021 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -69,8 +69,6 @@ am__make_running_with_option = \
   test $$has_opt = yes
 am__make_dryrun = (target_option=n; $(am__make_running_with_option))
 am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
-am__rm_f = rm -f $(am__rm_f_notfound)
-am__rm_rf = rm -rf $(am__rm_f_notfound)
 pkgdatadir = $(datadir)/@PACKAGE@
 pkgincludedir = $(includedir)/@PACKAGE@
 pkglibdir = $(libdir)/@PACKAGE@
@@ -110,7 +108,7 @@ am__CONFIG_DISTCLEAN_FILES = config.status config.cache config.log \
  configure.lineno config.status.lineno
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = config.h
-CONFIG_CLEAN_FILES = man/po/Makefile
+CONFIG_CLEAN_FILES = man/po/Makefile shadow.spec
 CONFIG_CLEAN_VPATH_FILES =
 AM_V_P = $(am__v_P_@AM_V@)
 am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
@@ -165,26 +163,19 @@ am__define_uniq_tagged_files = \
   unique=`for i in $$list; do \
     if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
   done | $(am__uniquify_input)`
-DIST_SUBDIRS = lib libsubid src po doc etc tests/unit man
+DIST_SUBDIRS = libmisc lib libsubid src po contrib doc etc man
 am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/config.h.in \
-	$(top_srcdir)/build-aux/compile \
+	$(srcdir)/shadow.spec.in $(top_srcdir)/man/po/Makefile.in \
-	$(top_srcdir)/build-aux/config.guess \
+	ABOUT-NLS AUTHORS.md COPYING ChangeLog NEWS README TODO \
-	$(top_srcdir)/build-aux/config.rpath \
+	compile config.guess config.rpath config.sub install-sh \
-	$(top_srcdir)/build-aux/config.sub \
+	ltmain.sh missing
-	$(top_srcdir)/build-aux/install-sh \
-	$(top_srcdir)/build-aux/ltmain.sh \
-	$(top_srcdir)/build-aux/missing \
-	$(top_srcdir)/man/po/Makefile.in ABOUT-NLS AUTHORS.md COPYING \
-	ChangeLog NEWS README build-aux/compile build-aux/config.guess \
-	build-aux/config.rpath build-aux/config.sub \
-	build-aux/install-sh build-aux/ltmain.sh build-aux/missing
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 distdir = $(PACKAGE)-$(VERSION)
 top_distdir = $(distdir)
 am__remove_distdir = \
   if test -d "$(distdir)"; then \
-    find "$(distdir)" -type d ! -perm -700 -exec chmod u+rwx {} ';' \
+    find "$(distdir)" -type d ! -perm -200 -exec chmod u+w {} ';' \
-      ; rm -rf "$(distdir)" \
+      && rm -rf "$(distdir)" \
       || { sleep 5 && rm -rf "$(distdir)"; }; \
   else :; fi
 am__post_remove_distdir = $(am__remove_distdir)
@@ -214,20 +205,17 @@ am__relativize = \
   done; \
   reldir="$$dir2"
 DIST_ARCHIVES = $(distdir).tar.gz $(distdir).tar.xz
-GZIP_ENV = -9
+GZIP_ENV = --best
 DIST_TARGETS = dist-xz dist-gzip
 # Exists only to be overridden by the user if desired.
 AM_DISTCHECK_DVI_TARGET = dvi
 distuninstallcheck_listfiles = find . -type f -print
 am__distuninstallcheck_listfiles = $(distuninstallcheck_listfiles) \
   | sed 's|^\./|$(prefix)/|' | grep -v '$(infodir)/dir$$'
-distcleancheck_listfiles = \
+distcleancheck_listfiles = find . -type f -print
-  find . \( -type f -a \! \
-            \( -name .nfs* -o -name .smb* -o -name .__afs* \) \) -print
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
 AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
-AM_DISTCHECK_CONFIGURE_FLAGS = @AM_DISTCHECK_CONFIGURE_FLAGS@
 AR = @AR@
 AUTOCONF = @AUTOCONF@
 AUTOHEADER = @AUTOHEADER@
@@ -236,8 +224,6 @@ AWK = @AWK@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
 CFLAGS = @CFLAGS@
-CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
-CMOCKA_LIBS = @CMOCKA_LIBS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CSCOPE = @CSCOPE@
@@ -256,7 +242,6 @@ EGREP = @EGREP@
 ETAGS = @ETAGS@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
-FILECMD = @FILECMD@
 GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
 GMSGFMT = @GMSGFMT@
 GMSGFMT_015 = @GMSGFMT_015@
@@ -272,15 +257,9 @@ INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
 LD = @LD@
 LDFLAGS = @LDFLAGS@
 LIBACL = @LIBACL@
-LIBADD_DL = @LIBADD_DL@
-LIBADD_DLD_LINK = @LIBADD_DLD_LINK@
-LIBADD_DLOPEN = @LIBADD_DLOPEN@
-LIBADD_SHL_LOAD = @LIBADD_SHL_LOAD@
 LIBATTR = @LIBATTR@
 LIBAUDIT = @LIBAUDIT@
-LIBBSD = @LIBBSD@
+LIBCRACK = @LIBCRACK@
-LIBBSD_CFLAGS = @LIBBSD_CFLAGS@
-LIBBSD_LIBS = @LIBBSD_LIBS@
 LIBCRYPT = @LIBCRYPT@
 LIBECONF = @LIBECONF@
 LIBICONV = @LIBICONV@
@@ -296,16 +275,14 @@ LIBSUBID_ABI = @LIBSUBID_ABI@
 LIBSUBID_ABI_MAJOR = @LIBSUBID_ABI_MAJOR@
 LIBSUBID_ABI_MICRO = @LIBSUBID_ABI_MICRO@
 LIBSUBID_ABI_MINOR = @LIBSUBID_ABI_MINOR@
-LIBSYSTEMD = @LIBSYSTEMD@
 LIBTCB = @LIBTCB@
 LIBTOOL = @LIBTOOL@
 LIPO = @LIPO@
+LIYESCRYPT = @LIYESCRYPT@
 LN_S = @LN_S@
 LTLIBICONV = @LTLIBICONV@
 LTLIBINTL = @LTLIBINTL@
 LTLIBOBJS = @LTLIBOBJS@
-LT_DLLOADERS = @LT_DLLOADERS@
-LT_DLPREOPEN = @LT_DLPREOPEN@
 LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
@@ -328,9 +305,6 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
-PKG_CONFIG = @PKG_CONFIG@
-PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
-PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
 POSUB = @POSUB@
 RANLIB = @RANLIB@
 SED = @SED@
@@ -346,6 +320,8 @@ XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
 XMLCATALOG = @XMLCATALOG@
 XML_CATALOG_FILE = @XML_CATALOG_FILE@
 XSLTPROC = @XSLTPROC@
+YACC = @YACC@
+YFLAGS = @YFLAGS@
 abs_builddir = @abs_builddir@
 abs_srcdir = @abs_srcdir@
 abs_top_builddir = @abs_top_builddir@
@@ -356,10 +332,8 @@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
 am__quote = @am__quote@
-am__rm_f_notfound = @am__rm_f_notfound@
 am__tar = @am__tar@
 am__untar = @am__untar@
-am__xargs_n = @am__xargs_n@
 bindir = @bindir@
 build = @build@
 build_alias = @build_alias@
@@ -402,11 +376,9 @@ target_alias = @target_alias@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
-ACLOCAL_AMFLAGS = -I m4
+EXTRA_DIST = NEWS README TODO shadow.spec.in
-SUBDIRS = lib $(am__append_1) src po doc etc tests/unit \
+SUBDIRS = libmisc lib $(am__append_1) src po contrib doc etc \
 	$(am__append_2)
-CLEANFILES = man/8.out man/po/remove-potcdate.* man/*/login.defs.d man/*/*.mo
-EXTRA_DIST = NEWS README tests/
 all: config.h
 	$(MAKE) $(AM_MAKEFLAGS) all-recursive
 
@@ -450,17 +422,19 @@ config.h: stamp-h1
 	@test -f $@ || $(MAKE) $(AM_MAKEFLAGS) stamp-h1
 
 stamp-h1: $(srcdir)/config.h.in $(top_builddir)/config.status
-	$(AM_V_at)rm -f stamp-h1
+	@rm -f stamp-h1
-	$(AM_V_GEN)cd $(top_builddir) && $(SHELL) ./config.status config.h
+	cd $(top_builddir) && $(SHELL) ./config.status config.h
 $(srcdir)/config.h.in: @MAINTAINER_MODE_TRUE@ $(am__configure_deps) 
-	$(AM_V_GEN)($(am__cd) $(top_srcdir) && $(AUTOHEADER))
+	($(am__cd) $(top_srcdir) && $(AUTOHEADER))
-	$(AM_V_at)rm -f stamp-h1
+	rm -f stamp-h1
-	$(AM_V_at)touch $@
+	touch $@
 
 distclean-hdr:
 	-rm -f config.h stamp-h1
 man/po/Makefile: $(top_builddir)/config.status $(top_srcdir)/man/po/Makefile.in
 	cd $(top_builddir) && $(SHELL) ./config.status $@
+shadow.spec: $(top_builddir)/config.status $(srcdir)/shadow.spec.in
+	cd $(top_builddir) && $(SHELL) ./config.status $@
 
 mostlyclean-libtool:
 	-rm -f *.lo
@@ -576,13 +550,12 @@ cscopelist-am: $(am__tagged_files)
 distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
 	-rm -f cscope.out cscope.in.out cscope.po.out cscope.files
-
 distdir: $(BUILT_SOURCES)
 	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
 distdir-am: $(DISTFILES)
 	$(am__remove_distdir)
-	$(AM_V_at)$(MKDIR_P) "$(distdir)"
+	test -d "$(distdir)" || mkdir "$(distdir)"
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@@ -637,9 +610,6 @@ distdir-am: $(DISTFILES)
 	      || exit 1; \
 	  fi; \
 	done
-	$(MAKE) $(AM_MAKEFLAGS) \
-	  top_distdir="$(top_distdir)" distdir="$(distdir)" \
-	  dist-hook
 	-test -n "$(am__skip_mode_fix)" \
 	|| find "$(distdir)" -type d ! -perm -755 \
 		-exec chmod u+rwx,go+rx {} \; -o \
@@ -655,10 +625,6 @@ dist-bzip2: distdir
 	tardir=$(distdir) && $(am__tar) | BZIP2=$${BZIP2--9} bzip2 -c >$(distdir).tar.bz2
 	$(am__post_remove_distdir)
 
-dist-bzip3: distdir
-	tardir=$(distdir) && $(am__tar) | bzip3 -c >$(distdir).tar.bz3
-	$(am__post_remove_distdir)
-
 dist-lzip: distdir
 	tardir=$(distdir) && $(am__tar) | lzip -c $${LZIP_OPT--9} >$(distdir).tar.lz
 	$(am__post_remove_distdir)
@@ -699,11 +665,9 @@ dist dist-all:
 distcheck: dist
 	case '$(DIST_ARCHIVES)' in \
 	*.tar.gz*) \
-	  eval GZIP= gzip -dc $(distdir).tar.gz | $(am__untar) ;;\
+	  eval GZIP= gzip $(GZIP_ENV) -dc $(distdir).tar.gz | $(am__untar) ;;\
 	*.tar.bz2*) \
 	  bzip2 -dc $(distdir).tar.bz2 | $(am__untar) ;;\
-	*.tar.bz3*) \
-	  bzip3 -dc $(distdir).tar.bz3 | $(am__untar) ;;\
 	*.tar.lz*) \
 	  lzip -dc $(distdir).tar.lz | $(am__untar) ;;\
 	*.tar.xz*) \
@@ -711,7 +675,7 @@ distcheck: dist
 	*.tar.Z*) \
 	  uncompress -c $(distdir).tar.Z | $(am__untar) ;;\
 	*.shar.gz*) \
-	  eval GZIP= gzip -dc $(distdir).shar.gz | unshar ;;\
+	  eval GZIP= gzip $(GZIP_ENV) -dc $(distdir).shar.gz | unshar ;;\
 	*.zip*) \
 	  unzip $(distdir).zip ;;\
 	*.tar.zst*) \
@@ -809,11 +773,10 @@ install-strip:
 mostlyclean-generic:
 
 clean-generic:
-	-$(am__rm_f) $(CLEANFILES)
 
 distclean-generic:
-	-$(am__rm_f) $(CONFIG_CLEAN_FILES)
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-	-test . = "$(srcdir)" || $(am__rm_f) $(CONFIG_CLEAN_VPATH_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
 
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
@@ -893,9 +856,9 @@ uninstall-am:
 .PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am \
 	am--refresh check check-am clean clean-cscope clean-generic \
 	clean-libtool cscope cscopelist-am ctags ctags-am dist \
-	dist-all dist-bzip2 dist-bzip3 dist-gzip dist-hook dist-lzip \
+	dist-all dist-bzip2 dist-gzip dist-lzip dist-shar dist-tarZ \
-	dist-shar dist-tarZ dist-xz dist-zip dist-zstd distcheck \
+	dist-xz dist-zip dist-zstd distcheck distclean \
-	distclean distclean-generic distclean-hdr distclean-libtool \
+	distclean-generic distclean-hdr distclean-libtool \
 	distclean-tags distcleancheck distdir distuninstallcheck dvi \
 	dvi-am html html-am info info-am install install-am \
 	install-data install-data-am install-dvi install-dvi-am \
@@ -910,23 +873,6 @@ uninstall-am:
 .PRECIOUS: Makefile
 
 
-dist-hook:
-	chmod -R u+w $(distdir)/tests
-	chmod u+w $(distdir)
-	mv $(distdir)/tests/unit $(distdir)/realunittest
-	mv $(distdir)/tests/tests $(distdir)/realtests
-	rm -rf $(distdir)/tests
-	mv $(distdir)/realtests $(distdir)/tests
-	rm -rf $(distdir)/tests/unit $(distdir)/tests/Makefile*
-	mv $(distdir)/realunittest $(distdir)/tests/unit
-
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:
-
-# Tell GNU make to disable its built-in pattern rules.
-%:: %,v
-%:: RCS/%,v
-%:: RCS/%
-%:: s.%
-%:: SCCS/s.%

NEWS

@@ -696,7 +696,7 @@ shadow-4.0.18 -> shadow-4.0.18.1					03-08-2006
 shadow-4.0.17 -> shadow-4.0.18						01-08-2006
 
 *** general:
-- su: fixed set environment too early when using PAM, so move it to !USE_PAM
+- su: fixed set enviroment too early when using PAM, so move it to !USE_PAM
   (patch submitted by Mike Frysinger <vapier@gentoo.org>),
 - groupadd, groupmod, useradd, usermod: fixed UID/GID overflow (fixed
   http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198920)
@@ -855,7 +855,7 @@ shadow-4.0.14 -> shadow-4.0.15						13-03-2006
 - su: move exit() outside libmisc/shell.c::shell() for handle shell() errors
   on higher level (now is better visable where some programs exit with 126
   and 127 exit codes); added new shell() parameter (char *const envp[])
-  which allow fix preserving environment in su on using -p, (patch by
+  which allow fix preserving enviroment in su on using -p, (patch by
   Alexander Gattin <xrgtn@yandex.ru>),
 - su: added handle -c,--command option for GNU su compliance (merge
   437_su_-c_option Debian patch),
@@ -966,7 +966,7 @@ shadow-4.0.12 -> shadow-4.0.13						10-10-2005
   to example described in ident(1) man page (modern compilers like latest GCC
   removes not used functions by global optimization).
   So "ident /usr/bin/passwd" will show again some useable informations
-- su: fixed twice copy environment which causes auth problems
+- su: fixed twice copy enviroment which causes auth problems
   (bug was introduced in 4.0.12; fix by Nicolas François <nicolas.francois@centraliens.net>),
 - chage: differentiate the different failure causes by the exit value
   This will permit to adduser Debian script to detect if chage failed because the
@@ -1133,7 +1133,7 @@ shadow-4.0.9 -> shadow-4.0.10						28-06-2005
   http://bugs.debian.org/53702
 - login: check for hushed login and pass PAM_SILENT if true,
   http://bugs.debian.org/48002
-- login: fixed username on successful login (was using the normal username,
+- login: fixed username on succesful login (was using the normal username,
   when it should have used pam_user) http://bugs.debian.org/47819
 - remove using SHADOWPWD #define so now shadow is always built with shadow
   password support,
@@ -1212,7 +1212,7 @@ shadow-4.0.7 -> shadow-4.0.8						26-04-2005
   (without gshadow) doesn't permit to use newgrp,
 - newgrp(1): newgrp uses /bin/sh (not bash),
 - faillog(8): updated after rewritten faillog command for use getopt_long(),
-- login(1): removed fragment about abilities pass environment variables in login prompt,
+- login(1): removed fragment about abilities pass enviroment variables in login prompt,
 - gshadow(5): new file (by Nicolas Nicolas François <nicolas.francois@centraliens.net>),
 - usermod(8): fixed #302388 Debian bug: added separated -o option description,
 
@@ -1242,7 +1242,7 @@ shadow-4.0.6 -> shadow-4.0.7						26-01-2005
 
 shadow-4.0.5 -> shadow-4.0.6						08-11-2004
 
-- su: fixed adding of pam_env env variables to environment
+- su: fixed adding of pam_env env variables to enviroment
   (Martin Schlemmer <azarah@nosferatu.za.org>),
 - autoconf: fixed filling MAIL_SPOOL_DIR and MAIL_SPOOL_FILE variables
   which was always empty (Gregorio Guidi <g.guidi@sns.it>),
@@ -1275,7 +1275,7 @@ shadow-4.0.4.1 -> shadow-4.0.5						27-10-2004
   including symlinks placed into /etc/skel/public_html for example.
   http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=66819
 - su: add pam_open_session() support. If built without PAM support
-  propagate $DISPLAY and $XAUTHORITY environment variables.
+  propagate $DISPLAY and $XAUTHORITY enviroment variables.
   Based on http://www.gentoo.org/cgi-bin/viewcvs.cgi/sys-apps/shadow/files/shadow-4.0.4.1-su-pam_open_session.patch?rev=1.1
 - applied 036_pam_access_with_preauth.patch Debian patch submited by Bjorn
   Torkelsson <Bjorn.Torkelsson@hpc2n.umu.se>: add support for PAM account

README

@@ -17,12 +17,6 @@ are used for managing group accounts.
 * [Issue tracker](https://github.com/shadow-maint/shadow/issues)
 * [Releases](https://github.com/shadow-maint/shadow/releases)
 
-## Code
-
-The main development branch is at [https://github.com/shadow-maint/shadow.git](https://github.com/shadow-maint/shadow)
-
-See [STABLE.md](https://github.com/shadow-maint/shadow/blob/master/STABLE.md) for a list of supported stable branches.
-
 ## Contacts
 There are several ways to contact us:
 * [the general discussion mailing list](
@@ -37,11 +31,6 @@ There are several ways to contact us:
   https://alioth-lists-archive.debian.net/pipermail/pkg-shadow-commits/),
   only used for historical purposes
 
-## Contributions
-
-Contributions are welcome. Follow the
-[guidelines](doc/contributions/introduction.md) before posting any patches.
-
 ## Authors and maintainers
 Authors and maintainers are listed in [AUTHORS.md](
 https://github.com/shadow-maint/shadow/blob/master/AUTHORS.md).

TODO

@@ -0,0 +1,127 @@
+ * Create a common usage function that'd take the array of
+   long options and an array of descriptions and output that so things would
+   be standardized across the utils.
+   Usage strings should be normalized and split first.
+   Investigate optparse.
+
+
+/etc/default/useradd
+ * GROUP=1000 should accept a group name.
+
+Check when RLOGIN is enabled if ruserok() exists
+
+Move selinux_file_context out of libmisc/copydir.c
+
+Review hardcoded root account?
+
+review all call to strto
+
+libmisc/cleanup_user.c
+	cleanup needed (cleanup_report_add_user* not used)
+
+
+libxcrypt support
+ * http://wiki.linuxfromscratch.org/patches/browser/trunk/shadow/shadow-4.0.18.1-owl_blowfish-1.patch
+
+implement getlong, getulong.
+	avoid atoi, atol, atoul, strtol, strtoul, ...
+
+manpages: comment the RLOGIN parts
+
+Replace build_list (in lib/gshadow.c) and list (in lib/sgetgrent.c) by
+comma_to_list()
+
+Revert the modified files if all files could not be changed.
+  * or warn and indicate which files were modified and which were not.
+  * check the order the files are modified.
+
+report nscd_flush_cache failures?
+call nscd from the programs or from lib (commonio?)
+
+PAM: check if a non-interactive conversation function could be used to set
+the password in chpasswd and newusers
+
+WITH_SELINUX
+  - review all tools to check that the strategies are consistent
+
+chage, chfn, chsh: same change needed as in passwd.
+  - probably need moving check_selinux_access to a separate file.
+
+testsuite
+ - newgrp
+   - test with unknown user's GID
+
+newusers
+ - add logging to SYSLOG & AUDIT
+ - use CREATE_HOME
+ - Add a -Z option (see useradd / usermod)
+
+Document when/where option appeared, document whether an option is standard
+or not.
+
+Check all the expiry semantics
+
+ALL:
+- move base passwd/shadow/group/gshadow operation to module for allow write
+  different backend modules for db, NIS, LDAP and others. Default backend it
+  will be goot if will be chosen depending on /etc/nsswitch.conf and allow
+  override this by -r <repository> options (where the <repository> can be
+  file, db, nis nisplus, ldap .. like on /etc/nsswitch.conf in service column).
+  passwd have old piece of code with handling -r option and it will be good
+  finish this and propagate on other shadow tools for allow operate on other
+  user databases by well known tools.
+- Protect against signals. Register do_cleanups in a signal handler.
+
+- login.defs
+  - generate depending on configuration
+
+- useradd:
+  - add handle create user mail spool in maildir format.
+  - Add support for -k in -D mode
+  - Add support for -K in -D mode
+  - Add option to create or not the mail spool (and set the default in -D
+    mode)
+  - Change -l to reset the entry if an entry was already there
+  - set the mask in mkdir?
+
+- userdel:
+  - add backup option for the removal of user resources,
+  - user_busy: check that the user is not running any processes.
+  - missing "deleting group" FAILED
+  - home dir removed, but userdel may fail and may leave the user
+    => warning needed
+
+- usermod
+  - add an option equivalent to useradd's -l (only when uid is changed)
+  - the mode of new home directories should be set according to the
+    original mode. Does copy_tree does this?
+  - user renamed, order is not kept in /etc/group (see
+    47_usermod-l_no_shadow_file). This is a problem when the first user is
+    considered as the admin.
+  - see mail "user ID change" on  April, 15
+    + fix call to chown (combination of -m and -u/-g)
+    + add tests
+
+- passwd:
+  - check combination of options (e.g. -u/-l)
+  - when -u refuse to unlock because it would create an empty password, it
+    should not display "Password changed."
+    exit instead?
+
+- newgrp: check the USE_PAM section.
+
+- pwck
+  - Add check to move passwd passwords to shadow if there is a shadow
+    entry (with a password).
+  - Add check to move passwd passwords to shadow if there is a shadow
+    file.
+  - Support an alternative /etc/tcb directory as second parameter.
+  - add options -g / -G to specify alternative group / gshadow files
+
+- su
+  - add a login.defs configuration parameter to add variables to keep in
+    the environment with "su -l" (TERM/TERMCOLOR/...)
+
+- vipw
+  - set ACLs and XATTRs on the temporary file (and backups?)
+  - vipw + selinux -> use lib/selinux.c

build-aux/test-driver

@@ -1,160 +0,0 @@
-#! /bin/sh
-# test-driver - basic testsuite driver script.
-
-scriptversion=2025-06-18.21; # UTC
-
-# Copyright (C) 2011-2025 Free Software Foundation, Inc.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2, or (at your option)
-# any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-# As a special exception to the GNU General Public License, if you
-# distribute this file as part of a program that contains a
-# configuration script generated by Autoconf, you may include it under
-# the same distribution terms that you use for the rest of that program.
-
-# This file is maintained in Automake, please report
-# bugs to <bug-automake@gnu.org> or send patches to
-# <automake-patches@gnu.org>.
-
-# Make unconditional expansion of undefined variables an error.  This
-# helps a lot in preventing typo-related bugs.
-set -u
-
-usage_error ()
-{
-  echo "$0: $*" >&2
-  print_usage >&2
-  exit 2
-}
-
-print_usage ()
-{
-  cat <<END
-Usage:
-  test-driver --test-name NAME --log-file PATH --trs-file PATH
-              [--expect-failure {yes|no}] [--color-tests {yes|no}]
-              [--collect-skipped-logs {yes|no}]
-              [--enable-hard-errors {yes|no}] [--]
-              TEST-SCRIPT [TEST-SCRIPT-ARGUMENTS]
-
-The '--test-name', '--log-file' and '--trs-file' options are mandatory.
-See the GNU Automake documentation for information.
-
-Report bugs to <bug-automake@gnu.org>.
-GNU Automake home page: <https://www.gnu.org/software/automake/>.
-General help using GNU software: <https://www.gnu.org/gethelp/>.
-END
-}
-
-test_name= # Used for reporting.
-log_file=  # Where to save the output of the test script.
-trs_file=  # Where to save the metadata of the test run.
-expect_failure=no
-color_tests=no
-collect_skipped_logs=yes
-enable_hard_errors=yes
-while test $# -gt 0; do
-  case $1 in
-  --help) print_usage; exit $?;;
-  --version) echo "test-driver (GNU Automake) $scriptversion"; exit $?;;
-  --test-name) test_name=$2; shift;;
-  --log-file) log_file=$2; shift;;
-  --trs-file) trs_file=$2; shift;;
-  --color-tests) color_tests=$2; shift;;
-  --collect-skipped-logs) collect_skipped_logs=$2; shift;;
-  --expect-failure) expect_failure=$2; shift;;
-  --enable-hard-errors) enable_hard_errors=$2; shift;;
-  --) shift; break;;
-  -*) usage_error "invalid option: '$1'";;
-   *) break;;
-  esac
-  shift
-done
-
-missing_opts=
-test x"$test_name" = x && missing_opts="$missing_opts --test-name"
-test x"$log_file"  = x && missing_opts="$missing_opts --log-file"
-test x"$trs_file"  = x && missing_opts="$missing_opts --trs-file"
-if test x"$missing_opts" != x; then
-  usage_error "the following mandatory options are missing:$missing_opts"
-fi
-
-if test $# -eq 0; then
-  usage_error "missing argument"
-fi
-
-if test $color_tests = yes; then
-  # Keep this in sync with 'lib/am/check.am:$(am__tty_colors)'.
-  red='' # Red.
-  grn='' # Green.
-  lgn='' # Light green.
-  blu='' # Blue.
-  mgn='' # Magenta.
-  std=''     # No color.
-else
-  red= grn= lgn= blu= mgn= std=
-fi
-
-do_exit='rm -f $log_file $trs_file; (exit $st); exit $st'
-trap "st=129; $do_exit" 1
-trap "st=130; $do_exit" 2
-trap "st=141; $do_exit" 13
-trap "st=143; $do_exit" 15
-
-# Test script is run here. We create the file first, then append to it,
-# to ameliorate tests themselves also writing to the log file. Our tests
-# don't, but others can (automake bug#35762).
-: >"$log_file"
-"$@" >>"$log_file" 2>&1
-estatus=$?
-
-if test $enable_hard_errors = no && test $estatus -eq 99; then
-  tweaked_estatus=1
-else
-  tweaked_estatus=$estatus
-fi
-
-case $tweaked_estatus:$expect_failure in
-  0:yes) col=$red res=XPASS recheck=yes gcopy=yes;;
-  0:*)   col=$grn res=PASS  recheck=no  gcopy=no;;
-  77:*)  col=$blu res=SKIP  recheck=no  gcopy=$collect_skipped_logs;;
-  99:*)  col=$mgn res=ERROR recheck=yes gcopy=yes;;
-  *:yes) col=$lgn res=XFAIL recheck=no  gcopy=yes;;
-  *:*)   col=$red res=FAIL  recheck=yes gcopy=yes;;
-esac
-
-# Report the test outcome and exit status in the logs, so that one can
-# know whether the test passed or failed simply by looking at the '.log'
-# file, without the need of also peaking into the corresponding '.trs'
-# file (automake bug#11814).
-echo "$res $test_name (exit status: $estatus)" >>"$log_file"
-
-# Report outcome to console.
-echo "${col}${res}${std}: $test_name"
-
-# Register the test result, and other relevant metadata.
-echo ":test-result: $res" > $trs_file
-echo ":global-test-result: $res" >> $trs_file
-echo ":recheck: $recheck" >> $trs_file
-echo ":copy-in-global-log: $gcopy" >> $trs_file
-
-# Local Variables:
-# mode: shell-script
-# sh-indentation: 2
-# eval: (add-hook 'before-save-hook 'time-stamp nil t)
-# time-stamp-start: "scriptversion="
-# time-stamp-format: "%Y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC0"
-# time-stamp-end: "; # UTC"
-# End:

compile

@@ -1,9 +1,9 @@
 #! /bin/sh
 # Wrapper for compilers which do not understand '-c -o'.
 
-scriptversion=2025-06-18.21; # UTC
+scriptversion=2018-03-07.03; # UTC
 
-# Copyright (C) 1999-2025 Free Software Foundation, Inc.
+# Copyright (C) 1999-2021 Free Software Foundation, Inc.
 # Written by Tom Tromey <tromey@cygnus.com>.
 #
 # This program is free software; you can redistribute it and/or modify
@@ -37,11 +37,11 @@ IFS=" ""	$nl"
 
 file_conv=
 
-# func_file_conv build_file unneeded_conversions
+# func_file_conv build_file lazy
 # Convert a $build file to $host form and store it in $file
 # Currently only supports Windows hosts. If the determined conversion
-# type is listed in (the comma separated) UNNEEDED_CONVERSIONS, no
+# type is listed in (the comma separated) LAZY, no conversion will
-# conversion will take place.
+# take place.
 func_file_conv ()
 {
   file=$1
@@ -51,20 +51,9 @@ func_file_conv ()
 	# lazily determine how to convert abs files
 	case `uname -s` in
 	  MINGW*)
-	    if test -n "$MSYSTEM" && (cygpath --version) >/dev/null 2>&1; then
-	      # MSYS2 environment.
-	      file_conv=cygwin
-	    else
-	      # Original MinGW environment.
 	    file_conv=mingw
-	    fi
 	    ;;
-	  MSYS*)
+	  CYGWIN* | MSYS*)
-	    # Old MSYS environment, or MSYS2 with 32-bit MSYS2 shell.
-	    file_conv=cygwin
-	    ;;
-	  CYGWIN*)
-	    # Cygwin environment.
 	    file_conv=cygwin
 	    ;;
 	  *)
@@ -74,14 +63,12 @@ func_file_conv ()
       fi
       case $file_conv/,$2, in
 	*,$file_conv,*)
-	  # This is the optimization mentioned above:
-	  # If UNNEEDED_CONVERSIONS contains $file_conv, don't convert.
 	  ;;
 	mingw/*)
 	  file=`cmd //C echo "$file " | sed -e 's/"\(.*\) " *$/\1/'`
 	  ;;
-	cygwin/*)
+	cygwin/* | msys/*)
-	  file=`cygpath -w "$file" || echo "$file"`
+	  file=`cygpath -m "$file" || echo "$file"`
 	  ;;
 	wine/*)
 	  file=`winepath -w "$file" || echo "$file"`
@@ -156,7 +143,7 @@ func_cl_wrapper ()
 	  # configure might choose to run compile as 'compile cc -o foo foo.c'.
 	  eat=1
 	  case $2 in
-	    *.o | *.lo | *.[oO][bB][jJ])
+	    *.o | *.[oO][bB][jJ])
 	      func_file_conv "$2"
 	      set x "$@" -Fo"$file"
 	      shift
@@ -261,17 +248,14 @@ If you are trying to build a whole package this is not the
 right script to run: please start by reading the file 'INSTALL'.
 
 Report bugs to <bug-automake@gnu.org>.
-GNU Automake home page: <https://www.gnu.org/software/automake/>.
-General help using GNU software: <https://www.gnu.org/gethelp/>.
 EOF
     exit $?
     ;;
   -v | --v*)
-    echo "compile (GNU Automake) $scriptversion"
+    echo "compile $scriptversion"
     exit $?
     ;;
   cl | *[/\\]cl | cl.exe | *[/\\]cl.exe | \
-  clang-cl | *[/\\]clang-cl | clang-cl.exe | *[/\\]clang-cl.exe | \
   icl | *[/\\]icl | icl.exe | *[/\\]icl.exe )
     func_cl_wrapper "$@"      # Doesn't return...
     ;;
@@ -356,9 +340,9 @@ exit $ret
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 2
-# eval: (add-hook 'before-save-hook 'time-stamp nil t)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
-# time-stamp-format: "%Y-%02m-%02d.%02H"
+# time-stamp-format: "%:y-%02m-%02d.%02H"
 # time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:

config.guess

@@ -1,10 +1,10 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
-#   Copyright 1992-2024 Free Software Foundation, Inc.
+#   Copyright 1992-2022 Free Software Foundation, Inc.
 
 # shellcheck disable=SC2006,SC2268 # see below for rationale
 
-timestamp='2024-07-27'
+timestamp='2022-01-09'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -47,7 +47,7 @@ me=`echo "$0" | sed -e 's,.*/,,'`
 usage="\
 Usage: $0 [OPTION]
 
-Output the configuration name of the system '$me' is run on.
+Output the configuration name of the system \`$me' is run on.
 
 Options:
   -h, --help         print this help, then exit
@@ -60,13 +60,13 @@ version="\
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright 1992-2024 Free Software Foundation, Inc.
+Copyright 1992-2022 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
 
 help="
-Try '$me --help' for more information."
+Try \`$me --help' for more information."
 
 # Parse command line
 while test $# -gt 0 ; do
@@ -102,8 +102,8 @@ GUESS=
 # temporary files to be created and, as you can see below, it is a
 # headache to deal with in a portable fashion.
 
-# Historically, 'CC_FOR_BUILD' used to be named 'HOST_CC'. We still
+# Historically, `CC_FOR_BUILD' used to be named `HOST_CC'. We still
-# use 'HOST_CC' if defined, but it is deprecated.
+# use `HOST_CC' if defined, but it is deprecated.
 
 # Portable tmp directory creation inspired by the Autoconf team.
 
@@ -123,7 +123,7 @@ set_cc_for_build() {
     dummy=$tmp/dummy
     case ${CC_FOR_BUILD-},${HOST_CC-},${CC-} in
 	,,)    echo "int x;" > "$dummy.c"
-	       for driver in cc gcc c17 c99 c89 ; do
+	       for driver in cc gcc c89 c99 ; do
 		   if ($driver -c -o "$dummy.o" "$dummy.c") >/dev/null 2>&1 ; then
 		       CC_FOR_BUILD=$driver
 		       break
@@ -155,9 +155,6 @@ Linux|GNU|GNU/*)
 
 	set_cc_for_build
 	cat <<-EOF > "$dummy.c"
-	#if defined(__ANDROID__)
-	LIBC=android
-	#else
 	#include <features.h>
 	#if defined(__UCLIBC__)
 	LIBC=uclibc
@@ -165,8 +162,6 @@ Linux|GNU|GNU/*)
 	LIBC=dietlibc
 	#elif defined(__GLIBC__)
 	LIBC=gnu
-	#elif defined(__LLVM_LIBC__)
-	LIBC=llvm
 	#else
 	#include <stdarg.h>
 	/* First heuristic to detect musl libc.  */
@@ -174,7 +169,6 @@ Linux|GNU|GNU/*)
 	LIBC=musl
 	#endif
 	#endif
-	#endif
 	EOF
 	cc_set_libc=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`
 	eval "$cc_set_libc"
@@ -465,7 +459,7 @@ case $UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION in
 		UNAME_RELEASE=`uname -v`
 		;;
 	esac
-	# Japanese Language versions have a version number like '4.1.3-JL'.
+	# Japanese Language versions have a version number like `4.1.3-JL'.
 	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/-/_/'`
 	GUESS=sparc-sun-sunos$SUN_REL
 	;;
@@ -634,8 +628,7 @@ EOF
 		sed 's/^		//' << EOF > "$dummy.c"
 		#include <sys/systemcfg.h>
 
-		int
+		main()
-		main ()
 			{
 			if (!__power_pc())
 				exit(1);
@@ -719,8 +712,7 @@ EOF
 		#include <stdlib.h>
 		#include <unistd.h>
 
-		int
+		int main ()
-		main ()
 		{
 		#if defined(_SC_KERNEL_BITS)
 		    long bits = sysconf(_SC_KERNEL_BITS);
@@ -912,7 +904,7 @@ EOF
 	fi
 	;;
     *:FreeBSD:*:*)
-	UNAME_PROCESSOR=`uname -p`
+	UNAME_PROCESSOR=`/usr/bin/uname -p`
 	case $UNAME_PROCESSOR in
 	    amd64)
 		UNAME_PROCESSOR=x86_64 ;;
@@ -974,37 +966,11 @@ EOF
 	GNU_REL=`echo "$UNAME_RELEASE" | sed -e 's/[-(].*//'`
 	GUESS=$UNAME_MACHINE-unknown-$GNU_SYS$GNU_REL-$LIBC
 	;;
-    x86_64:[Mm]anagarm:*:*|i?86:[Mm]anagarm:*:*)
-	GUESS="$UNAME_MACHINE-pc-managarm-mlibc"
-	;;
-    *:[Mm]anagarm:*:*)
-	GUESS="$UNAME_MACHINE-unknown-managarm-mlibc"
-	;;
     *:Minix:*:*)
 	GUESS=$UNAME_MACHINE-unknown-minix
 	;;
     aarch64:Linux:*:*)
-	set_cc_for_build
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
-	CPU=$UNAME_MACHINE
-	LIBCABI=$LIBC
-	if test "$CC_FOR_BUILD" != no_compiler_found; then
-	    ABI=64
-	    sed 's/^	    //' << EOF > "$dummy.c"
-	    #ifdef __ARM_EABI__
-	    #ifdef __ARM_PCS_VFP
-	    ABI=eabihf
-	    #else
-	    ABI=eabi
-	    #endif
-	    #endif
-EOF
-	    cc_set_abi=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^ABI' | sed 's, ,,g'`
-	    eval "$cc_set_abi"
-	    case $ABI in
-		eabi | eabihf) CPU=armv8l; LIBCABI=$LIBC$ABI ;;
-	    esac
-	fi
-	GUESS=$CPU-unknown-linux-$LIBCABI
 	;;
     aarch64_be:Linux:*:*)
 	UNAME_MACHINE=aarch64_be
@@ -1070,16 +1036,7 @@ EOF
     k1om:Linux:*:*)
 	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
 	;;
-    kvx:Linux:*:*)
+    loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*)
-	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
-	;;
-    kvx:cos:*:*)
-	GUESS=$UNAME_MACHINE-unknown-cos
-	;;
-    kvx:mbr:*:*)
-	GUESS=$UNAME_MACHINE-unknown-mbr
-	;;
-    loongarch32:Linux:*:* | loongarch64:Linux:*:*)
 	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
 	;;
     m32r*:Linux:*:*)
@@ -1194,27 +1151,16 @@ EOF
 	;;
     x86_64:Linux:*:*)
 	set_cc_for_build
-	CPU=$UNAME_MACHINE
 	LIBCABI=$LIBC
 	if test "$CC_FOR_BUILD" != no_compiler_found; then
-	    ABI=64
+	    if (echo '#ifdef __ILP32__'; echo IS_X32; echo '#endif') | \
-	    sed 's/^	    //' << EOF > "$dummy.c"
+		(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
-	    #ifdef __i386__
+		grep IS_X32 >/dev/null
-	    ABI=x86
+	    then
-	    #else
+		LIBCABI=${LIBC}x32
-	    #ifdef __ILP32__
-	    ABI=x32
-	    #endif
-	    #endif
-EOF
-	    cc_set_abi=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^ABI' | sed 's, ,,g'`
-	    eval "$cc_set_abi"
-	    case $ABI in
-		x86) CPU=i686 ;;
-		x32) LIBCABI=${LIBC}x32 ;;
-	    esac
 	    fi
-	GUESS=$CPU-pc-linux-$LIBCABI
+	fi
+	GUESS=$UNAME_MACHINE-pc-linux-$LIBCABI
 	;;
     xtensa*:Linux:*:*)
 	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
@@ -1234,7 +1180,7 @@ EOF
 	GUESS=$UNAME_MACHINE-pc-sysv4.2uw$UNAME_VERSION
 	;;
     i*86:OS/2:*:*)
-	# If we were able to find 'uname', then EMX Unix compatibility
+	# If we were able to find `uname', then EMX Unix compatibility
 	# is probably installed.
 	GUESS=$UNAME_MACHINE-pc-os2-emx
 	;;
@@ -1375,7 +1321,7 @@ EOF
 		GUESS=ns32k-sni-sysv
 	fi
 	;;
-    PENTIUM:*:4.0*:*)	# Unisys 'ClearPath HMP IX 4000' SVR4/MP effort
+    PENTIUM:*:4.0*:*)	# Unisys `ClearPath HMP IX 4000' SVR4/MP effort
 			# says <Richard.M.Bartel@ccMail.Census.GOV>
 	GUESS=i586-unisys-sysv4
 	;;
@@ -1421,11 +1367,8 @@ EOF
     BePC:Haiku:*:*)	# Haiku running on Intel PC compatible.
 	GUESS=i586-pc-haiku
 	;;
-    ppc:Haiku:*:*)	# Haiku running on Apple PowerPC
+    x86_64:Haiku:*:*)
-	GUESS=powerpc-apple-haiku
+	GUESS=x86_64-unknown-haiku
-	;;
-    *:Haiku:*:*)	# Haiku modern gcc (not bound by BeOS compat)
-	GUESS=$UNAME_MACHINE-unknown-haiku
 	;;
     SX-4:SUPER-UX:*:*)
 	GUESS=sx4-nec-superux$UNAME_RELEASE
@@ -1597,9 +1540,6 @@ EOF
     *:Unleashed:*:*)
 	GUESS=$UNAME_MACHINE-unknown-unleashed$UNAME_RELEASE
 	;;
-    *:Ironclad:*:*)
-	GUESS=$UNAME_MACHINE-unknown-ironclad
-	;;
 esac
 
 # Do we have a guess based on uname results?
@@ -1623,7 +1563,6 @@ cat > "$dummy.c" <<EOF
 #endif
 #endif
 #endif
-int
 main ()
 {
 #if defined (sony)

config.h.in

@@ -4,12 +4,6 @@
    authenticate the callers */
 #undef ACCT_TOOLS_SETUID
 
-/* Define to support lastlog. */
-#undef ENABLE_LASTLOG
-
-/* Define to manage session support with logind. */
-#undef ENABLE_LOGIND
-
 /* Define to 1 if translation of program messages to the user's native
    language is requested. */
 #undef ENABLE_NLS
@@ -20,6 +14,10 @@
 /* Path for faillog file. */
 #undef FAILLOG_FILE
 
+/* Define to the type of elements in the array set by `getgroups'. Usually
+   this is either `int' or `gid_t'. */
+#undef GETGROUPS_T
+
 /* max group name length */
 #undef GROUP_NAME_MAX_LENGTH
 
@@ -32,7 +30,7 @@
 /* Define to 1 if you have the <acl/libacl.h> header file. */
 #undef HAVE_ACL_LIBACL_H
 
-/* Define to 1 if you have the 'arc4random_buf' function. */
+/* Define to 1 if you have the `arc4random_buf' function. */
 #undef HAVE_ARC4RANDOM_BUF
 
 /* Define to 1 if you have the <attr/error_context.h> header file. */
@@ -49,77 +47,121 @@
    the CoreFoundation framework. */
 #undef HAVE_CFPREFERENCESCOPYAPPVALUE
 
+/* Define to 1 if you have the <crypt.h> header file. */
+#undef HAVE_CRYPT_H
+
 /* Define if the GNU dcgettext() function is already present or preinstalled.
    */
 #undef HAVE_DCGETTEXT
 
-/* Define to 1 if you have the declaration of 'cygwin_conv_path', and to 0 if
+/* Define to 1 if you have the declaration of `PAM_DATA_SILENT', and to 0 if
-   you don't. */
-#undef HAVE_DECL_CYGWIN_CONV_PATH
-
-/* Define to 1 if you have the declaration of 'PAM_DATA_SILENT', and to 0 if
    you don't. */
 #undef HAVE_DECL_PAM_DATA_SILENT
 
-/* Define to 1 if you have the declaration of 'PAM_DELETE_CRED', and to 0 if
+/* Define to 1 if you have the declaration of `PAM_DELETE_CRED', and to 0 if
    you don't. */
 #undef HAVE_DECL_PAM_DELETE_CRED
 
-/* Define to 1 if you have the declaration of 'PAM_ESTABLISH_CRED', and to 0
+/* Define to 1 if you have the declaration of `PAM_ESTABLISH_CRED', and to 0
    if you don't. */
 #undef HAVE_DECL_PAM_ESTABLISH_CRED
 
-/* Define to 1 if you have the declaration of 'PAM_NEW_AUTHTOK_REQD', and to 0
+/* Define to 1 if you have the declaration of `PAM_NEW_AUTHTOK_REQD', and to 0
    if you don't. */
 #undef HAVE_DECL_PAM_NEW_AUTHTOK_REQD
 
-/* Define if you have the GNU dld library. */
-#undef HAVE_DLD
-
-/* Define to 1 if you have the 'dlerror' function. */
-#undef HAVE_DLERROR
-
 /* Define to 1 if you have the <dlfcn.h> header file. */
 #undef HAVE_DLFCN_H
 
-/* Define if you have the _dyld_func_lookup function. */
+/* Define to 1 if you have the <errno.h> header file. */
-#undef HAVE_DYLD
+#undef HAVE_ERRNO_H
 
-/* Define to 1 if you have the 'explicit_bzero' function. */
+/* Define to 1 if you have the `explicit_bzero' function. */
 #undef HAVE_EXPLICIT_BZERO
 
-/* Defined to 1 if you have the declaration of 'fgetpwent_r' */
+/* Define to 1 if you have the `fchmod' function. */
-#undef HAVE_FGETPWENT_R
+#undef HAVE_FCHMOD
 
-/* Define to 1 if you have the 'getentropy' function. */
+/* Define to 1 if you have the `fchown' function. */
+#undef HAVE_FCHOWN
+
+/* Define to 1 if you have the <fcntl.h> header file. */
+#undef HAVE_FCNTL_H
+
+/* Define to 1 if you have the `fsync' function. */
+#undef HAVE_FSYNC
+
+/* Define to 1 if you have the `futimes' function. */
+#undef HAVE_FUTIMES
+
+/* Define to 1 if you have the `getentropy' function. */
 #undef HAVE_GETENTROPY
 
-/* Define to 1 if you have the 'getrandom' function. */
+/* Define to 1 if you have the `getgrgid_r' function. */
+#undef HAVE_GETGRGID_R
+
+/* Define to 1 if you have the `getgrnam_r' function. */
+#undef HAVE_GETGRNAM_R
+
+/* Define to 1 if you have the `getpwnam_r' function. */
+#undef HAVE_GETPWNAM_R
+
+/* Define to 1 if you have the `getpwuid_r' function. */
+#undef HAVE_GETPWUID_R
+
+/* Define to 1 if you have the `getrandom' function. */
 #undef HAVE_GETRANDOM
 
-/* Define to 1 if you have the 'getspnam_r' function. */
+/* Define to 1 if you have the `getspnam' function. */
+#undef HAVE_GETSPNAM
+
+/* Define to 1 if you have the `getspnam_r' function. */
 #undef HAVE_GETSPNAM_R
 
 /* Define if the GNU gettext() function is already present or preinstalled. */
 #undef HAVE_GETTEXT
 
+/* Define to 1 if you have the `getusershell' function. */
+#undef HAVE_GETUSERSHELL
+
+/* Define to 1 if you have the `getutent' function. */
+#undef HAVE_GETUTENT
+
+/* Define to 1 if you have the <gshadow.h> header file. */
+#undef HAVE_GSHADOW_H
+
 /* Define if you have the iconv() function and it works. */
 #undef HAVE_ICONV
 
-/* Define to 1 if you have the 'innetgr' function. */
+/* Define to 1 if you have the `initgroups' function. */
+#undef HAVE_INITGROUPS
+
+/* Define to 1 if you have the `innetgr' function. */
 #undef HAVE_INNETGR
 
 /* Define to 1 if you have the <inttypes.h> header file. */
 #undef HAVE_INTTYPES_H
 
-/* Define to 1 if you have the 'lckpwdf' function. */
+/* Define to 1 if you have the `l64a' function. */
+#undef HAVE_L64A
+
+/* Define to 1 if you have the <lastlog.h> header file. */
+#undef HAVE_LASTLOG_H
+
+/* Define to 1 if you have the `lckpwdf' function. */
 #undef HAVE_LCKPWDF
 
-/* Define if you have the libdl library or equivalent. */
+/* Defined if you have libcrack. */
-#undef HAVE_LIBDL
+#undef HAVE_LIBCRACK
 
-/* Define if libdlloader will be built on this platform */
+/* Defined if you have the ts&szs cracklib. */
-#undef HAVE_LIBDLLOADER
+#undef HAVE_LIBCRACK_HIST
+
+/* Defined if it includes *Pw functions. */
+#undef HAVE_LIBCRACK_PW
+
+/* Define to 1 if you have the <limits.h> header file. */
+#undef HAVE_LIMITS_H
 
 /* Define to 1 if you have the <linux/btrfs_tree.h> header file. */
 #undef HAVE_LINUX_BTRFS_TREE_H
@@ -130,29 +172,44 @@
 /* Define if struct lastlog has ll_host */
 #undef HAVE_LL_HOST
 
-/* Define to 1 if you have the 'lutimes' function. */
+/* Define to 1 if you have the <locale.h> header file. */
+#undef HAVE_LOCALE_H
+
+/* Define to 1 if you have the `lutimes' function. */
 #undef HAVE_LUTIMES
 
-/* Define to 1 if you have the 'memset_explicit' function. */
+/* Define to 1 if you have the `memset_s' function. */
-#undef HAVE_MEMSET_EXPLICIT
+#undef HAVE_MEMSET_S
 
 /* Define to 1 if you have the <minix/config.h> header file. */
 #undef HAVE_MINIX_CONFIG_H
 
-/* Define to 1 if you have the 'putgrent' function. */
+/* Define to 1 if you have the `mkdir' function. */
+#undef HAVE_MKDIR
+
+/* Define to 1 if you have the <netdb.h> header file. */
+#undef HAVE_NETDB_H
+
+/* Define to 1 if you have the <paths.h> header file. */
+#undef HAVE_PATHS_H
+
+/* Define to 1 if you have the `putgrent' function. */
 #undef HAVE_PUTGRENT
 
-/* Define to 1 if you have the 'putpwent' function. */
+/* Define to 1 if you have the `putpwent' function. */
 #undef HAVE_PUTPWENT
 
-/* Define to 1 if you have the 'putspent' function. */
+/* Define to 1 if you have the `putspent' function. */
 #undef HAVE_PUTSPENT
 
-/* Define to 1 if you have the <readpassphrase.h> header file. */
+/* Define to 1 if you have the `rename' function. */
-#undef HAVE_READPASSPHRASE_H
+#undef HAVE_RENAME
 
-/* Define to 1 if you have the 'rpmatch' function. */
+/* Define to 1 if you have the `rmdir' function. */
-#undef HAVE_RPMATCH
+#undef HAVE_RMDIR
+
+/* Define to 1 if you have the <rpc/key_prot.h> header file. */
+#undef HAVE_RPC_KEY_PROT_H
 
 /* Define to 1 if you have the <security/openpam.h> header file. */
 #undef HAVE_SECURITY_OPENPAM_H
@@ -166,17 +223,29 @@
 /* Define to 1 if you have the <semanage/semanage.h> header file. */
 #undef HAVE_SEMANAGE_SEMANAGE_H
 
-/* Define to 1 if you have the 'sgetgrent' function. */
+/* Define to 1 if you have the `setgroups' function. */
+#undef HAVE_SETGROUPS
+
+/* Define to 1 if you have the `sgetgrent' function. */
 #undef HAVE_SGETGRENT
 
-/* Define to 1 if you have the 'sgetpwent' function. */
+/* Define to 1 if you have the `sgetpwent' function. */
 #undef HAVE_SGETPWENT
 
-/* Define to 1 if you have the 'sgetspent' function. */
+/* Define to 1 if you have the `sgetspent' function. */
 #undef HAVE_SGETSPENT
 
-/* Define if you have the shl_load function. */
+/* Define to 1 if you have the <sgtty.h> header file. */
-#undef HAVE_SHL_LOAD
+#undef HAVE_SGTTY_H
+
+/* Have working shadow group support in libc */
+#undef HAVE_SHADOWGRP
+
+/* Define to 1 if you have the `snprintf' function. */
+#undef HAVE_SNPRINTF
+
+/* Define to 1 if stdbool.h conforms to C99. */
+#undef HAVE_STDBOOL_H
 
 /* Define to 1 if you have the <stdint.h> header file. */
 #undef HAVE_STDINT_H
@@ -187,11 +256,14 @@
 /* Define to 1 if you have the <stdlib.h> header file. */
 #undef HAVE_STDLIB_H
 
-/* Define to 1 if you have the 'stpecpy' function. */
+/* Define to 1 if you have the `strcasecmp' function. */
-#undef HAVE_STPECPY
+#undef HAVE_STRCASECMP
 
-/* Define to 1 if you have the 'stpeprintf' function. */
+/* Define to 1 if you have the `strdup' function. */
-#undef HAVE_STPEPRINTF
+#undef HAVE_STRDUP
+
+/* Define to 1 if you have the `strerror' function. */
+#undef HAVE_STRERROR
 
 /* Define to 1 if you have the <strings.h> header file. */
 #undef HAVE_STRINGS_H
@@ -199,57 +271,144 @@
 /* Define to 1 if you have the <string.h> header file. */
 #undef HAVE_STRING_H
 
-/* Define to 1 if 'ut_addr' is a member of 'struct utmpx'. */
+/* Define to 1 if you have the `strstr' function. */
+#undef HAVE_STRSTR
+
+/* Define to 1 if `st_atim' is a member of `struct stat'. */
+#undef HAVE_STRUCT_STAT_ST_ATIM
+
+/* Define to 1 if `st_atimensec' is a member of `struct stat'. */
+#undef HAVE_STRUCT_STAT_ST_ATIMENSEC
+
+/* Define to 1 if `st_mtim' is a member of `struct stat'. */
+#undef HAVE_STRUCT_STAT_ST_MTIM
+
+/* Define to 1 if `st_mtimensec' is a member of `struct stat'. */
+#undef HAVE_STRUCT_STAT_ST_MTIMENSEC
+
+/* Define to 1 if `ut_addr' is a member of `struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_ADDR
 
-/* Define to 1 if 'ut_addr_v6' is a member of 'struct utmpx'. */
+/* Define to 1 if `ut_addr_v6' is a member of `struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_ADDR_V6
 
-/* Define to 1 if 'ut_host' is a member of 'struct utmpx'. */
+/* Define to 1 if `ut_host' is a member of `struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_HOST
 
-/* Define to 1 if 'ut_name' is a member of 'struct utmpx'. */
+/* Define to 1 if `ut_name' is a member of `struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_NAME
 
-/* Define to 1 if 'ut_syslen' is a member of 'struct utmpx'. */
+/* Define to 1 if `ut_syslen' is a member of `struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_SYSLEN
 
-/* Define to 1 if 'ut_time' is a member of 'struct utmpx'. */
+/* Define to 1 if `ut_time' is a member of `struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_TIME
 
-/* Define to 1 if 'ut_xtime' is a member of 'struct utmpx'. */
+/* Define to 1 if `ut_xtime' is a member of `struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_XTIME
 
+/* Define to 1 if `ut_addr' is a member of `struct utmp'. */
+#undef HAVE_STRUCT_UTMP_UT_ADDR
+
+/* Define to 1 if `ut_addr_v6' is a member of `struct utmp'. */
+#undef HAVE_STRUCT_UTMP_UT_ADDR_V6
+
+/* Define to 1 if `ut_host' is a member of `struct utmp'. */
+#undef HAVE_STRUCT_UTMP_UT_HOST
+
+/* Define to 1 if `ut_id' is a member of `struct utmp'. */
+#undef HAVE_STRUCT_UTMP_UT_ID
+
+/* Define to 1 if `ut_name' is a member of `struct utmp'. */
+#undef HAVE_STRUCT_UTMP_UT_NAME
+
+/* Define to 1 if `ut_syslen' is a member of `struct utmp'. */
+#undef HAVE_STRUCT_UTMP_UT_SYSLEN
+
+/* Define to 1 if `ut_time' is a member of `struct utmp'. */
+#undef HAVE_STRUCT_UTMP_UT_TIME
+
+/* Define to 1 if `ut_tv' is a member of `struct utmp'. */
+#undef HAVE_STRUCT_UTMP_UT_TV
+
+/* Define to 1 if `ut_type' is a member of `struct utmp'. */
+#undef HAVE_STRUCT_UTMP_UT_TYPE
+
+/* Define to 1 if `ut_user' is a member of `struct utmp'. */
+#undef HAVE_STRUCT_UTMP_UT_USER
+
+/* Define to 1 if `ut_xtime' is a member of `struct utmp'. */
+#undef HAVE_STRUCT_UTMP_UT_XTIME
+
+/* Define to 1 if you have the <syslog.h> header file. */
+#undef HAVE_SYSLOG_H
+
+/* Define to 1 if you have the <sys/capability.h> header file. */
+#undef HAVE_SYS_CAPABILITY_H
+
+/* Define to 1 if you have the <sys/ioctl.h> header file. */
+#undef HAVE_SYS_IOCTL_H
+
+/* Define to 1 if you have the <sys/random.h> header file. */
+#undef HAVE_SYS_RANDOM_H
+
+/* Define to 1 if you have the <sys/resource.h> header file. */
+#undef HAVE_SYS_RESOURCE_H
+
 /* Define to 1 if you have the <sys/statfs.h> header file. */
 #undef HAVE_SYS_STATFS_H
 
 /* Define to 1 if you have the <sys/stat.h> header file. */
 #undef HAVE_SYS_STAT_H
 
+/* Define to 1 if you have the <sys/time.h> header file. */
+#undef HAVE_SYS_TIME_H
+
 /* Define to 1 if you have the <sys/types.h> header file. */
 #undef HAVE_SYS_TYPES_H
 
 /* Define to 1 if you have the <tcb.h> header file. */
 #undef HAVE_TCB_H
 
+/* Define to 1 if you have the <termios.h> header file. */
+#undef HAVE_TERMIOS_H
+
+/* Define to 1 if you have the <termio.h> header file. */
+#undef HAVE_TERMIO_H
+
+/* Define to 1 if you have the <ulimit.h> header file. */
+#undef HAVE_ULIMIT_H
+
 /* Define to 1 if you have the <unistd.h> header file. */
 #undef HAVE_UNISTD_H
 
-/* Define to 1 if you have the 'updwtmpx' function. */
+/* Define to 1 if you have the `updwtmp' function. */
+#undef HAVE_UPDWTMP
+
+/* Define to 1 if you have the `updwtmpx' function. */
 #undef HAVE_UPDWTMPX
 
 /* Define to 1 if you have the <utime.h> header file. */
 #undef HAVE_UTIME_H
 
-/* Define to 1 if 'utime(file, NULL)' sets file's timestamp to the present. */
+/* Define to 1 if `utime(file, NULL)' sets file's timestamp to the present. */
 #undef HAVE_UTIME_NULL
 
-/* Define to support vendor settings. */
+/* Define to 1 if you have the <utmpx.h> header file. */
-#undef HAVE_VENDORDIR
+#undef HAVE_UTMPX_H
+
+/* Define to 1 if you have the <utmp.h> header file. */
+#undef HAVE_UTMP_H
 
 /* Define to 1 if you have the <wchar.h> header file. */
 #undef HAVE_WCHAR_H
 
+/* Define to 1 if the system has the type `_Bool'. */
+#undef HAVE__BOOL
+
+/* Path for lastlog file. */
+#undef LASTLOG_FILE
+
 /* Define to the sub-directory where libtool stores uninstalled libraries. */
 #undef LT_OBJDIR
 
@@ -283,6 +442,12 @@
 /* Path to passwd program. */
 #undef PASSWD_PROGRAM
 
+/* Define if login should support the -r flag for rlogind. */
+#undef RLOGIN
+
+/* Define to the ruserok() "success" return value (0 or 1). */
+#undef RUSEROK
+
 /* Define to support the shadow group file. */
 #undef SHADOWGRP
 
@@ -292,10 +457,10 @@
 /* The default shell. */
 #undef SHELL
 
-/* The size of 'gid_t', as computed by sizeof. */
+/* The size of `gid_t', as computed by sizeof. */
 #undef SIZEOF_GID_T
 
-/* The size of 'uid_t', as computed by sizeof. */
+/* The size of `uid_t', as computed by sizeof. */
 #undef SIZEOF_UID_T
 
 /* Define to support S/Key logins. */
@@ -304,7 +469,7 @@
 /* Define to support newer BSD S/Key API */
 #undef SKEY_BSD_STYLE
 
-/* Define to 1 if all of the C89 standard headers exist (not just the ones
+/* Define to 1 if all of the C90 standard headers exist (not just the ones
    required in a freestanding environment). This macro is provided for
    backward compatibility; new code need not use it. */
 #undef STDC_HEADERS
@@ -312,6 +477,9 @@
 /* Define to support /etc/suauth su access control. */
 #undef SU_ACCESS
 
+/* Define to 1 if your <sys/time.h> declares `struct tm'. */
+#undef TM_IN_SYS_TIME
+
 /* Define to allow the bcrypt password encryption algorithm */
 #undef USE_BCRYPT
 
@@ -327,7 +495,10 @@
 /* Define to support flushing of sssd caches */
 #undef USE_SSSD
 
-/* Enable extensions on AIX, Interix, z/OS.  */
+/* Define to use syslog(). */
+#undef USE_SYSLOG
+
+/* Enable extensions on AIX 3, Interix.  */
 #ifndef _ALL_SOURCE
 # undef _ALL_SOURCE
 #endif
@@ -388,15 +559,11 @@
 #ifndef __STDC_WANT_IEC_60559_DFP_EXT__
 # undef __STDC_WANT_IEC_60559_DFP_EXT__
 #endif
-/* Enable extensions specified by C23 Annex F.  */
-#ifndef __STDC_WANT_IEC_60559_EXT__
-# undef __STDC_WANT_IEC_60559_EXT__
-#endif
 /* Enable extensions specified by ISO/IEC TS 18661-4:2015.  */
 #ifndef __STDC_WANT_IEC_60559_FUNCS_EXT__
 # undef __STDC_WANT_IEC_60559_FUNCS_EXT__
 #endif
-/* Enable extensions specified by C23 Annex H and ISO/IEC TS 18661-3:2015.  */
+/* Enable extensions specified by ISO/IEC TS 18661-3:2015.  */
 #ifndef __STDC_WANT_IEC_60559_TYPES_EXT__
 # undef __STDC_WANT_IEC_60559_TYPES_EXT__
 #endif
@@ -419,12 +586,12 @@
 #endif
 
 
+/* Define if utmpx should be used */
+#undef USE_UTMPX
+
 /* Define to allow the yescrypt password encryption algorithm */
 #undef USE_YESCRYPT
 
-/* Directory for distribution provided configuration files */
-#undef VENDORDIR
-
 /* Version number of package */
 #undef VERSION
 
@@ -440,9 +607,6 @@
 /* Build shadow with BtrFS support */
 #undef WITH_BTRFS
 
-/* Build shadow without libbsd support */
-#undef WITH_LIBBSD
-
 /* Build shadow with SELinux support */
 #undef WITH_SELINUX
 
@@ -455,11 +619,17 @@
 /* Number of bits in a file offset, on hosts where this is settable. */
 #undef _FILE_OFFSET_BITS
 
-/* Define to 1 on platforms where this makes off_t a 64-bit type. */
+/* Define for large files, on AIX-style hosts. */
 #undef _LARGE_FILES
 
-/* Number of bits in time_t, on hosts where this is settable. */
+/* Path for utmp file. */
-#undef _TIME_BITS
+#undef _UTMP_FILE
 
-/* Define to 1 on platforms where this makes time_t a 64-bit type. */
+/* Path for wtmp file. */
-#undef __MINGW_USE_VC2005_COMPAT
+#undef _WTMP_FILE
+
+/* Define to `int' if <sys/types.h> doesn't define. */
+#undef gid_t
+
+/* Define to `int' if <sys/types.h> doesn't define. */
+#undef uid_t

contrib/Makefile.am

@@ -0,0 +1,6 @@
+# This is a dummy Makefile.am to get automake work flawlessly,
+# and also cooperate to make a distribution for `make dist'
+
+EXTRA_DIST = README adduser.c adduser.sh adduser2.sh \
+ atudel groupmems.shar pwdauth.c shadow-anonftp.patch \
+ udbachk.tgz

contrib/Makefile.in

@@ -0,0 +1,496 @@
+# Makefile.in generated by automake 1.16.5 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2021 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+# This is a dummy Makefile.am to get automake work flawlessly,
+# and also cooperate to make a distribution for `make dist'
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = contrib
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/acinclude.m4 \
+	$(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+SOURCES =
+DIST_SOURCES =
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+am__DIST_COMMON = $(srcdir)/Makefile.in README
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CSCOPE = @CSCOPE@
+CTAGS = @CTAGS@
+CYGPATH_W = @CYGPATH_W@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+ECONF_CPPFLAGS = @ECONF_CPPFLAGS@
+EGREP = @EGREP@
+ETAGS = @ETAGS@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
+GREP = @GREP@
+GROUP_NAME_MAX_LENGTH = @GROUP_NAME_MAX_LENGTH@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+LD = @LD@
+LDFLAGS = @LDFLAGS@
+LIBACL = @LIBACL@
+LIBATTR = @LIBATTR@
+LIBAUDIT = @LIBAUDIT@
+LIBCRACK = @LIBCRACK@
+LIBCRYPT = @LIBCRYPT@
+LIBECONF = @LIBECONF@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBMD = @LIBMD@
+LIBOBJS = @LIBOBJS@
+LIBPAM = @LIBPAM@
+LIBS = @LIBS@
+LIBSELINUX = @LIBSELINUX@
+LIBSEMANAGE = @LIBSEMANAGE@
+LIBSKEY = @LIBSKEY@
+LIBSUBID_ABI = @LIBSUBID_ABI@
+LIBSUBID_ABI_MAJOR = @LIBSUBID_ABI_MAJOR@
+LIBSUBID_ABI_MICRO = @LIBSUBID_ABI_MICRO@
+LIBSUBID_ABI_MINOR = @LIBSUBID_ABI_MINOR@
+LIBTCB = @LIBTCB@
+LIBTOOL = @LIBTOOL@
+LIPO = @LIPO@
+LIYESCRYPT = @LIYESCRYPT@
+LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAINT = @MAINT@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NM = @NM@
+NMEDIT = @NMEDIT@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+POSUB = @POSUB@
+RANLIB = @RANLIB@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+STRIP = @STRIP@
+USE_NLS = @USE_NLS@
+VENDORDIR = @VENDORDIR@
+VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLCATALOG = @XMLCATALOG@
+XML_CATALOG_FILE = @XML_CATALOG_FILE@
+XSLTPROC = @XSLTPROC@
+YACC = @YACC@
+YFLAGS = @YFLAGS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+capcmd = @capcmd@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+runstatedir = @runstatedir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+EXTRA_DIST = README adduser.c adduser.sh adduser2.sh \
+ atudel groupmems.shar pwdauth.c shadow-anonftp.patch \
+ udbachk.tgz
+
+all: all-am
+
+.SUFFIXES:
+$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign contrib/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign contrib/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+tags TAGS:
+
+ctags CTAGS:
+
+cscope cscopelist:
+
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am
+
+distdir-am: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile
+installdirs:
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool mostlyclean-am
+
+distclean: distclean-am
+	-rm -f Makefile
+distclean-am: clean-am distclean-generic
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am:
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-generic mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am:
+
+.MAKE: install-am install-strip
+
+.PHONY: all all-am check check-am clean clean-generic clean-libtool \
+	cscopelist-am ctags-am distclean distclean-generic \
+	distclean-libtool distdir dvi dvi-am html html-am info info-am \
+	install install-am install-data install-data-am install-dvi \
+	install-dvi-am install-exec install-exec-am install-html \
+	install-html-am install-info install-info-am install-man \
+	install-pdf install-pdf-am install-ps install-ps-am \
+	install-strip installcheck installcheck-am installdirs \
+	maintainer-clean maintainer-clean-generic mostlyclean \
+	mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
+	tags-am uninstall uninstall-am
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

contrib/README

@@ -0,0 +1,10 @@
+People keep sending various adduser programs and scripts...  They are
+all in this directory.  I haven't tested them, use at your own risk.
+Anyway, the best one I've seen so far is adduser-3.x from Debian.
+
+atudel is a perl script to remove at jobs owned by the specified user
+(atrm in at-2.9 for Linux can't do that).
+
+udbachk.tgz is a passwd/group/shadow file integrity checker.
+
+--marekm

contrib/adduser.c

@@ -0,0 +1,502 @@
+/****
+** 04/21/96
+** hacked even more, replaced gets() with something slightly harder to buffer
+** overflow. Added support for setting a default quota on new account, with
+** edquota -p. Other cleanups for security, I let some users run adduser suid
+** root to add new accounts. (overflow checks, clobber environment, valid 
+** shell checks, restrictions on gid + home dir settings).
+
+** Added max. username length. Used syslog() a bit for important events. 
+** Support to immediately expire account with passwd -e.
+
+** Called it version 2.0! Because I felt like it!
+
+** -- Chris, chris@ferret.lmh.ox.ac.uk
+
+** 03/17/96
+** hacked a bit more, removed unused code, cleaned up for gcc -Wall.
+** --marekm
+**
+** 02/26/96
+** modified to call shadow utils (useradd,chage,passwd) on shadowed 
+** systems - Cristian Gafton, gafton@sorosis.ro
+**
+** 6/27/95
+** shadow-adduser 1.4:
+**
+** now it copies the /etc/skel dir into the person's dir, 
+** makes the mail folders, changed some defaults and made a 'make 
+** install' just for the hell of it.
+**
+** Greg Gallagher
+** CIN.Net
+**
+** 1/28/95
+** shadow-adduser 1.3:
+** 
+** Basically a bug-fix on my additions in 1.2.  Thanks to Terry Stewart 
+** (stew@texas.net) for pointing out one of the many idiotic bugs I introduced.
+** It was such a stupid bug that I would have never seen it myself.
+**
+**                                Brandon
+*****
+** 01/27/95
+** 
+** shadow-adduser 1.2:
+** I took the C source from adduser-shadow (credits are below) and made
+** it a little more worthwhile.  Many small changes... Here's
+** the ones I can remember:
+** 
+** Removed support for non-shadowed systems (if you don't have shadow,
+**     use the original adduser, don't get this shadow version!)
+** Added support for the correct /etc/shadow fields (Min days before
+**     password change, max days before password change, Warning days,
+**     and how many days from expiry date does the account go invalid)
+**     The previous version just left all of those fields blank.
+**     There is still one field left (expiry date for the account, period)
+**     which I have left blank because I do not use it and didn't want to
+**     spend any more time on this.  I'm sure someone will put it in and
+**     tack another plethora of credits on here. :)
+** Added in the password date field, which should always reflect the last
+**     date the password was changed, for expiry purposes.  "passwd" always
+**     updates this field, so the adduser program should set it up right
+**     initially (or a user could keep thier initial password forever ;)
+**     The number is in days since Jan 1st, 1970.
+**
+**                       Have fun with it, and someone please make
+**                       a real version(this is still just a hack)
+**                       for us all to use (and Email it to me???)
+**
+**                               Brandon
+**                                  photon@usis.com
+**
+***** 
+** adduser 1.0: add a new user account (For systems not using shadow)
+** With a nice little interface and a will to do all the work for you.
+**
+** Craig Hagan
+** hagan@opine.cs.umass.edu
+**
+** Modified to really work, look clean, and find unused uid by Chris Cappuccio
+** chris@slinky.cs.umass.edu
+**
+*****
+**
+** 01/19/95
+**
+** FURTHER modifications to enable shadow passwd support (kludged, but
+** no more so than the original)  by Dan Crowson - dcrowson@mo.net
+**
+** Search on DAN for all changes...
+**
+*****
+**
+** cc -O -o adduser adduser.c
+** Use gcc if you have it... (political reasons beyond my control) (chris)
+**
+** I've gotten this program to work with success under Linux (without
+** shadow) and SunOS 4.1.3. I would assume it should work pretty well
+** on any system that uses no shadow. (chris)
+**
+** If you have no crypt() then try
+** cc -DNO_CRYPT -O -o adduser adduser.c xfdes.c
+** I'm not sure how login operates with no crypt()... I guess
+** the same way we're doing it here.
+*/
+
+#include <unistd.h>
+#include <stdlib.h>
+#include <pwd.h>
+#include <grp.h>
+#include <ctype.h>
+#include <stdio.h>
+#include <string.h>
+#include <time.h>
+#include <sys/types.h>
+#include <sys/timeb.h>
+#include <sys/time.h>
+#include <sys/stat.h>
+#include <syslog.h>
+
+#define IMMEDIATE_CHANGE	/* Expire newly created password, must be changed
+				 * immediately upon next login */
+#define HAVE_QUOTAS		/* Obvious */
+#define EXPIRE_VALS_SET		/* If defined, 'normal' users can't change 
+				 * password expiry values (if running suid root) */
+
+#define HAVE_GETUSERSHELL	/* FIXME: Isn't this defined in config.h too? */
+#define LOGGING			/* If we want to log various things to syslog */
+#define MAX_USRNAME  8		/* Longer usernames seem to work on my system....
+				 * But they're probably a poor idea */
+
+
+#define DEFAULT_SHELL	"/bin/bash"	/* because BASH is your friend */
+#define DEFAULT_HOME	"/home"
+#define USERADD_PATH	"/usr/sbin/useradd"
+#define CHAGE_PATH	"/usr/bin/chage"
+#define PASSWD_PATH	"/usr/bin/passwd"
+#define EDQUOTA_PATH	"/usr/sbin/edquota"
+#define QUOTA_DEFAULT	"defuser"
+#define DEFAULT_GROUP	100
+
+#define DEFAULT_MIN_PASS 0
+#define DEFAULT_MAX_PASS 100
+#define DEFAULT_WARN_PASS 14
+#define DEFAULT_USER_DIE 366
+
+void safeget (char *, int);
+
+void 
+main (void)
+{
+  char foo[32];
+  char usrname[32], person[32], dir[32], shell[32];
+  unsigned int group, min_pass, max_pass, warn_pass, user_die;
+  /* the group and uid of the new user */
+  int bad = 0, done = 0, correct = 0, olduid;
+  char cmd[255];
+  struct group *grp;
+
+  /* flags, in order:
+   * bad to see if the username is in /etc/passwd, or if strange stuff has
+   * been typed if the user might be put in group 0
+   * done allows the program to exit when a user has been added
+   * correct loops until a username is found that isn't in /etc/passwd
+   */
+
+  /* The real program starts HERE! */
+
+  if (geteuid () != 0)
+    {
+      printf ("It seems you don't have access to add a new user.  Try\n");
+      printf ("logging in as root or su root to gain superuser access.\n");
+      exit (1);
+    }
+
+  /* Sanity checks
+   */
+
+#ifdef LOGGING
+  openlog ("adduser", LOG_PID | LOG_CONS | LOG_NOWAIT, LOG_AUTH);
+  syslog (LOG_INFO, "invoked by user %s\n", getpwuid (getuid ())->pw_name);
+#endif
+
+  if (!(grp = getgrgid (DEFAULT_GROUP)))
+    {
+      printf ("Error: the default group %d does not exist on this system!\n",
+	      DEFAULT_GROUP);
+      printf ("adduser must be recompiled.\n");
+#ifdef LOGGING
+      syslog (LOG_ERR, "warning: failed. no such default group\n");
+      closelog ();
+#endif
+      exit (1);
+    };
+
+  while (!correct)
+    {				/* loop until a "good" usrname is chosen */
+      while (!done)
+	{
+	  printf ("\nLogin to add (^C to quit): ");
+	  fflush (stdout);
+
+	  safeget (usrname, sizeof (usrname));
+
+	  if (!strlen (usrname))
+	    {
+	      printf ("Empty input.\n");
+	      done = 0;
+	      continue;
+	    };
+
+	  /* what I saw here before made me think maybe I was running DOS */
+	  /* might this be a solution? (chris) */
+	  if (strlen (usrname) > MAX_USRNAME)
+	    {
+	      printf ("That name is longer than the maximum of %d characters. Choose another.\n", MAX_USRNAME);
+	      done = 0;
+	    }
+	  else if (getpwnam (usrname) != NULL)
+	    {
+	      printf ("That name is in use, choose another.\n");
+	      done = 0;
+	    }
+	  else if (strchr (usrname, ' ') != NULL)
+	    {
+	      printf ("No spaces in username!!\n");
+	      done = 0;
+	    }
+	  else
+	    done = 1;
+	};			/* done, we have a valid new user name */
+
+      /* all set, get the rest of the stuff */
+      printf ("\nEditing information for new user [%s]\n", usrname);
+
+      printf ("\nFull Name [%s]: ", usrname);
+      fflush (stdout);
+      safeget (person, sizeof (person));
+      if (!strlen (person))
+	{
+	  bzero (person, sizeof (person));
+	  strcpy (person, usrname);
+	};
+
+      if (getuid () == 0)
+	{
+	  do
+	    {
+	      bad = 0;
+	      printf ("GID [%d]: ", DEFAULT_GROUP);
+	      fflush (stdout);
+	      safeget (foo, sizeof (foo));
+	      if (!strlen (foo))
+		group = DEFAULT_GROUP;
+	      else if (isdigit (*foo))
+		{
+		  group = atoi (foo);
+		  if (!(grp = getgrgid (group)))
+		    {
+		      printf ("unknown gid %s\n", foo);
+		      group = DEFAULT_GROUP;
+		      bad = 1;
+		    };
+		}
+	      else if ((grp = getgrnam (foo)))
+		group = grp->gr_gid;
+	      else
+		{
+		  printf ("unknown group %s\n", foo);
+		  group = DEFAULT_GROUP;
+		  bad = 1;
+		}
+	      if (group == 0)
+		{		/* You're not allowed to make root group users! */
+		  printf ("Creation of root group users not allowed (must be done by hand)\n");
+		  group = DEFAULT_GROUP;
+		  bad = 1;
+		};
+	    }
+	  while (bad);
+	}
+      else
+	{
+	  printf ("Group will be default of: %d\n", DEFAULT_GROUP);
+	  group = DEFAULT_GROUP;
+	}
+
+      if (getuid () == 0)
+	{
+	  printf ("\nIf home dir ends with a / then '%s' will be appended to it\n", usrname);
+	  printf ("Home Directory [%s/%s]: ", DEFAULT_HOME, usrname);
+	  fflush (stdout);
+	  safeget (dir, sizeof (dir));
+	  if (!strlen (dir))
+	    {			/* hit return */
+	      sprintf (dir, "%s/%s", DEFAULT_HOME, usrname);
+	    }
+	  else if (dir[strlen (dir) - 1] == '/')
+	    sprintf (dir+strlen(dir), "%s", usrname);
+	}
+      else
+	{
+	  printf ("\nHome directory will be %s/%s\n", DEFAULT_HOME, usrname);
+	  sprintf (dir, "%s/%s", DEFAULT_HOME, usrname);
+	}
+
+      printf ("\nShell [%s]: ", DEFAULT_SHELL);
+      fflush (stdout);
+      safeget (shell, sizeof (shell));
+      if (!strlen (shell))
+	sprintf (shell, "%s", DEFAULT_SHELL);
+      else
+	{
+	  char *sh;
+	  int ok = 0;
+#ifdef HAVE_GETUSERSHELL
+	  setusershell ();
+	  while ((sh = getusershell ()) != NULL)
+	    if (!strcmp (shell, sh))
+	      ok = 1;
+	  endusershell ();
+#endif
+	  if (!ok)
+	    {
+	      if (getuid () == 0)
+		printf ("Warning: root allowed non standard shell\n");
+	      else
+		{
+		  printf ("Shell NOT in /etc/shells, DEFAULT used\n");
+		  sprintf (shell, "%s", DEFAULT_SHELL);
+		}
+	    }
+	}
+
+#ifdef EXPIRE_VALS_SET
+      if (getuid () == 0)
+	{
+#endif
+	  printf ("\nMin. Password Change Days [%d]: ", DEFAULT_MIN_PASS);
+	  fflush (stdout);
+	  safeget (foo, sizeof (foo));
+	  if (strlen (foo) > 1)
+	    min_pass = DEFAULT_MIN_PASS;
+	  else
+	    min_pass = atoi (foo);
+
+	  printf ("Max. Password Change Days [%d]: ", DEFAULT_MAX_PASS);
+	  fflush (stdout);
+	  safeget (foo, sizeof (foo));
+	  if (strlen (foo) > 1)
+	    max_pass = atoi (foo);
+	  else
+	    max_pass = DEFAULT_MAX_PASS;
+
+	  printf ("Password Warning Days [%d]: ", DEFAULT_WARN_PASS);
+	  fflush (stdout);
+	  safeget (foo, sizeof (foo));
+	  warn_pass = atoi (foo);
+	  if (warn_pass == 0)
+
+	    warn_pass = DEFAULT_WARN_PASS;
+
+	  printf ("Days after Password Expiry for Account Locking [%d]: ", DEFAULT_USER_DIE);
+	  fflush (stdout);
+	  safeget (foo, sizeof (foo));
+	  user_die = atoi (foo);
+	  if (user_die == 0)
+	    user_die = DEFAULT_USER_DIE;
+
+#ifdef EXPIRE_VALS_SET
+	}
+      else
+	{
+	  printf ("\nSorry, account expiry values are set.\n");
+	  user_die = DEFAULT_USER_DIE;
+	  warn_pass = DEFAULT_WARN_PASS;
+	  max_pass = DEFAULT_MAX_PASS;
+	  min_pass = DEFAULT_MIN_PASS;
+	}
+#endif
+
+      printf ("\nInformation for new user [%s] [%s]:\n", usrname, person);
+      printf ("Home directory: [%s] Shell: [%s]\n", dir, shell);
+      printf ("GID: [%d]\n", group);
+      printf ("MinPass: [%d] MaxPass: [%d] WarnPass: [%d] UserExpire: [%d]\n",
+	      min_pass, max_pass, warn_pass, user_die);
+      printf ("\nIs this correct? [y/N]: ");
+      fflush (stdout);
+      safeget (foo, sizeof (foo));
+
+      done = bad = correct = (foo[0] == 'y' || foo[0] == 'Y');
+
+      if (bad != 1)
+	printf ("\nUser [%s] not added\n", usrname);
+    }
+
+  /* Clobber the environment, I run this suid root sometimes to let 
+   * non root privileged accounts add users --chris */
+
+  *environ = NULL;
+
+  bzero (cmd, sizeof (cmd));
+  sprintf (cmd, "%s -g %d -d %s -s %s -c \"%s\" -m -k /etc/skel %s",
+	   USERADD_PATH, group, dir, shell, person, usrname);
+  printf ("Calling useradd to add new user:\n%s\n", cmd);
+  if (system (cmd))
+    {
+      printf ("User add failed!\n");
+#ifdef LOGGING
+      syslog (LOG_ERR, "could not add new user\n");
+      closelog ();
+#endif
+      exit (errno);
+    };
+
+  olduid = getuid ();	/* chage, passwd, edquota etc. require ruid = root
+			 */
+  setuid (0);
+
+  bzero (cmd, sizeof (cmd));
+
+  /* Chage runs suid root. => we need ruid root to run it with
+   * anything other than chage -l
+   */
+
+  sprintf (cmd, "%s -m %d -M %d -W %d -I %d %s", CHAGE_PATH,
+	   min_pass, max_pass, warn_pass, user_die, usrname);
+  printf ("%s\n", cmd);
+  if (system (cmd))
+    {
+      printf ("There was an error setting password expire values\n");
+#ifdef LOGGING
+      syslog (LOG_ERR, "password expire values could not be set\n");
+#endif
+    };
+
+  /* I want to add a user completely with one easy command --chris */
+
+#ifdef HAVE_QUOTAS
+  bzero (cmd, sizeof (cmd));
+  sprintf (cmd, "%s -p %s -u %s", EDQUOTA_PATH, QUOTA_DEFAULT, usrname);
+  printf ("%s\n", cmd);
+  if (system (cmd))
+    {
+      printf ("\nWarning: error setting quota\n");
+#ifdef LOGGING
+      syslog (LOG_ERR, "warning: account created but NO quotas set!\n");
+#endif /* LOGGING */
+    }
+  else
+    printf ("\nDefault quota set.\n");
+#endif /* HAVE_QUOTAS */
+
+  bzero (cmd, sizeof (cmd));
+  sprintf (cmd, "%s %s", PASSWD_PATH, usrname);
+  if (system (cmd))
+    {
+      printf ("\nWarning: error setting password\n");
+#ifdef LOGGING
+      syslog (LOG_ERR, "warning: password set failed!\n");
+#endif
+    }
+#ifdef IMMEDIATE_CHANGE
+  bzero (cmd, sizeof (cmd));
+  sprintf (cmd, "%s -e %s", PASSWD_PATH, usrname);
+  if (system (cmd))
+    {
+      printf ("\nWarning: error expiring password\n");
+#ifdef LOGGING
+      syslog (LOG_ERR, "warning: password expire failed!\n");
+#endif /* LOGGING */
+    }
+#endif /* IMMEDIATE_CHANGE */
+
+  setuid (olduid);
+
+#ifdef LOGGING
+  closelog ();
+#endif
+
+  printf ("\nDone.\n");
+}
+
+void 
+safeget (char *buf, int maxlen)
+{
+  int c, i = 0, bad = 0;
+  char *bstart = buf;
+  while ((c = getc (stdin)) != EOF && (c != '\n') && (++i < maxlen))
+    {
+      bad = (!isalnum (c) && (c != '_') && (c != ' '));
+      *(buf++) = (char) c;
+    }
+  *buf = '\0';
+
+  if (bad)
+    {
+      printf ("\nString contained banned character. Please stick to alphanumerics.\n");
+      *bstart = '\0';
+    }
+}
+

contrib/adduser.sh

@@ -0,0 +1,90 @@
+#!/bin/sh
+# adduser script for use with shadow passwords and useradd command.
+# by Hrvoje Dogan <hdogan@student.math.hr>, Dec 1995.
+
+echo -n "Login name for new user []:"
+read LOGIN
+if [ -z $LOGIN ]
+then echo "Come on, man, you can't leave the login field empty...";exit
+fi
+echo
+echo -n "User id for $LOGIN [ defaults to next available]:"
+read ID
+GUID="-u $ID"
+if [ -z $ID ] 
+then GUID=""
+fi
+
+echo
+echo -n "Initial group for $LOGIN [users]:"
+read GID
+GGID="-g $GID"
+if [ -z $GID ]
+then GGID=""
+fi
+
+echo
+echo -n "Additional groups for $LOGIN []:"
+read AGID
+GAGID="-G $AGID"
+if [ -z $AGID ]
+then GAGID=""
+fi
+
+echo
+echo -n "$LOGIN's home directory [/home/$LOGIN]:"
+read HME
+GHME="-d $HME"
+if [ -z $HME ]
+then GHME=""
+fi
+
+echo
+echo -n "$LOGIN's shell [/bin/bash]:"
+read SHL
+GSHL="-s $SHL"
+if [ -z $SHL ]
+then GSHL=""
+fi
+
+echo
+echo -n "$LOGIN's account expiry date (MM/DD/YY) []:"
+read EXP
+GEXP="-e $EXP"
+if [ -z $EXP ]
+then GEXP=""
+fi
+echo
+echo OK, I'm about to make a new account. Here's what you entered so far:
+echo New login name: $LOGIN
+if [ -z $GUID ] 
+then echo New UID: [Next available]
+else echo New UID: $UID
+fi
+if [ -z $GGID ]
+then echo Initial group: users
+else echo Initial group: $GID
+fi
+if [ -z $GAGID ]
+then echo Additional groups: [none]
+else echo Additional groups: $AGID
+fi
+if [ -z $GHME ]
+then echo Home directory: /home/$LOGIN
+else echo Home directory: $HME
+fi
+if [ -z $GSHL ]
+then echo Shell: /bin/bash
+else echo Shell: $SHL
+fi
+if [ -z $GEXP ]
+then echo Expiry date: [no expiration]
+else echo Expiry date: $EXP
+fi
+echo "This is it... if you want to bail out, you'd better do it now."
+read FOO
+echo Making new account...
+/usr/sbin/useradd $GHME -m $GEXP $GGID $GAGID $GSHL $GUID $LOGIN
+/usr/bin/chfn $LOGIN
+/usr/bin/passwd $LOGIN
+echo "Done..."

contrib/adduser2.sh

@@ -0,0 +1,743 @@
+#!/bin/bash
+#
+#  adduser			Interactive user adding program.
+#
+#  Copyright (C) 1996		Petri Mattila, Prihateam Networks
+#				petri@prihateam.fi
+#	
+#  This program is free software; you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation; either version 2, or (at your option)
+#  any later version.
+#
+# Changes:
+#	220496	v0.01	Initial version
+#	230496	v0.02	More checks, embolden summary
+#	240496		Even more checks
+#	250496 		Help with ?
+#	040596	v0.03	Cleanups
+#	050596	v0.04	Bug fixes, expire date checks
+#	070596	v0.05	Iso-latin-1 names
+#
+
+## Defaults
+
+# default groups
+def_group="users"
+def_other_groups=""
+
+# default home directory
+def_home_dir=/home/users
+
+# default shell
+def_shell=/bin/tcsh
+
+# Default expiration date (mm/dd/yy)
+def_expire=""
+
+# default dates
+def_pwd_min=0
+def_pwd_max=90
+def_pwd_warn=14
+def_pwd_iact=14
+
+
+# possible UIDs
+uid_low=1000
+uid_high=64000
+
+# skel directory
+skel=/etc/skel
+
+# default mode for home directory
+def_mode=711
+
+# Regex, that the login name must meet, only ANSI characters
+login_regex='^[0-9a-zA-Z_-]*$'
+
+# Regex, that the user name must meet
+# ANSI version
+##name_regex='^[0-9a-zA-Z_-\ ]*$'
+# ISO-LATIN-1 version
+name_regex='^[0-9a-zA-ZÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõöùúûüýþÿ_-\ ]*$'
+
+# set PATH
+export PATH="/bin:/sbin:/usr/bin:/usr/sbin"
+
+# Some special characters
+case "$TERM" in
+   vt*|ansi*|con*|xterm*|linux*)
+	S=''	# start embolden
+	E=''	# end embolden
+	;;
+   *)	
+	S=''
+	E=''
+	;;
+esac
+
+
+## Functions
+
+check_root() {
+	if test "$EUID" -ne 0
+	then
+		echo "You must be root to run this program."
+		exit 1
+	fi
+}
+
+check_user() {
+	local usr pwd uid gid name home sh
+
+	cat /etc/passwd | (
+		while IFS=":" read usr pwd uid gid name home sh
+		do
+			if test "$1" = "${usr}"
+			then
+				return 1
+			fi
+		done
+		return 0
+	)
+}
+
+check_group() {
+	local read grp pwd gid members
+
+	cat /etc/group | (
+		while IFS=":" read grp pwd gid members
+		do
+			if test "$1" = "${grp}"
+			then
+				return 1
+			fi
+		done
+		return 0
+	)
+}
+
+check_other_groups() {
+	local grp check IFS
+
+	check="$1"
+	IFS=","
+
+	set ${check}
+	for grp
+	do
+		if check_group "${grp}"
+		then
+			echo "Group ${grp} does not exist."
+			return 1
+		fi
+	done
+	return 0
+}		
+
+check_uid() {
+	local usr pwd uid gid name home sh
+	
+	cat /etc/passwd | (
+		while IFS=":" read usr pwd uid gid name home sh
+		do
+			if test "$1" = "${uid}"
+			then
+				return 1
+			fi
+		done
+		return 0
+	)
+}
+
+read_yn() {
+	local ans ynd
+	
+	ynd="$1"
+	
+	while :
+	do
+		read ans	
+		case "${ans}" in
+		      "") return ${ynd} ;;
+		    [nN]) return 1 ;;
+		    [yY]) return 0 ;;
+		       *) echo -n "Y or N, please ? " ;;
+		esac
+	done
+}
+
+read_login() {
+	echo
+	while :
+	do
+		echo -n "Login: ${def_login:+[${def_login}] }"
+		read login
+		
+		if test "${login}" = '?'
+		then
+			less /etc/passwd
+			echo
+			continue
+		fi
+
+		if test -z "${login}" -a -n "${def_login}"
+		then
+			login="${def_login}"
+			echo "Using ${login}"
+			return
+		fi
+		
+		if test "${#login}" -gt 8
+		then
+			echo "Login must be at most 8 characters long"
+			continue
+		fi
+		
+		if test "${#login}" -lt 2
+		then
+			echo "Login must be at least 2 characters long"
+			continue
+		fi
+		
+		if ! expr "${login}" : "${login_regex}" &> /dev/null
+		then
+			echo "Please use letters, numbers and special characters _-,."
+			continue
+		fi
+		
+		if ! check_user "${login}"
+		then
+			echo "Username ${login} is already in use"
+			continue
+		fi
+		
+		def_login="${login}"
+		return
+	done
+}
+
+read_name () {
+	echo
+	while :
+	do
+		echo -n "Real name: ${def_name:+[${def_name}] }"
+		read name
+		
+		if test "${name}" = '?'
+		then
+			less /etc/passwd
+			echo
+			continue
+		fi
+
+		if test -z "${name}" -a -n "${def_name}"
+		then
+			name="${def_name}"
+			echo "Using ${name}"
+		fi
+
+		if test "${#name}" -gt 32
+		then
+			echo "Name should be at most 32 characters long"
+			continue
+		fi
+
+		if ! expr "${name}" : "${name_regex}" &> /dev/null
+		then
+			echo "Please use letters, numbers, spaces and special characters ,._-"
+			continue
+		fi
+		
+		def_name="${name}"
+		return
+	done
+}
+
+read_home() {
+	local x
+	
+	echo
+	while :
+	do
+		echo -n "Home Directory: [${def_home_dir}/${login}] "
+		read home
+		
+		if test -z "${home}"
+		then
+			home="${def_home_dir}/${login}"
+			echo "Using ${home}"
+		fi
+		
+		if ! expr "${home}" : '^[0-9a-zA-Z,._-\/]*$' &> /dev/null
+		then
+			echo "Please use letters, numbers, spaces and special characters ,._-/"
+			continue
+		fi
+		
+		x="$(basename ${home})"
+		if test "${x}" != "${login}"
+		then
+			echo "Warning: you are about to use different login name and home directory."
+		fi
+		
+		x="$(dirname ${home})"
+		if ! test -d "${x}"
+		then
+			echo "Directory ${x} does not exist."
+			echo "If you still want to use it, please make it manually."
+			continue
+		fi
+		
+		def_home_dir="${x}"
+		return
+	done
+}
+
+read_shell () {
+	local x
+
+	echo
+	while :
+	do
+		echo -n "Shell: [${def_shell}] "
+		read shell
+		
+		if test -z "${shell}"
+		then
+			shell="${def_shell}"
+			echo "Using ${shell}"
+		fi
+		
+		for x in $(cat /etc/shells)
+		do
+			if test "${x}" = "${shell}"
+			then
+				def_shell="${shell}"
+				return
+			fi
+		done
+
+		echo "Possible shells are:"
+		cat /etc/shells
+	done
+}
+
+read_group () {
+	echo
+	while :
+	do
+		echo -n "Group: [${def_group}] "
+		read group
+		
+		if test -z "${group}"
+		then
+			group="${def_group}"
+			echo "Using ${group}"
+		fi
+		
+		if test "${group}" = '?'
+		then
+			less /etc/group
+			echo
+			continue
+		fi
+
+		if check_group "${group}"
+		then
+			echo "Group ${group} does not exist."
+			continue
+		fi
+		
+		def_group="${group}"
+		return
+	done
+}
+
+read_other_groups () {
+	echo
+	while :
+	do
+		echo -n "Other groups: [${def_og:-none}] "
+		read other_groups
+		
+		if test "${other_groups}" = '?'
+		then
+			less /etc/group
+			echo
+			continue
+		fi
+
+		if test -z "${other_groups}"
+		then
+			if test -n "${def_og}"
+			then
+				other_groups="${def_og}"
+				echo "Using ${other_groups}"
+			else	
+				echo "No other groups"
+				return
+			fi
+		fi
+		
+		
+		if ! check_other_groups "${other_groups}"
+		then
+			continue
+		fi
+		
+		def_og="${other_groups}"
+		return
+	done
+}
+
+read_uid () {
+	echo
+	while :
+	do
+		echo -n "uid: [first free] "
+		read uid
+			
+		if test -z "${uid}"
+		then
+			echo "Using first free UID."
+			return
+		fi
+		
+		if test "${uid}" = '?'
+		then
+			less /etc/passwd
+			echo
+			continue
+		fi
+
+		if ! expr "${uid}" : '^[0-9]+$' &> /dev/null
+		then
+			echo "Please use numbers only."
+			continue
+		fi
+		if test "${uid}" -lt "${uid_low}"
+		then
+			echo "UID must be greater than ${uid_low}"
+			continue
+		fi
+		if test "${uid}" -gt "${uid_high}"
+		then
+			echo "UID must be smaller than ${uid_high}"
+			continue
+		fi
+		if ! check_uid "${uid}"
+		then
+			echo "UID ${uid} is already in use"
+			continue
+		fi
+		
+		return
+	done
+}
+
+read_max_valid_days() {
+	echo
+	while :
+	do
+		echo -en "Maximum days between password changes: [${def_pwd_max}] "
+		read max_days
+		
+		if test -z "${max_days}"
+		then
+			max_days="${def_pwd_max}"
+			echo "Using ${max_days}"
+			return
+		fi
+		
+		if ! expr "${max_days}" : '^[0-9]+$' &> /dev/null
+		then
+			echo "Please use numbers only."
+			continue
+		fi
+		if test "${max_days}" -lt 7
+		then
+			echo "Warning: you are using a value shorter than a week."
+		fi
+		
+		def_pwd_max="${max_days}"
+		return	
+	done
+}
+
+read_min_valid_days() {
+	echo
+	while :
+	do
+		echo -en "Minimum days between password changes: [${def_pwd_min}] "
+		read min_days
+		
+		if test -z "${min_days}"
+		then
+			min_days="${def_pwd_min}"
+			echo "Using ${min_days}"
+			return
+		fi
+		
+		if ! expr "${min_days}" : '^[0-9]+$' &> /dev/null
+		then
+			echo "Please use numbers only."
+			continue
+		fi
+		if test "${min_days}" -gt 7
+		then
+			echo "Warning: you are using a value longer than a week."
+		fi
+		
+		def_pwd_min="${min_days}"
+		return	
+	done
+}
+
+read_warning_days() {
+	echo
+	while :
+	do
+		echo -en "Number of warning days before password expires: [${def_pwd_warn}] "
+		read warn_days
+		
+		if test -z "${warn_days}"
+		then
+			warn_days="${def_pwd_warn}"
+			echo "Using ${warn_days}"
+		fi
+
+		if ! expr "${warn_days}" : '^[0-9]+$' &> /dev/null
+		then
+			echo "Please use numbers only."
+			continue
+		fi
+		if test "${warn_days}" -gt 14
+		then
+			echo "Warning: you are using a value longer than two week."
+		fi
+		
+		def_pwd_warn="${warn_days}"
+		return	
+	done
+}
+
+
+read_inactive_days() {
+	echo
+	while :
+	do
+		echo -en "Number of usable days after expiration: [${def_pwd_iact}] "
+		read iact_days
+		
+		if test -z "${iact_days}"
+		then
+			iact_days="${def_pwd_iact}"
+			echo "Using ${iact_days}"
+			return
+		fi
+		if ! expr "${iact_days}" : '^[0-9]+$' &> /dev/null
+		then
+			echo "Please use numbers only."
+			continue
+		fi
+		if test "${iact_days}" -gt 14
+		then
+			echo "Warning: you are using a value that is more than two weeks."
+		fi
+		
+		def_pwd_iact="${iact_days}"
+		return	
+	done
+}
+
+read_expire_date() {
+	local ans
+	
+	echo
+	while :
+	do
+		echo -en "Expire date of this account (mm/dd/yy): [${def_expire:-never}] "
+		read ans
+		
+		if test -z "${ans}"
+		then
+			if test -z "${def_expire}"
+			then
+				ans="never"
+			else
+				ans="${def_expire}"
+				echo "Using ${def_expire}"
+			fi
+		fi
+		
+		if test "${ans}" = "never"
+		then
+			echo "Account will never expire."
+			def_expire=""
+			expire=""
+			return
+		fi
+
+		if ! expr "${ans}" : '^[0-9][0-9]/[0-9][0-9]/[0-9][0-9]$' &> /dev/null
+		then
+			echo "Please use format mm/dd/yy"
+			continue
+		fi
+		
+		if ! expire_date="$(date -d ${ans} '+%A, %B %d %Y')"
+		then
+			continue
+		fi
+		
+		def_expire="${expire}"
+		return	
+	done
+}
+
+read_passwd_yn() {
+	echo -en "\nDo you want to set password [Y/n] ? "
+	if read_yn 0
+	then
+		set_pwd="YES"
+	else
+		set_pwd=""
+	fi
+}
+
+
+print_values() {
+
+clear
+cat << EOM
+
+Login:        ${S}${login}${E}
+Group:        ${S}${group}${E}
+Other groups: ${S}${other_groups:-[none]}${E}
+
+Real Name:    ${S}${name}${E}
+
+uid:          ${S}${uid:-[first free]}${E}
+home:         ${S}${home}${E}
+shell:        ${S}${shell}${E}
+
+Account expiration date:                   ${S}${expire_date:-never}${E}
+Minimum days between password changes:     ${S}${min_days}${E}
+Maximum days between password changes:     ${S}${max_days}${E}
+Number of usable days after expiration:    ${S}${iact_days}${E}
+Number of warning days before expiration:  ${S}${warn_days}${E}
+
+${S}${set_pwd:+Set password for this account.}${E}
+
+EOM
+}
+
+set_user() {
+	if ! useradd \
+		-c "${name}" \
+		-d "${home}" \
+		-g "${group}" \
+		-s "${shell}" \
+		${expire:+-e ${expire}} \
+		${uid:+-u ${uid}} \
+		${other_groups:+-G ${other_groups}} \
+		${login}
+	then
+		echo "Error ($?) in useradd...exiting..."
+		exit 1
+	fi
+}
+
+set_aging() {
+	if ! passwd \
+		-x ${max_days} \
+		-n ${min_days} \
+		-w ${warn_days} \
+		-i ${iact_days} \
+		${login}
+	then
+		echo "Error ($?) in setting password aging...exiting..." 
+		exit 1
+	fi
+}
+
+set_password() {
+	if test -n "${set_pwd}"
+	then
+		echo
+		passwd ${login}
+		echo
+	fi
+}	
+
+set_system() {
+	if test -d "${home}"
+	then
+		echo "Directory ${home} already exists."
+		echo "Skeleton files not copied."
+		return
+	fi
+	
+	echo -n "Copying skeleton files..."
+	( 
+	  mkdir ${home}
+	  cd ${skel} && cp -af . ${home}
+	  chmod ${def_mode} ${home}
+	  chown -R ${login}:${group} ${home}
+	)
+	echo "done."
+
+	## Add your own stuff here:
+	echo -n "Setting up other files..."
+	(
+	  mailbox="/var/spool/mail/${login}"
+	  touch ${mailbox}
+	  chown "${login}:mail" ${mailbox}
+	  chmod 600 ${mailbox}
+	)
+	echo "done."
+}
+
+
+read_values() {
+	clear
+	echo -e "\nPlease answer the following questions about the new user to be added."
+	
+	while :
+	do
+		read_login
+		read_name
+		read_group
+		read_other_groups
+		read_home
+		read_shell
+		read_uid
+		read_expire_date
+		read_max_valid_days
+		read_min_valid_days
+		read_warning_days
+		read_inactive_days
+		read_passwd_yn
+
+		print_values
+		
+		echo -n "Is this correct [N/y] ? "
+		read_yn 1 && return
+	done
+}
+
+
+main() {
+	check_root
+	read_values
+	set_user
+	set_aging
+	set_system
+	set_password
+}
+
+
+## Run it 8-)
+main
+
+# End.

contrib/groupmems.shar

@@ -0,0 +1,465 @@
+#!/bin/sh
+# This is a shell archive (produced by GNU sharutils 4.2.1).
+# To extract the files from this archive, save it to some FILE, remove
+# everything before the `!/bin/sh' line above, then type `sh FILE'.
+#
+# Made on 2000-05-25 14:41 CDT by <gk4@gnu.austin.ibm.com>.
+# Source directory was `/home/gk4/src/groupmem'.
+#
+# Existing files will *not* be overwritten unless `-c' is specified.
+#
+# This shar contains:
+# length mode       name
+# ------ ---------- ------------------------------------------
+#   1960 -rw-r--r-- Makefile
+#   6348 -rw-r--r-- groupmems.c
+#   3372 -rw------- groupmems.8
+#
+save_IFS="${IFS}"
+IFS="${IFS}:"
+gettext_dir=FAILED
+locale_dir=FAILED
+first_param="$1"
+for dir in $PATH
+do
+  if test "$gettext_dir" = FAILED && test -f $dir/gettext \
+     && ($dir/gettext --version >/dev/null 2>&1)
+  then
+    set `$dir/gettext --version 2>&1`
+    if test "$3" = GNU
+    then
+      gettext_dir=$dir
+    fi
+  fi
+  if test "$locale_dir" = FAILED && test -f $dir/shar \
+     && ($dir/shar --print-text-domain-dir >/dev/null 2>&1)
+  then
+    locale_dir=`$dir/shar --print-text-domain-dir`
+  fi
+done
+IFS="$save_IFS"
+if test "$locale_dir" = FAILED || test "$gettext_dir" = FAILED
+then
+  echo=echo
+else
+  TEXTDOMAINDIR=$locale_dir
+  export TEXTDOMAINDIR
+  TEXTDOMAIN=sharutils
+  export TEXTDOMAIN
+  echo="$gettext_dir/gettext -s"
+fi
+if touch -am -t 200112312359.59 $$.touch >/dev/null 2>&1 && test ! -f 200112312359.59 -a -f $$.touch; then
+  shar_touch='touch -am -t $1$2$3$4$5$6.$7 "$8"'
+elif touch -am 123123592001.59 $$.touch >/dev/null 2>&1 && test ! -f 123123592001.59 -a ! -f 123123592001.5 -a -f $$.touch; then
+  shar_touch='touch -am $3$4$5$6$1$2.$7 "$8"'
+elif touch -am 1231235901 $$.touch >/dev/null 2>&1 && test ! -f 1231235901 -a -f $$.touch; then
+  shar_touch='touch -am $3$4$5$6$2 "$8"'
+else
+  shar_touch=:
+  echo
+  $echo 'WARNING: not restoring timestamps.  Consider getting and'
+  $echo "installing GNU \`touch', distributed in GNU File Utilities..."
+  echo
+fi
+rm -f 200112312359.59 123123592001.59 123123592001.5 1231235901 $$.touch
+#
+if mkdir _sh10937; then
+  $echo 'x -' 'creating lock directory'
+else
+  $echo 'failed to create lock directory'
+  exit 1
+fi
+# ============= Makefile ==============
+if test -f 'Makefile' && test "$first_param" != -c; then
+  $echo 'x -' SKIPPING 'Makefile' '(file already exists)'
+else
+  $echo 'x -' extracting 'Makefile' '(text)'
+  sed 's/^X//' << 'SHAR_EOF' > 'Makefile' &&
+/*
+# SPDX-FileCopyrightText: 2000, International Business Machines, Inc.
+# SPDX-FileCopyrightText: 2000, George Kraft IV, gk4@us.ibm.com
+# SPDX-License-Identifier: BSD-3-Clause
+# 
+X
+all: groupmems
+X
+groupmems: groupmems.c
+X	cc -g -o groupmems groupmems.c -L. -lshadow
+X
+install: groupmems
+X	-/usr/sbin/groupadd groups
+X	install -o root -g groups -m 4770 groupmems /usr/bin
+X
+install.man: groupmems.8
+X	install -o root -g root -m 644 groupmems.8 /usr/man/man8
+X
+SHAR_EOF
+  (set 20 00 05 25 14 40 28 'Makefile'; eval "$shar_touch") &&
+  chmod 0644 'Makefile' ||
+  $echo 'restore of' 'Makefile' 'failed'
+  if ( md5sum --help 2>&1 | grep 'sage: md5sum \[' ) >/dev/null 2>&1 \
+  && ( md5sum --version 2>&1 | grep -v 'textutils 1.12' ) >/dev/null; then
+    md5sum -c << SHAR_EOF >/dev/null 2>&1 \
+    || $echo 'Makefile:' 'MD5 check failed'
+b46cf7ef8d59149093c011ced3f3103c  Makefile
+SHAR_EOF
+  else
+    shar_count="`LC_ALL= LC_CTYPE= LANG= wc -c < 'Makefile'`"
+    test 1960 -eq "$shar_count" ||
+    $echo 'Makefile:' 'original size' '1960,' 'current size' "$shar_count!"
+  fi
+fi
+# ============= groupmems.c ==============
+if test -f 'groupmems.c' && test "$first_param" != -c; then
+  $echo 'x -' SKIPPING 'groupmems.c' '(file already exists)'
+else
+  $echo 'x -' extracting 'groupmems.c' '(text)'
+  sed 's/^X//' << 'SHAR_EOF' > 'groupmems.c' &&
+/*
+X * SPDX-FileCopyrightText: 2000, International Business Machines, Inc.
+X * SPDX-FileCopyrightText: 2000, George Kraft IV, gk4@us.ibm.com
+X * SPDX-License-Identifier: BSD-3-Clause
+X */
+/*
+**
+**	Utility "groupmem" adds and deletes members from a user's group.
+**	
+**	Setup (as "root"):
+**	
+**		groupadd -r groups 
+**		chmod 2770 groupmems
+**		chown root.groups groupmems
+**		groupmems -g groups -a gk4
+**	
+**	Usage (as "gk4"):
+**	
+**		groupmems -a olive
+**		groupmems -a jordan
+**		groupmems -a meghan
+**		groupmems -a morgan
+**		groupmems -a jake
+**		groupmems -l 
+**		groupmems -d jake
+**		groupmems -l 
+*/
+X
+#include <stdio.h>
+#include <pwd.h>
+#include <grp.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include "defines.h"
+#include "groupio.h"
+X
+/* Exit Status Values */
+X
+#define EXIT_SUCCESS		0	/* success */
+#define EXIT_USAGE		1	/* invalid command syntax */
+#define EXIT_GROUP_FILE		2	/* group file access problems */
+#define EXIT_NOT_ROOT		3	/* not superuser  */
+#define EXIT_NOT_EROOT		4	/* not effective superuser  */
+#define EXIT_NOT_PRIMARY	5	/* not primary owner of group  */
+#define EXIT_NOT_MEMBER		6	/* member of group does not exist */
+#define EXIT_MEMBER_EXISTS	7	/* member of group already exists */
+X
+#define TRUE 1
+#define FALSE 0
+X
+/* Globals */
+X
+extern int optind;
+extern char *optarg;
+static char *adduser = NULL;
+static char *deluser = NULL;
+static char *thisgroup = NULL;
+static int purge = FALSE;
+static int list = FALSE;
+static int exclusive = 0;
+X
+static int isroot(void) {
+X	return getuid() ? FALSE : TRUE;
+}
+X
+static int isgroup(void) {
+X	gid_t g = getgid();
+X	struct group *grp = getgrgid(g);
+X
+X	return TRUE;
+}
+X
+static char *whoami(void) {
+X	struct group *grp = getgrgid(getgid());
+X	struct passwd *usr = getpwuid(getuid());
+X
+X	if (0 == strcmp(usr->pw_name, grp->gr_name)) {
+X		return (char *)strdup(usr->pw_name);
+X	} else {
+X		return NULL;
+X	} 
+}
+X
+static void
+addtogroup(char *user, char **members) {
+X	int i;
+X	char **pmembers;
+X
+X	for (i = 0; NULL != members[i]; i++ ) {
+X		if (0 == strcmp(user, members[i])) {
+X			fprintf(stderr, "Member already exists\n");
+X			exit(EXIT_MEMBER_EXISTS);
+X		}
+X	}
+X
+X	if (0 == i) {
+X		pmembers = (char **)calloc(2, sizeof(char *));
+X	} else {
+X		pmembers = (char **)realloc(members, sizeof(char *)*(i+1));
+X	}
+X
+X	*members = *pmembers;
+X	members[i] = user;
+X	members[i+1] = NULL;
+}
+X
+static void
+rmfromgroup(char *user, char **members) {
+X	int i;
+X	int found = FALSE;
+X
+X	i = 0;
+X	while (!found && NULL != members[i]) {
+X		if (0 == strcmp(user, members[i])) {
+X			found = TRUE;
+X		} else {
+X			i++;
+X		}
+X	}
+X
+X	while (found && NULL != members[i]) {
+X		members[i] = members[++i];
+X	}
+X
+X	if (!found) {
+X		fprintf(stderr, "Member to remove could not be found\n");
+X		exit(EXIT_NOT_MEMBER);
+X	}
+}
+X
+static void
+nomembers(char **members) {
+X	int i;
+X
+X	for (i = 0; NULL != members[i]; i++ ) {
+X		members[i] = NULL;
+X	}
+}
+X
+static void
+members(char **members) {
+X	int i;
+X
+X	for (i = 0; NULL != members[i]; i++ ) {
+X		printf("%s ", members[i]);
+X
+X		if (NULL == members[i+1]) {
+X			printf("\n");
+X		} else {
+X			printf(" ");
+X		}
+X	}
+}
+X
+static void usage(void) {
+X	fprintf(stderr, "usage: groupmems -a username | -d username | -D | -l [-g groupname]\n");
+X	exit(EXIT_USAGE);
+}
+X
+main(int argc, char **argv) {
+X	int arg, i;
+X	char *name;
+X	struct group *grp;
+X
+X	while ((arg = getopt(argc, argv, "a:d:g:Dl")) != EOF) {
+X		switch (arg) {
+X		case 'a':
+X			adduser = strdup(optarg);
+X			++exclusive;
+X			break;
+X		case 'd':
+X			deluser = strdup(optarg);
+X			++exclusive;
+X			break;
+X		case 'g':
+X			thisgroup = strdup(optarg);
+X			break;
+X		case 'D':
+X			purge = TRUE;
+X			++exclusive;
+X			break;
+X		case 'l':
+X			list = TRUE;
+X			++exclusive;
+X			break;
+X		default:
+X			usage();
+X		}
+X	}
+X
+X	if (exclusive > 1 || optind < argc) {
+X		usage();
+X	}
+X
+X	if (!isroot() && NULL != thisgroup) {
+X		fprintf(stderr, "Only root can add members to different groups\n");
+X		exit(EXIT_NOT_ROOT);
+X	} else if (isroot() && NULL != thisgroup) {
+X		name = thisgroup;
+X	} else if (!isgroup()) {
+X		fprintf(stderr, "Group access is required\n");
+X		exit(EXIT_NOT_EROOT);
+X	} else if (NULL == (name = whoami())) {
+X		fprintf(stderr, "Not primary owner of current group\n");
+X		exit(EXIT_NOT_PRIMARY);
+X	}
+X
+X	if (!gr_lock()) {
+X		fprintf(stderr, "Unable to lock group file\n");
+X		exit(EXIT_GROUP_FILE);
+X	}
+X
+X	if (!gr_open(O_RDWR)) {
+X		fprintf(stderr, "Unable to open group file\n");
+X		exit(EXIT_GROUP_FILE);
+X	}
+X
+X	grp = (struct group *)gr_locate(name);
+X
+X	if (NULL != adduser) {
+X		addtogroup(adduser, grp->gr_mem);
+X		gr_update(grp);
+X	} else if (NULL != deluser) {
+X		rmfromgroup(deluser, grp->gr_mem);
+X		gr_update(grp);
+X	} else if (purge) {
+X		nomembers(grp->gr_mem);
+X		gr_update(grp);
+X	} else if (list) {
+X		members(grp->gr_mem);
+X	}
+X
+X	if (!gr_close()) {
+X		fprintf(stderr, "Cannot close group file\n");
+X		exit(EXIT_GROUP_FILE);
+X	}
+X
+X	gr_unlock();
+X
+X	exit(EXIT_SUCCESS);
+}
+X
+/* EOF */
+SHAR_EOF
+  (set 20 00 05 25 14 36 38 'groupmems.c'; eval "$shar_touch") &&
+  chmod 0644 'groupmems.c' ||
+  $echo 'restore of' 'groupmems.c' 'failed'
+  if ( md5sum --help 2>&1 | grep 'sage: md5sum \[' ) >/dev/null 2>&1 \
+  && ( md5sum --version 2>&1 | grep -v 'textutils 1.12' ) >/dev/null; then
+    md5sum -c << SHAR_EOF >/dev/null 2>&1 \
+    || $echo 'groupmems.c:' 'MD5 check failed'
+f0dd68f8d762d89d24d3ce1f4141f981  groupmems.c
+SHAR_EOF
+  else
+    shar_count="`LC_ALL= LC_CTYPE= LANG= wc -c < 'groupmems.c'`"
+    test 6348 -eq "$shar_count" ||
+    $echo 'groupmems.c:' 'original size' '6348,' 'current size' "$shar_count!"
+  fi
+fi
+# ============= groupmems.8 ==============
+if test -f 'groupmems.8' && test "$first_param" != -c; then
+  $echo 'x -' SKIPPING 'groupmems.8' '(file already exists)'
+else
+  $echo 'x -' extracting 'groupmems.8' '(text)'
+  sed 's/^X//' << 'SHAR_EOF' > 'groupmems.8' &&
+X.\"
+X.\" SPDX-FileCopyrightText: 2000, International Business Machines, Inc.
+X.\" SPDX-FileCopyrightText: 2000, George Kraft IV, gk4@us.ibm.com
+X.\" SPDX-License-Identifier: BSD-3-Clause
+X.\"
+X.\" $Id$
+X.\"
+X.TH GROUPMEMS 8
+X.SH NAME
+groupmems \- Administer members of a user's primary group
+X.SH SYNOPSIS
+X.B groupmems
+\fB-a\fI user_name \fR |
+\fB-d\fI user_name \fR |
+\fB-l\fR |
+\fB-D\fR |
+[\fB-g\fI group_name \fR]
+X.SH DESCRIPTION
+The \fBgroupmems\fR utility allows a user to administer their own
+group membership list without the requirement of superuser privileges.
+The \fBgroupmems\fR utility is for systems that configure its users to
+be in their own name sake primary group (i.e., guest / guest).
+X.P
+Only the superuser, as administrator, can use \fBgroupmems\fR to alter
+the memberships of other groups.
+X.IP "\fB-a \fIuser_name\fR"
+Add a new user to the group membership list.
+X.IP "\fB-d \fIuser_name\fR"
+Delete a user from the group membership list.
+X.IP "\fB-l\fR"
+List the group membership list.
+X.IP "\fB-D\fR"
+Delete all users from the group membership list.
+X.IP "\fB-g \fIgroup_name\fR"
+The superuser can specify which group membership list to modify.
+X.SH SETUP
+The \fBgroupmems\fR executable should be in mode \fB2770\fR as user \fBroot\fR
+and in group \fBgroups\fR.   The system administrator can add users to
+group groups to allow or disallow them using the  \fBgroupmems\fR utility
+to manager their own group membership list.
+X.P
+X     $ groupadd -r groups
+X.br
+X     $ chmod 2770 groupmems
+X.br
+X     $ chown root.groups groupmems
+X.br
+X     $ groupmems -g groups -a gk4
+X.SH FILES
+/etc/group
+X.br
+/etc/gshadow
+X.SH SEE ALSO
+X.BR chfn (1),
+X.BR chsh (1),
+X.BR useradd (8),
+X.BR userdel (8),
+X.BR usermod (8),
+X.BR passwd (1),
+X.BR groupadd (8),
+X.BR groupdel (8)
+X.SH AUTHOR
+George Kraft IV (gk4@us.ibm.com)
+X.\" EOF
+SHAR_EOF
+  (set 20 00 05 25 14 38 23 'groupmems.8'; eval "$shar_touch") &&
+  chmod 0600 'groupmems.8' ||
+  $echo 'restore of' 'groupmems.8' 'failed'
+  if ( md5sum --help 2>&1 | grep 'sage: md5sum \[' ) >/dev/null 2>&1 \
+  && ( md5sum --version 2>&1 | grep -v 'textutils 1.12' ) >/dev/null; then
+    md5sum -c << SHAR_EOF >/dev/null 2>&1 \
+    || $echo 'groupmems.8:' 'MD5 check failed'
+181e6cd3a3c9d3df320197fa2cde2b4a  groupmems.8
+SHAR_EOF
+  else
+    shar_count="`LC_ALL= LC_CTYPE= LANG= wc -c < 'groupmems.8'`"
+    test 3372 -eq "$shar_count" ||
+    $echo 'groupmems.8:' 'original size' '3372,' 'current size' "$shar_count!"
+  fi
+fi
+rm -fr _sh10937
+exit 0

contrib/pwdauth.c

@@ -0,0 +1,308 @@
+/*
+ * pwdauth.c - program to verify a given username/password pair.
+ *
+ * Run it with username in argv[1] (may be omitted - default is the
+ * current user), and send it the password over a pipe on stdin.
+ * Exit status: 0 - correct password, 1 - wrong password, >1 - other
+ * errors.  For use with shadow passwords, this program should be
+ * installed setuid root.
+ *
+ * This can be used, for example, by xlock - you don't have to install
+ * this large and complex (== possibly insecure) program setuid root,
+ * just modify it to run this simple program to do the authentication.
+ *
+ * Recent versions (xlockmore-3.9) are cleaner, and drop privileges as
+ * soon as possible after getting the user's encrypted password.
+ * Using this program probably doesn't make it more secure, and has one
+ * disadvantage: since we don't get the encrypted user's password at
+ * startup (but at the time the user is authenticated), it is not clear
+ * how we should handle errors (like getpwnam() returning NULL).
+ * - fail the authentication?  Problem: no way to unlock (other than kill
+ *   the process from somewhere else) if the NIS server stops responding.
+ * - succeed and unlock?  Problem: it's too easy to unlock by unplugging
+ *   the box from the network and waiting until NIS times out...
+ *
+ * This program is Copyright (C) 1996 Marek Michalkiewicz
+ * <marekm@i17linuxb.ists.pwr.wroc.pl>.
+ *
+ * It may be used and distributed freely for any purposes.  There is no
+ * warranty - use at your own risk.  I am not liable for any damages etc.
+ * If you improve it, please send me your changes.
+ */
+
+static char rcsid[] = "$Id$";
+
+/*
+ * Define USE_SYSLOG to use syslog() to log successful and failed
+ * authentication.  This should be safe even if your system has
+ * the infamous syslog buffer overrun security problem...
+ */
+#define USE_SYSLOG
+
+/*
+ * Define HAVE_GETSPNAM to get shadow passwords using getspnam().
+ * Some systems don't have getspnam(), but getpwnam() returns
+ * encrypted passwords only if running as root.
+ *
+ * According to the xlock source (not tested, except Linux) -
+ * define: Linux, Solaris 2.x, SVR4, ...
+ * undef: HP-UX with Secured Passwords, FreeBSD, NetBSD, QNX.
+ * Known not supported (yet): Ultrix, OSF/1, SCO.
+ */
+#define HAVE_GETSPNAM
+
+/*
+ * Define HAVE_PW_ENCRYPT to use pw_encrypt() instead of crypt().
+ * pw_encrypt() is like the standard crypt(), except that it may
+ * support better password hashing algorithms.
+ *
+ * Define if linking with libshadow.a from the shadow password
+ * suite (Linux, SunOS 4.x?).
+ */
+#undef HAVE_PW_ENCRYPT
+
+/*
+ * Define HAVE_AUTH_METHODS to support the shadow suite specific
+ * extension: the encrypted password field contains a list of
+ * administrator defined authentication methods, separated by
+ * semicolons.  This program only supports the standard password
+ * authentication method (a string that doesn't start with '@').
+ */
+#undef HAVE_AUTH_METHODS
+
+/*
+ * FAIL_DELAY - number of seconds to sleep before exiting if the
+ * password was wrong, to slow down password guessing attempts.
+ */
+#define FAIL_DELAY 2
+
+/* No user-serviceable parts below :-).  */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <pwd.h>
+
+#ifdef USE_SYSLOG
+#include <syslog.h>
+#ifndef LOG_AUTHPRIV
+#define LOG_AUTHPRIV LOG_AUTH
+#endif
+#endif
+
+#ifdef HAVE_GETSPNAM
+#include <shadow.h>
+#endif
+
+#ifdef HAVE_PW_ENCRYPT
+extern char *pw_encrypt();
+#define crypt pw_encrypt
+#endif
+
+/*
+ * Read the password (one line) from fp.  We don't turn off echo
+ * because we expect input from a pipe.
+ */
+static char *
+get_line(fp)
+	FILE *fp;
+{
+	static char buf[128];
+	char *cp;
+	int ch;
+
+	cp = buf;
+	while ((ch = getc(fp)) != EOF && ch != '\0' && ch != '\n') {
+		if (cp >= buf + sizeof buf - 1)
+			break;
+		*cp++ = ch;
+	}
+	*cp = '\0';
+	return buf;
+}
+
+/*
+ * Get the password file entry for the current user.  If the name
+ * returned by getlogin() is correct (matches the current real uid),
+ * return the entry for that user.  Otherwise, return the entry (if
+ * any) matching the current real uid.  Return NULL on failure.
+ */
+static struct passwd *
+get_my_pwent()
+{
+	uid_t uid = getuid();
+	char *name = getlogin();
+
+	if (name && *name) {
+		struct passwd *pw = getpwnam(name);
+
+		if (pw && pw->pw_uid == uid)
+			return pw;
+	}
+	return getpwuid(uid);
+}
+
+/*
+ * Verify the password.  The system-dependent shadow support is here.
+ */
+static int
+password_auth_ok(pw, pass)
+	const struct passwd *pw;
+	const char *pass;
+{
+	int result;
+	char *cp;
+#ifdef HAVE_AUTH_METHODS
+	char *buf;
+#endif
+#ifdef HAVE_GETSPNAM
+	struct spwd *sp;
+#endif
+
+	if (pw) {
+#ifdef HAVE_GETSPNAM
+		sp = getspnam(pw->pw_name);
+		if (sp)
+			cp = sp->sp_pwdp;
+		else
+#endif
+			cp = pw->pw_passwd;
+	} else
+		cp = "xx";
+
+#ifdef HAVE_AUTH_METHODS
+	buf = strdup(cp);  /* will be modified by strtok() */
+	if (!buf) {
+		fprintf(stderr, "Out of memory.\n");
+		exit(13);
+	}
+	cp = strtok(buf, ";");
+	while (cp && *cp == '@')
+		cp = strtok(NULL, ";");
+
+	/* fail if no password authentication for this user */
+	if (!cp)
+		cp = "xx";
+#endif
+
+	if (*pass || *cp)
+		result = (strcmp(crypt(pass, cp), cp) == 0);
+	else
+		result = 1;  /* user with no password */
+
+#ifdef HAVE_AUTH_METHODS
+	free(buf);
+#endif
+	return result;
+}
+
+/*
+ * Main program.
+ */
+int
+main(argc, argv)
+	int argc;
+	char **argv;
+{
+	struct passwd *pw;
+	char *pass, *name;
+	char myname[32];
+
+#ifdef USE_SYSLOG
+	openlog("pwdauth", LOG_PID | LOG_CONS, LOG_AUTHPRIV);
+#endif
+	pw = get_my_pwent();
+	if (!pw) {
+#ifdef USE_SYSLOG
+		syslog(LOG_ERR, "can't get login name for uid %d.\n",
+		       (int) getuid());
+#endif
+		fprintf(stderr, "Who are you?\n");
+		exit(2);
+	}
+	strncpy(myname, pw->pw_name, sizeof myname - 1);
+	myname[sizeof myname - 1] = '\0';
+	name = myname;
+
+	if (argc > 1) {
+		name = argv[1];
+		pw = getpwnam(name);
+	}
+
+	pass = get_line(stdin);
+	if (password_auth_ok(pw, pass)) {
+#ifdef USE_SYSLOG
+		syslog(pw->pw_uid ? LOG_INFO : LOG_NOTICE,
+		       "user `%s' entered correct password for `%.32s'.\n",
+		       myname, name);
+#endif
+		exit(0);
+	}
+#ifdef USE_SYSLOG
+	/* be careful not to overrun the syslog buffer */
+	syslog((!pw || pw->pw_uid) ? LOG_NOTICE : LOG_WARNING,
+	       "user `%s' entered incorrect password for `%.32s'.\n",
+	       myname, name);
+#endif
+#ifdef FAIL_DELAY
+	sleep(FAIL_DELAY);
+#endif
+	fprintf(stderr, "Wrong password.\n");
+	exit(1);
+}
+
+#if 0
+/*
+ * You can use code similar to the following to run this program.
+ * Return values: >=0 - program exit status (use the <sys/wait.h>
+ * macros to get the exit code, it is shifted left by 8 bits),
+ * -1 - check errno.
+ */
+int
+verify_password(const char *username, const char *password)
+{
+	int pipe_fd[2];
+	int pid, wpid, status;
+
+	if (pipe(pipe_fd))
+		return -1;
+	
+	if ((pid = fork()) == 0) {
+		char *arg[3];
+		char *env[1];
+
+		/* child */
+		close(pipe_fd[1]);
+		if (pipe_fd[0] != 0) {
+			if (dup2(pipe_fd[0], 0) != 0)
+				_exit(127);
+			close(pipe_fd[0]);
+		}
+		arg[0] = "/usr/bin/pwdauth";
+		arg[1] = username;
+		arg[2] = NULL;
+		env[0] = NULL;
+		execve(arg[0], arg, env);
+		_exit(127);
+	} else if (pid == -1) {
+		/* error */
+		close(pipe_fd[0]);
+		close(pipe_fd[1]);
+		return -1;
+	}
+	/* parent */
+	close(pipe_fd[0]);
+	write(pipe_fd[1], password, strlen(password));
+	write(pipe_fd[1], "\n", 1);
+	close(pipe_fd[1]);
+
+	while ((wpid = wait(&status)) != pid) {
+		if (wpid == -1)
+			return -1;
+	}
+	return status;
+}
+#endif

contrib/shadow-anonftp.patch

@@ -0,0 +1,147 @@
+Hello Marek,
+
+I have created a diffile against the 980403 release that adds
+functionality to newusers for automatic handling of users with only
+anonymous ftp login (using the guestgroup feature in ftpaccess, which
+means that the users home directory looks like '/home/user/./'). It also
+adds a commandline argument to specify an initial directory structure
+for such users, with a tarball normally containing the bin,lib,etc
+directories used in the chrooted environment.
+
+I am using it to automatically create chunks of users with only ftp
+access for a webserver.
+
+I have tried to follow your coding standards and I believe it is bug
+free but.. well, who knows. :) It's not much code however.
+
+I hope you find it useful. Do what you like with it, feel free to ask if
+anything is unclear.
+
+Best rgds,
+  Calle Karlsson
+  ckn@kash.se
+
+diff -uNr shadow-980403.orig/src/newusers.c shadow-980403/src/newusers.c
+--- shadow-980403.orig/src/newusers.c	Fri Jan 30 00:22:43 1998
++++ shadow-980403/src/newusers.c	Fri Apr 17 16:55:33 1998
+@@ -76,11 +76,35 @@
+ static void
+ usage(void)
+ {
+-	fprintf(stderr, "Usage: %s [ input ]\n", Prog);
++	fprintf (stderr, "Usage: %s [-p prototype tarfile] [ input ]\n", Prog);
++	fprintf (stderr, "The prototype tarfile is only used for users\n");
++	fprintf (stderr, "marked as anonymous ftp users. It must be a full pathname.\n");
+ 	exit(1);
+ }
+ 
+ /*
++ * createuserdir - create a directory and chmod it
++ */
++
++static int
++createuserdir (char * dir, int uid, int gid, int line)
++{
++	if (mkdir (dir, 0777 & ~getdef_num("UMASK", 077))) {
++		fprintf (stderr, "%s: line %d: mkdir %s failed\n",
++			 Prog, line, dir);
++		return -1;
++	}
++
++	if (chown (dir, uid, gid)) {
++		fprintf (stderr, "%s: line %d: chown %s failed\n",
++			 Prog, line, dir);
++		return -1;
++	}
++
++	return 0;
++}
++
++/*
+  * add_group - create a new group or add a user to an existing group
+  */
+ 
+@@ -328,6 +352,8 @@
+ main(int argc, char **argv)
+ {
+ 	char	buf[BUFSIZ];
++	char	anonproto[BUFSIZ];
++	int	flag;
+ 	char	*fields[8];
+ 	int	nfields;
+ 	char	*cp;
+@@ -340,12 +366,23 @@
+ 
+ 	Prog = Basename(argv[0]);
+ 
+-	if (argc > 1 && argv[1][0] == '-')
+-		usage ();
++	* anonproto = '\0';
++
++	while ((flag = getopt (argc, argv, "p:h")) != EOF) {
++		switch (flag) {
++		case 'p':
++			STRFCPY(anonproto, optarg);
++			break;
++		case 'h':
++		default:
++			usage ();
++			break;
++		}
++	}
+ 
+-	if (argc == 2) {
+-		if (! freopen (argv[1], "r", stdin)) {
+-			snprintf(buf, sizeof buf, "%s: %s", Prog, argv[1]);
++	if (optind < argc) {
++		if (! freopen (argv[optind], "r", stdin)) {
++			snprintf(buf, sizeof buf, "%s: %s", Prog, argv[optind]);
+ 			perror (buf);
+ 			exit (1);
+ 		}
+@@ -499,15 +536,36 @@
+ 		if (fields[6][0])
+ 			newpw.pw_shell = fields[6];
+ 
+-		if (newpw.pw_dir[0] && access(newpw.pw_dir, F_OK)) {
+-			if (mkdir (newpw.pw_dir,
+-					0777 & ~getdef_num("UMASK", 077)))
+-				fprintf (stderr, "%s: line %d: mkdir failed\n",
+-					Prog, line);
+-			else if (chown (newpw.pw_dir,
+-					newpw.pw_uid, newpw.pw_gid))
+-				fprintf (stderr, "%s: line %d: chown failed\n",
+-					Prog, line);
++		if (newpw.pw_dir[0]) {
++		        char * userdir = strdup (newpw.pw_dir);
++			char * anonpart;
++			int rc;
++
++			if ((anonpart = strstr (userdir, "/./"))) {
++			        * anonpart = '\0';
++				anonpart += 2;
++			}
++			
++			if (access(userdir, F_OK))
++				rc = createuserdir (userdir, newpw.pw_uid, newpw.pw_gid, line);
++			else
++				rc = 0;
++
++			if (rc == 0 && anonpart) {
++				if (* anonproto) {
++					char cmdbuf [BUFSIZ];
++					snprintf(cmdbuf, sizeof cmdbuf,
++						 "cd %s; tar xf %s",
++						 userdir, anonproto);
++					system (cmdbuf);
++				}
++				if (strlen (anonpart) > 1) {
++					strcat (userdir, anonpart);
++					if (access (userdir, F_OK))
++						createuserdir (userdir, newpw.pw_uid, newpw.pw_gid, line);
++				}
++			}
++			free (userdir);
+ 		}
+ 
+ 		/*

debian/HOME_MODE.xml

@@ -0,0 +1,43 @@
+<!--
+   Copyright (c) 1991 - 1993, Julianne Frances Haugh
+   Copyright (c) 1991 - 1993, Chip Rosenthal
+   Copyright (c) 2007 - 2009, Nicolas François
+   All rights reserved.
+  
+   Redistribution and use in source and binary forms, with or without
+   modification, are permitted provided that the following conditions
+   are met:
+   1. Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+   2. Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+   3. The name of the copyright holders or contributors may not be used to
+      endorse or promote products derived from this software without
+      specific prior written permission.
+  
+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+   HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+-->
+<varlistentry>
+  <term><option>HOME_MODE</option> (number)</term>
+  <listitem>
+    <para>
+      The mode for new home directories. If not specified,
+      the <option>UMASK</option> is used to create the mode.
+    </para>
+    <para>
+      <command>useradd</command> and <command>newusers</command> use this
+      to set the mode of the home directory they create.
+    </para>
+  </listitem>
+</varlistentry>

debian/Makefile

@@ -0,0 +1,16 @@
+PKG=shadow
+SITE=ftp://pkg-shadow.alioth.debian.org/pub/pkg-shadow/
+
+deb:: check_cheese
+
+include /usr/share/quilt/quilt.debbuild.mk
+
+check_cheese:
+	@dpkg-parsechangelog | grep -q "\* The \".*\".* release\." || { \
+		echo ""; \
+		echo " **                                  **"; \
+		echo " **  Warning: not a cheesy release!  **"; \
+		echo " **                                  **"; \
+		echo ""; \
+		exit 1; \
+	}

debian/NEWS

@@ -0,0 +1,62 @@
+shadow (1:4.13+dfsg1-2) unstable; urgency=medium
+
+  The previous entry falsely states that PREVENT_NO_AUTH in /etc/login.defs
+  affects authentication.  The historical default of letting all users with
+  empty password field in without authentication is still in effect.
+
+ -- Balint Reczey <balint@balintreczey.hu>  Mon, 25 Sep 2023 17:04:09 +0200
+
+shadow (1:4.11.1+dfsg1-0exp1) experimental; urgency=medium
+
+  Login now prevents an empty password field to be interpreted as
+  "no authentication required" for UID 0 (root account).
+  The historical default of letting all users with empty password field
+  in without authentication can be restored in /etc/login.defs setting
+  PREVENT_NO_AUTH to "no".
+
+ -- Balint Reczey <balint@balintreczey.hu>  Sun, 07 Nov 2021 21:51:46 +0100
+
+shadow (1:4.7-1) unstable; urgency=medium
+
+  * /etc/securetty is no longer shipped by this package and it is no longer
+    honored in login's PAM configuration by default. Please see #731656 for the
+    details.
+
+ -- Balint Reczey <rbalint@ubuntu.com>  Thu, 20 Jun 2019 13:46:52 +0200
+
+shadow (1:4.0.15-5) unstable; urgency=low
+
+  * commands passed in argument to su must use su's -c option and must quote
+    the command if it contains a space, as in:
+        su - root -c "ls -l /"
+    The following commands won't work anymore:
+        su - root -c ls -l /
+        su - root "ls -l /"
+        su - root ls -l /
+
+ -- Christian Perrier <bubulle@debian.org>  Sat,  8 Apr 2006 20:11:38 +0200
+
+shadow (1:4.0.14-1) unstable; urgency=low
+
+  * passwd does not support the -f, -s, and -g options anymore. You should use
+    the chfn, chsh and gpasswd utilities instead.
+  * login now distributes the nologin utility, which can be used as a shell
+    to politely refuse a login
+
+ -- Christian Perrier <bubulle@debian.org>  Thu,  5 Jan 2006 08:47:44 +0100
+
+shadow (1:4.0.12-1) unstable; urgency=low
+
+  CLOSE_SESSIONS and other variables are not used anymore in
+  /etc/login/defs.
+  As shadow utilities which use this file now warn about unknown
+  entries there, administrators should remove such unknown entries.
+  The supplied login.defs file does not include them anymore.
+
+  dpasswd is no more distributed by upstream. Login do not support
+  dialup password anymore.  Re-introducing this functionality in
+  upstream is not trivial.
+
+
+ -- Christian Perrier <bubulle@debian.org>  Thu, 25 Aug 2005 08:38:47 +0200
+

debian/README.debian

@@ -0,0 +1,62 @@
+Read this file first for a brief overview of the new versions of login
+and passwd.
+
+
+---Shadow passwords
+
+The command `shadowconfig on' will turn on shadow password support.
+`shadowconfig off' will turn it back off.  If you turn on shadow
+password support, you'll gain the ability to set password ages and
+expirations with chage(1).
+
+NOTE: If you use the nscd package, you may have problems with a
+slight delay in updating the password information. You may notice
+this during upgrades of certain packages that try to add a system
+user and then access the users information immediately afterwards.
+To avoid this, it is suggested that you stop the nscd daemon before
+upgrades, then restart it again.
+
+---General configuration
+
+Most of the configuration for the shadow utilities is in
+/etc/login.defs.  See login.defs(5).  The defaults are quite
+reasonable.
+
+Also see the /etc/pam.d/* files for each program to configure the PAM
+support. PAM documentation is available in several formats in the
+libpam-doc package.
+
+
+---MD5 Encryption
+
+This is enabled now using the /etc/pam.d/* files. Examples are given.
+
+
+---Adding users and groups
+
+Though you may add users and groups with the SysV type commands,
+useradd and groupadd, I recommend you add them with Debian adduser
+version 3+.  adduser gives you more configuration and conforms to the
+Debian UID and GID allocation.
+
+Editing user and group parameters can be done with usermod and
+groupmod.  Removing users and groups can be done with userdel and
+groupdel.
+
+
+--- Group administration
+
+Local group allocation is much easier.  With gpasswd(1) you can
+designate users to administer groups.  They can then securely add or
+remove users from the group.
+
+
+--- What to read next?
+
+Read the manpages, the other files in this directory, and the Shadow
+Password HOWTO (included in the doc-linux package).  A large portion
+of these files deals with getting shadow installed.  You can, of
+course, ignore those parts.
+
+Also, the libpam-doc package will go a long way to allowing you to take
+full advantage of the PAM authentication scheme.

debian/README.source

@@ -0,0 +1,8 @@
+If you update the translation of upsteam files (thank you for that!) please
+submit a pull request upstream instead of filing a bug in the Debian BTS
+to get it reviewed and accepted faster.
+
+A testsuite is also available. Instruction on how to run this testsuite
+are available in tests/README
+
+ -- Balint Reczey <balint@balintreczey.hu>, Mon, 31 Jan 2022 14:07:11 +0100

debian/TODO

@@ -0,0 +1,19 @@
+Things that should be done:
+ * Verify the files left in debian/tmp
+   + e.g. /etc/default/adduser should be installed
+ * Check the build system: rebuilding the package twoce in the same tree
+   doubles the size of the diff.gz file
+
+Other points (not related to the release of a syncronized shadow):
+ * compare the source with the usages and man pages
+   + probably add a sentence to chsh/chfn's manpages about authentication
+     required for ordinary users
+ * do something (a tool) for the variables in login.defs
+   In Debian, some tools are not compiled with the PAM support, so upstream
+   getdef.c won't be OK.
+   It should be nice to see in each man page the set of variables used.
+   The Debian package can now compile (export DEB_BUILD_OPTIONS='nostrip debug')
+   with the debugging informations. This may be used to extract the set of
+   variables used in Debian/for each tools.
+ * verify all the patches around (I've found patches for at least RedHat,
+   OWL, LFS, Mandriva, Gentoo; are they already applied?)

debian/bugs-usertags

@@ -0,0 +1,25 @@
+This described the usertags used by the team.
+
+For usertags documentation, see
+http://lists.debian.org/debian-devel-announce/2005/09/msg00002.html
+
+All bugs tagged by team members must be tagged with 
+"user pkg-shadow-devel@lists.alioth.debian.org"
+
+Tags list
+---------
+
+toclose:         This bug has been announced to be closed in case no more news
+                 or information is received from the bug submitter or someone
+                 else until the delay specified in the limits_YYYYMMDD tag
+
+limits-YYYYMMDD: combine it with "toclose". Specifies the date after which
+                 bugs can be closed without other action in case no news 
+                 is received
+
+manpages-replace A bug reported angainst a manpages-xx package to indicate
+                 conflicting man pages. This tag can be used to tune the
+                 Replaces fields.
+
+su-transition:   This bug is related to the su transition (#276419)
+

debian/control

@@ -0,0 +1,88 @@
+Source: shadow
+Maintainer: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
+Uploaders: Serge Hallyn <serge@hallyn.com>
+Section: admin
+Priority: required
+Build-Depends: debhelper-compat (= 13),
+               gettext,
+               libcrypt-dev,
+               libpam0g-dev,
+               quilt,
+               xsltproc <!nodoc>,
+               docbook-xsl <!nodoc>,
+               docbook-xml <!nodoc>,
+               libxml2-utils <!nodoc>,
+               libselinux1-dev [linux-any],
+               libsemanage-dev [linux-any],
+               itstool <!nodoc>,
+               bison,
+               libaudit-dev [linux-any]
+Standards-Version: 4.6.1
+Vcs-Git: https://salsa.debian.org/debian/shadow.git -b master
+Vcs-Browser: https://salsa.debian.org/debian/shadow
+Homepage: https://github.com/shadow-maint/shadow
+Rules-Requires-Root: binary-targets
+
+Package: passwd
+Architecture: any
+Multi-Arch: foreign
+Depends: ${shlibs:Depends},
+         ${misc:Depends},
+         libpam-modules
+Recommends: sensible-utils
+Description: change and administer password and group data
+ This package includes passwd, chsh, chfn, and many other programs to
+ maintain password and group data.
+ .
+ Shadow passwords are supported.  See /usr/share/doc/passwd/README.Debian
+
+Package: login
+Architecture: any
+Multi-Arch: foreign
+Essential: yes
+Pre-Depends: ${shlibs:Depends},
+             ${misc:Depends},
+             libpam-runtime,
+             libpam-modules
+Breaks: hurd (<< 20140206~) [hurd-any]
+Conflicts: python-4suite (<< 0.99cvs20060405-1)
+Replaces: hurd (<< 20140206~) [hurd-any]
+Description: system login tools
+ This package provides some required infrastructure for logins and for
+ changing effective user or group IDs, including:
+  * login, the program that invokes a user shell on a virtual terminal;
+  * nologin, a dummy shell for disabled user accounts;
+
+Package: uidmap
+Architecture: any
+Multi-Arch: foreign
+Priority: optional
+Depends: ${shlibs:Depends},
+         ${misc:Depends}
+Description: programs to help use subuids
+ These programs help unprivileged users to create uid and gid mappings in
+ user namespaces.
+
+Package: libsubid4
+Section: libs
+Priority: optional
+Architecture: any
+Multi-Arch: same
+Pre-Depends: ${misc:Pre-Depends}
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: subordinate id handling library -- shared library
+ The library provides an interface for querying, granding and ungranting
+ subordinate user and group ids.
+
+Package: libsubid-dev
+Section: libdevel
+Priority: optional
+Architecture: any
+Multi-Arch: same
+Depends: ${misc:Depends}, libsubid4 (= ${binary:Version})
+Description: subordinate id handling library -- shared library
+ The library provides an interface for querying, granding and ungranting
+ subordinate user and group ids.
+ .
+ This package contains the C header files that are
+ needed for applications to use the libsubid4 library.

debian/copyright

@@ -0,0 +1,221 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: Shadow
+Source: https://github.com/shadow-maint/shadow
+Note: atudel is licensed under BSD-4-Clause which is not DFSG compatible
+Files-Excluded: contrib/atudel
+
+Files: *
+Copyright: 1989-1994, Julianne Frances Haugh
+           2016-2022, Serge Hallyn <serge@hallyn.com>
+License: BSD-3-clause
+
+Files: man/po/da.po
+       man/po/de.po
+       man/tr/man1/su.1
+       po/da.po
+       po/de.po
+       po/es.po
+       po/eu.po
+       po/fi.po
+       po/gl.po
+       po/it.po
+       po/kk.po
+       po/nb.po
+       po/nl.po
+       po/nn.po
+       po/pl.po
+       po/pt_BR.po
+       po/ru.po
+       po/sq.po
+       po/sv.po
+       po/vi.po
+Copyright: 1999-2015, Free Software Foundation, Inc
+License: BSD-3-clause
+
+Files: man/fi/man1/chfn.1
+       man/id/man1/*
+       man/ko/man1/chfn.1
+       man/ko/man1/chsh.1
+       man/tr/man1/chfn.1
+       man/zh_TW/man1/chfn.1
+       man/zh_TW/man1/chsh.1
+Copyright: 1994, salvatore valente <svalente@athena.mit.edu>
+License: GPL-1
+
+Files: man/pt_BR/man8/*
+       man/zh_TW/man8/usermod.8
+Copyright: 1991-1994, Julianne Frances Haugh
+License: BSD-3-clause
+
+Files: man/hu/man1/gpasswd.1
+       man/ja/man1/gpasswd.1
+       man/pt_BR/man1/*
+Copyright: 1996, Rafal Maszkowski <rzm@pdi.net>
+License: BSD-3-clause
+
+Files: man/id/man1/login.1
+       man/ko/man1/login.1
+       man/tr/man1/login.1
+Copyright: 1993, Rickard E. Faith <faith@cs.unc.edu>
+License: BSD-3-clause
+
+Files: man/ja/man1/groups.1
+       man/ja/man5/limits.5
+       man/ja/man8/vipw.8
+Copyright: 2001, Maki KURODA
+License: BSD-3-clause
+
+Files: man/pt_BR/man5/passwd.5
+       man/tr/man5/passwd.5
+Copyright: 1993, Michael Haardt <michael@moria.de>
+License: GPL-2+
+
+Files: man/ja/man1/chage.1
+       man/ja/man5/suauth.5
+Copyright: 1997, Kazuyoshi Furutaka
+License: BSD-3-clause
+
+Files: man/po/fr.po
+       po/fr.po
+Copyright: 2011-2013, Debian French l10n team <debian-l10n-french@lists.debian.org>
+License: BSD-3-clause
+
+Files: man/zh_TW/man5/*
+Copyright: 1993, Michael Haardt <michael@moria.de>
+           1993, Scorpio, www.linuxforum.net
+License: GPL-2+
+
+Files: contrib/udbachk.tgz
+Copyright: 1999, Sami Kerola and Janne Riihijärvi
+License: GPL-2+
+
+Files: man/hu/man5/*
+Copyright: 1993, Michael Haardt <u31b3hs@pool.informatik.rwth-aachen.de>
+License: GPL-2+
+
+Files: contrib/adduser2.sh
+Copyright: 1996, Petri Mattila, Prihateam Networks <petri@prihateam.fi>
+License: GPL-2+
+
+Files: contrib/pwdauth.c
+Copyright: 1996, Marek Michalkiewicz
+License: BSD-3-clause
+
+Files: lib/subordinateio.h
+Copyright: 2012, Eric W. Biederman
+License: BSD-3-clause
+
+Files: libmisc/date_to_str.c
+Copyright: 2021, Alejandro Colomar <alx.manpages@gmail.com>
+License: BSD-3-clause
+
+Files: man/hu/man1/su.1
+Copyright: 1999, Ragnar Hojland Espinosa <ragnar@macula.net>
+License: BSD-3-clause
+
+Files: man/ja/man1/id.1
+Copyright: 2000, ISHIKAWA Keisuke
+License: BSD-3-clause
+
+Files: man/ja/man8/pwconv.8
+Copyright: 2001, Yuichi SATO
+License: BSD-3-clause
+
+Files: src/login_nopam.c
+Copyright: 1995, Wietse Venema
+License: BSD-3-clause
+
+Files: src/su.c
+Copyright: 1989 - 1994, Julianne Frances Haugh
+           1996 - 2000, Marek Michałkiewicz
+           2000 - 2006, Tomasz Kłoczko
+           2007 - 2013, Nicolas François
+License: GPL-2+
+
+Files: src/vipw.c
+Copyright: 1997, Guy Maor <maor@ece.utexas.edu>
+           1999 - 2000, Marek Michałkiewicz
+           2002 - 2006, Tomasz Kłoczko
+           2007 - 2013, Nicolas François
+License: GPL-2+
+
+Files: libmisc/getdate.y
+Copyright: Steven M. Bellovin <smb@research.att.com>
+License: public-domain
+ Originally written by Steven M. Bellovin <smb@research.att.com> while
+ at the University of North Carolina at Chapel Hill.  Later tweaked by
+ a couple of people on Usenet.  Completely overhauled by Rich $alz
+ <rsalz@bbn.com> and Jim Berets <jberets@bbn.com> in August, 1990;
+ .
+ This code is in the public domain and has no copyright.
+
+Files: man/ko/man5/*
+Copyright: 2000, ASPLINUX <man@asp-linux.co.kr>
+License: GPL-2+
+
+Files: debian/*
+Copyright: 1999-2001, Ben Collins <bcollins@debian.org>
+           2001-2004 Karl Ramm <kcr@debian.org>
+           2004-2014 Christian Perrier <bubulle@debian.org>
+           2006-2012 Nicolas Francois (Nekral) <nicolas.francois@centraliens.net>
+           2017-2022 Balint Reczey <balint@balintreczey.hu>
+License: BSD-3-clause
+
+Files: debian/HOME_MODE.xml
+Copyright: 1991-1993, Chip Rosenthal
+           1991-1993, Julianne Frances Haugh
+           2007-2009, Nicolas François
+License: BSD-3-clause
+
+Files: debian/patches/401_cppw_src.dpatch
+Copyright: 1997, Guy Maor <maor@ece.utexas.edu>
+           1999, Stephen Frost <sfrost@snowman.net>
+License: GPL-2+
+
+Files: debian/passwd.expire.cron
+Copyright: 1999, Ben Collins <bcollins@debian.org>
+License: BSD-3-clause
+
+License: BSD-3-clause
+ All rights reserved.
+ .
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+ 1. Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+ 2. Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
+ 3. Neither the name of the University nor the names of its contributors
+    may be used to endorse or promote products derived from this software
+    without specific prior written permission.
+ .
+ THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ SUCH DAMAGE.
+
+License: GPL-1
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 1
+ .
+ On Debian systems, the complete text of version 1 of the GNU General
+ Public License can be found in '/usr/share/common-licenses/GPL-1'.
+
+License: GPL-2+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 2 dated June, 1991, or (at
+ your option) any later version.
+ .
+ On Debian systems, the complete text of version 2 of the GNU General
+ Public License can be found in '/usr/share/common-licenses/GPL-2'.

debian/cpgr.8

@@ -0,0 +1 @@
+.so man8/cppw.8

debian/cppw.8

@@ -0,0 +1,27 @@
+.TH CPPW 8 "7 Apr 2005"
+.SH NAME
+cppw, cpgr \- copy with locking the given file to the password or group file
+.SH SYNOPSIS
+\fBcppw\fR [\fB\-h\fR] [\fB\-s\fR] password_file
+.br
+\fBcpgr\fR [\fB\-h\fR] [\fB\-s\fR] group_file
+
+.SH DESCRIPTION
+.BR cppw " and " cpgr
+will copy, with locking, the given file to
+.IR /etc/passwd " and " /etc/group ", respectively."
+With the \fB\-s\fR flag, they will copy the shadow versions of those files,
+.IR /etc/shadow " and " /etc/gshadow ", respectively."
+
+With the \fB\-h\fR flag, the commands display a short help message and exit
+silently.
+.SH "SEE ALSO"
+.BR vipw (8),
+.BR vigr (8),
+.BR group (5),
+.BR passwd (5),
+.BR shadow (5),
+.BR gshadow (5)
+.SH AUTHOR
+\fBcppw\fR and \fBcpgr\fR were written by Stephen Frost, based on
+\fBvipw\fR and \fBvigr\fR written by Guy Maor.

debian/default/useradd

@@ -0,0 +1,37 @@
+# Default values for useradd(8)
+#
+# The SHELL variable specifies the default login shell on your
+# system.
+# Similar to DSHELL in adduser. However, we use "sh" here because
+# useradd is a low level utility and should be as general
+# as possible
+SHELL=/bin/sh
+#
+# The default group for users
+# 100=users on Debian systems
+# Same as USERS_GID in adduser
+# This argument is used when the -n flag is specified.
+# The default behavior (when -n and -g are not specified) is to create a
+# primary user group with the same name as the user being added to the
+# system.
+# GROUP=100
+#
+# The default home directory. Same as DHOME for adduser
+# HOME=/home
+#
+# The number of days after a password expires until the account 
+# is permanently disabled
+# INACTIVE=-1
+#
+# The default expire date
+# EXPIRE=
+#
+# The SKEL variable specifies the directory containing "skeletal" user
+# files; in other words, files such as a sample .profile that will be
+# copied to the new user's home directory when it is created.
+# SKEL=/etc/skel
+#
+# Defines whether the mail spool should be created while
+# creating the account
+# CREATE_MAIL_SPOOL=no
+

debian/dependencies

@@ -0,0 +1,94 @@
+Build-Depends:
+==============
+ * autoconf
+ * automake1.9
+   works with 1.7 or 1.9 (at least)
+ * libtool
+ * gettext
+   POT, PO, GMO regenerated?
+ * libpam0g-dev
+   OK
+ * debhelper (>= 4.1.16)
+ * po-debconf
+   OK
+ * quilt
+   patch system
+ * dpkg-dev (>= 1.13.5)
+ * xsltproc
+   used to generate the manpages
+ * docbook-xsl
+   needed for /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl
+ * docbook-xml
+   manpages/docbook.xsl includes html/docbook.xsl
+   (But it is not strictly needed. The generated manpages are identical.
+   Without it, a warning is generated.)
+   Needed by JH_CHECK_XML_CATALOG([-//OASIS//DTD DocBook XML V4.1.2//EN], [DocBook XML DTD V4.1.2], [], enable_man=no)
+ * libxml2-utils
+   needed by the JH_CHECK_XML_CATALOG macros
+ * cdbs
+   used in debian/rules
+ * libselinux1-dev [!hurd-i386 !kfreebsd-i386 !kfreebsd-amd64]
+ * gnome-doc-utils (>= 0.4.3-1)
+   xml2po, 0.4.3-1 needed for the -l switch.
+
+passwd Depends:
+===============
+ * ${shlibs:Depends}
+   OK
+ * ${loginpam}
+   - hurd
+     login
+     libpam-modules (>= 0.72-5)
+   - other archs
+     + login (>= 970502-1)
+       login is needed because some passwd utils need /etc/login.defs
+       login is Essential, so this is just to enforce the version
+     + libpam-modules (>= 0.72-5)
+ * debianutils (>= 2.15.2)
+   After 1:4.0.12-6, {add,remove}-shell are distributed in debianutils (2.15)
+   /etc/shell was forgotten and introduced in debianutils in 2.15.2
+
+passwd Conflicts:
+=================
+
+passwd Replaces:
+================
+   Some of the passwd man pages are also distributed in some manpages* packages.
+   Look at the debian/02/run test to optimize these dependencies.
+   NOTE: Not all maintainers have been notified.
+ * manpages-de (<< 0.4-9), manpages-fi (<< 0.2-4), manpages-fr (<<1.64.0-1), manpages-hu (<< 20010119-5), manpages-it (<< 0.3.4-3), manpages-ja (<< 0.5.0.0.20050915-1), manpages-ko (<< 20050219-2), manpages-es (<< 1.55-4), manpages-es-extra (<< 0.8a-15), manpages-ru (<< 0.98-3)
+   All those packages have been updated during sarge->etch. So these Replaces
+   should be removed after lenny release
+ * manpages-tr, manpages-zh
+   Those packages are still in etch, so the Replaces should be kept even
+   after lenny release
+
+login Pre-Depends:
+==================
+ * ${shlibs:Depends}
+ * libpam-runtime (>= 0.76-14)
+   sarge contained 0.76-22
+
+Why Pre-Depends? (because it's an essential package?)
+
+login Depends:
+==============
+ * libpam-modules (>= 0.72-5)
+   libpam-modules is needed.
+   potato contained 0.72-9
+
+login Conflicts:
+================
+
+login Replaces:
+===============
+ * Some of the login man pages are also distributed in some manpages* packages.
+   Look at the debian/02/run test to optimize these dependencies.
+   NOTE: Not all maintainers have been notified.
+   - manpages-fi, manpages-fr (<<1.64.0-1), manpages-hu, manpages-it, manpages-ko, manpages-ja (<< 0.5.0.0.20050915-1), manpages-de (<< 0.4-10), manpages-es-extra (<<0.8a-15) 
+     Those are packages that have been updated during sarge->etch. These
+     Replaces should be removed after lenny
+   - manpages-tr, manpages-zh
+     Those packages are still in etch, so the Replaces should be kept even
+     after lenny release
+

debian/gitlab-ci.yml

@@ -0,0 +1,7 @@
+variables:
+  RELEASE: 'unstable'
+  # workaround for https://salsa.debian.org/salsa-ci-team/pipeline/-/issues/259
+  SALSA_CI_REPROTEST_ARGS: --vary=domain_host.use_sudo=1
+include:
+ - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml
+ - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml

debian/libsubid-dev.install

@@ -0,0 +1,3 @@
+usr/include/*
+usr/lib/*/libsubid.a
+usr/lib/*/libsubid.so

debian/libsubid4.install

@@ -0,0 +1 @@
+usr/lib/*/libsubid.so.*

debian/libsubid4.symbols

@@ -0,0 +1,10 @@
+libsubid.so.4 libsubid4 #MINVER#
+ subid_get_gid_owners@Base 1:4.11.1
+ subid_get_gid_ranges@Base 1:4.11.1
+ subid_get_uid_owners@Base 1:4.11.1
+ subid_get_uid_ranges@Base 1:4.11.1
+ subid_grant_gid_range@Base 1:4.11.1
+ subid_grant_uid_range@Base 1:4.11.1
+ subid_init@Base 1:4.11.1
+ subid_ungrant_gid_range@Base 1:4.11.1
+ subid_ungrant_uid_range@Base 1:4.11.1

debian/login.defs

@@ -0,0 +1,394 @@
+#
+# /etc/login.defs - Configuration control definitions for the login package.
+#
+# Three items must be defined:  MAIL_DIR, ENV_SUPATH, and ENV_PATH.
+# If unspecified, some arbitrary (and possibly incorrect) value will
+# be assumed.  All other items are optional - if not specified then
+# the described action or option will be inhibited.
+#
+# Comment lines (lines beginning with "#") and blank lines are ignored.
+#
+# Modified for Linux.  --marekm
+
+# REQUIRED for useradd/userdel/usermod
+#   Directory where mailboxes reside, _or_ name of file, relative to the
+#   home directory.  If you _do_ define MAIL_DIR and MAIL_FILE,
+#   MAIL_DIR takes precedence.
+#
+#   Essentially:
+#      - MAIL_DIR defines the location of users mail spool files
+#        (for mbox use) by appending the username to MAIL_DIR as defined
+#        below.
+#      - MAIL_FILE defines the location of the users mail spool files as the
+#        fully-qualified filename obtained by prepending the user home
+#        directory before $MAIL_FILE
+#
+# NOTE: This is no more used for setting up users MAIL environment variable
+#       which is, starting from shadow 4.0.12-1 in Debian, entirely the
+#       job of the pam_mail PAM modules
+#       See default PAM configuration files provided for
+#       login, su, etc.
+#
+# This is a temporary situation: setting these variables will soon
+# move to /etc/default/useradd and the variables will then be
+# no more supported
+MAIL_DIR        /var/mail
+#MAIL_FILE      .mail
+
+#
+# Enable logging and display of /var/log/faillog login failure info.
+# This option conflicts with the pam_tally PAM module.
+#
+FAILLOG_ENAB		yes
+
+#
+# Enable display of unknown usernames when login failures are recorded.
+#
+# WARNING: Unknown usernames may become world readable. 
+# See #290803 and #298773 for details about how this could become a security
+# concern
+LOG_UNKFAIL_ENAB	no
+
+#
+# Enable logging of successful logins
+#
+LOG_OK_LOGINS		no
+
+#
+# Enable "syslog" logging of su activity - in addition to sulog file logging.
+# SYSLOG_SG_ENAB does the same for newgrp and sg.
+#
+SYSLOG_SU_ENAB		yes
+SYSLOG_SG_ENAB		yes
+
+#
+# If defined, all su activity is logged to this file.
+#
+#SULOG_FILE	/var/log/sulog
+
+#
+# If defined, file which maps tty line to TERM environment parameter.
+# Each line of the file is in a format something like "vt100  tty01".
+#
+#TTYTYPE_FILE	/etc/ttytype
+
+#
+# If defined, login failures will be logged here in a utmp format
+# last, when invoked as lastb, will read /var/log/btmp, so...
+#
+FTMP_FILE	/var/log/btmp
+
+#
+# If defined, the command name to display when running "su -".  For
+# example, if this is defined as "su" then a "ps" will display the
+# command is "-su".  If not defined, then "ps" would display the
+# name of the shell actually being run, e.g. something like "-sh".
+#
+SU_NAME		su
+
+#
+# If defined, file which inhibits all the usual chatter during the login
+# sequence.  If a full pathname, then hushed mode will be enabled if the
+# user's name or shell are found in the file.  If not a full pathname, then
+# hushed mode will be enabled if the file exists in the user's home directory.
+#
+HUSHLOGIN_FILE	.hushlogin
+#HUSHLOGIN_FILE	/etc/hushlogins
+
+#
+# *REQUIRED*  The default PATH settings, for superuser and normal users.
+#
+# (they are minimal, add the rest in the shell startup files)
+ENV_SUPATH	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ENV_PATH	PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
+
+#
+# Terminal permissions
+#
+#	TTYGROUP	Login tty will be assigned this group ownership.
+#	TTYPERM		Login tty will be set to this permission.
+#
+# If you have a "write" program which is "setgid" to a special group
+# which owns the terminals, define TTYGROUP to the group number and
+# TTYPERM to 0620.  Otherwise leave TTYGROUP commented out and assign
+# TTYPERM to either 622 or 600.
+#
+# In Debian /usr/bin/bsd-write or similar programs are setgid tty
+# However, the default and recommended value for TTYPERM is still 0600
+# to not allow anyone to write to anyone else console or terminal
+
+# Users can still allow other people to write them by issuing 
+# the "mesg y" command.
+
+TTYGROUP	tty
+TTYPERM		0600
+
+#
+# Login configuration initializations:
+#
+#	ERASECHAR	Terminal ERASE character ('\010' = backspace).
+#	KILLCHAR	Terminal KILL character ('\025' = CTRL/U).
+#	UMASK		Default "umask" value.
+#
+# The ERASECHAR and KILLCHAR are used only on System V machines.
+# 
+# UMASK is the default umask value for pam_umask and is used by
+# useradd and newusers to set the mode of the new home directories.
+# 022 is the "historical" value in Debian for UMASK
+# 027, or even 077, could be considered better for privacy
+# There is no One True Answer here : each sysadmin must make up his/her
+# mind.
+#
+# If USERGROUPS_ENAB is set to "yes", that will modify this UMASK default value
+# for private user groups, i. e. the uid is the same as gid, and username is
+# the same as the primary group name: for these, the user permissions will be
+# used as group permissions, e. g. 022 will become 002.
+#
+# Prefix these values with "0" to get octal, "0x" to get hexadecimal.
+#
+ERASECHAR	0177
+KILLCHAR	025
+UMASK		022
+
+# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
+# home directories.
+# If HOME_MODE is not set, the value of UMASK is used to create the mode.
+#HOME_MODE	0700
+
+#
+# Password aging controls:
+#
+#	PASS_MAX_DAYS	Maximum number of days a password may be used.
+#	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
+#	PASS_WARN_AGE	Number of days warning given before a password expires.
+#
+PASS_MAX_DAYS	99999
+PASS_MIN_DAYS	0
+PASS_WARN_AGE	7
+
+#
+# Min/max values for automatic uid selection in useradd
+#
+UID_MIN			 1000
+UID_MAX			60000
+# System accounts
+#SYS_UID_MIN		  100
+#SYS_UID_MAX		  999
+# Extra per user uids
+SUB_UID_MIN		   100000
+SUB_UID_MAX		600100000
+SUB_UID_COUNT		    65536
+
+#
+# Min/max values for automatic gid selection in groupadd
+#
+GID_MIN			 1000
+GID_MAX			60000
+# System accounts
+#SYS_GID_MIN		  100
+#SYS_GID_MAX		  999
+# Extra per user group ids
+SUB_GID_MIN		   100000
+SUB_GID_MAX		600100000
+SUB_GID_COUNT		    65536
+
+#
+# Max number of login retries if password is bad. This will most likely be
+# overriden by PAM, since the default pam_unix module has it's own built
+# in of 3 retries. However, this is a safe fallback in case you are using
+# an authentication module that does not enforce PAM_MAXTRIES.
+#
+LOGIN_RETRIES		5
+
+#
+# Max time in seconds for login
+#
+LOGIN_TIMEOUT		60
+
+#
+# Which fields may be changed by regular users using chfn - use
+# any combination of letters "frwh" (full name, room number, work
+# phone, home phone).  If not defined, no changes are allowed.
+# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
+# 
+CHFN_RESTRICT		rwh
+
+#
+# Should login be allowed if we can't cd to the home directory?
+# Default is no.
+#
+DEFAULT_HOME	yes
+
+#
+# If defined, this command is run when removing a user.
+# It should remove any at/cron/print jobs etc. owned by
+# the user to be removed (passed as the first argument).
+#
+#USERDEL_CMD	/usr/sbin/userdel_local
+
+#
+# If set to yes, userdel will remove the user's group if it contains no
+# more members, and useradd will create by default a group with the name
+# of the user.
+#
+# Other former uses of this variable such as setting the umask when
+# user==primary group are not used in PAM environments, such as Debian
+#
+USERGROUPS_ENAB yes
+
+#
+# Instead of the real user shell, the program specified by this parameter
+# will be launched, although its visible name (argv[0]) will be the shell's.
+# The program may do whatever it wants (logging, additional authentification,
+# banner, ...) before running the actual shell.
+#
+# FAKE_SHELL /bin/fakeshell
+
+#
+# If defined, either full pathname of a file containing device names or
+# a ":" delimited list of device names.  Root logins will be allowed only
+# upon these devices.
+#
+# This variable is used by login and su.
+#
+#CONSOLE	/etc/consoles
+#CONSOLE	console:tty01:tty02:tty03:tty04
+
+#
+# List of groups to add to the user's supplementary group set
+# when logging in on the console (as determined by the CONSOLE
+# setting).  Default is none.
+#
+# Use with caution - it is possible for users to gain permanent
+# access to these groups, even when not logged in on the console.
+# How to do it is left as an exercise for the reader...
+#
+# This variable is used by login and su.
+#
+#CONSOLE_GROUPS		floppy:audio:cdrom
+
+#
+# If set to "yes", new passwords will be encrypted using the MD5-based
+# algorithm compatible with the one used by recent releases of FreeBSD.
+# It supports passwords of unlimited length and longer salt strings.
+# Set to "no" if you need to copy encrypted passwords to other systems
+# which don't understand the new algorithm.  Default is "no".
+#
+# This variable is deprecated. You should use ENCRYPT_METHOD.
+#
+#MD5_CRYPT_ENAB	no
+
+#
+# If set to MD5, MD5-based algorithm will be used for encrypting password
+# If set to SHA256, SHA256-based algorithm will be used for encrypting password
+# If set to SHA512, SHA512-based algorithm will be used for encrypting password
+# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
+# If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password
+# If set to DES, DES-based algorithm will be used for encrypting password (default)
+# MD5 and DES should not be used for new hashes, see crypt(5) for recommendations.
+# Overrides the MD5_CRYPT_ENAB option
+#
+# Note: It is recommended to use a value consistent with
+# the PAM modules configuration.
+#
+ENCRYPT_METHOD SHA512
+
+#
+# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
+#
+# Define the number of SHA rounds.
+# With a lot of rounds, it is more difficult to brute-force the password.
+# However, more CPU resources will be needed to authenticate users if
+# this value is increased.
+#
+# If not specified, the libc will choose the default number of rounds (5000),
+# which is orders of magnitude too low for modern hardware.
+# The values must be within the 1000-999999999 range.
+# If only one of the MIN or MAX values is set, then this value will be used.
+# If MIN > MAX, the highest value will be used.
+#
+#SHA_CRYPT_MIN_ROUNDS 5000
+#SHA_CRYPT_MAX_ROUNDS 5000
+
+#
+# Only works if ENCRYPT_METHOD is set to YESCRYPT.
+#
+# Define the YESCRYPT cost factor.
+# With a higher cost factor, it is more difficult to brute-force the password.
+# However, more CPU time and more memory will be needed to authenticate users
+# if this value is increased.
+#
+# If not specified, a cost factor of 5 will be used.
+# The value must be within the 1-11 range.
+#
+#YESCRYPT_COST_FACTOR 5
+
+#
+# The pwck(8) utility emits a warning for any system account with a home
+# directory that does not exist.  Some system accounts intentionally do
+# not have a home directory.  Such accounts may have this string as
+# their home directory in /etc/passwd to avoid a spurious warning.
+#
+NONEXISTENT	/nonexistent
+
+#
+# Allow newuidmap and newgidmap when running under an alternative
+# primary group.
+#
+#GRANT_AUX_GROUP_SUBIDS yes
+
+#
+# Select the HMAC cryptography algorithm.
+# Used in pam_timestamp module to calculate the keyed-hash message
+# authentication code.
+#
+# Note: It is recommended to check hmac(3) to see the possible algorithms
+# that are available in your system.
+#
+#HMAC_CRYPTO_ALGO SHA512
+
+################# OBSOLETED BY PAM ##############
+#						#
+# These options are now handled by PAM. Please	#
+# edit the appropriate file in /etc/pam.d/ to	#
+# enable the equivelants of them.
+#
+###############
+
+#MOTD_FILE
+#DIALUPS_CHECK_ENAB
+#LASTLOG_ENAB
+#MAIL_CHECK_ENAB
+#OBSCURE_CHECKS_ENAB
+#PORTTIME_CHECKS_ENAB
+#SU_WHEEL_ONLY
+#CRACKLIB_DICTPATH
+#PASS_CHANGE_TRIES
+#PASS_ALWAYS_WARN
+#ENVIRON_FILE
+#NOLOGINS_FILE
+#ISSUE_FILE
+#PASS_MIN_LEN
+#PASS_MAX_LEN
+#ULIMIT
+#ENV_HZ
+#CHFN_AUTH
+#CHSH_AUTH
+#FAIL_DELAY
+
+################# OBSOLETED #######################
+#						  #
+# These options are no more handled by shadow.    #
+#                                                 #
+# Shadow utilities will display a warning if they #
+# still appear.                                   #
+#                                                 #
+###################################################
+
+# CLOSE_SESSIONS
+# LOGIN_STRING
+# NO_PASSWORD_CONSOLE
+# QMAIL_DIR
+
+
+

debian/login.dirs

@@ -0,0 +1 @@
+usr/share/lintian/overrides

debian/login.install

@@ -0,0 +1,7 @@
+debian/login.defs etc
+usr/share/locale/*/LC_MESSAGES/shadow.mo
+sbin/nologin usr/sbin
+usr/bin/faillog
+usr/bin/lastlog
+usr/bin/newgrp
+bin/login usr/bin

debian/login.links

@@ -0,0 +1 @@
+usr/bin/newgrp usr/bin/sg

debian/login.lintian-overrides

@@ -0,0 +1 @@
+login: elevated-privileges 4755 root/root [usr/bin/newgrp]

debian/login.maintscript

@@ -0,0 +1 @@
+rm_conffile /etc/securetty 1:4.7-1~

debian/login.manpages

@@ -0,0 +1,16 @@
+usr/share/man/*/man1/login.1
+usr/share/man/*/man1/newgrp.1
+usr/share/man/*/man1/sg.1
+usr/share/man/*/man5/faillog.5
+usr/share/man/*/man5/login.defs.5
+usr/share/man/*/man8/faillog.8
+usr/share/man/*/man8/lastlog.8
+usr/share/man/*/man8/nologin.8
+usr/share/man/man1/login.1
+usr/share/man/man1/newgrp.1
+usr/share/man/man1/sg.1
+usr/share/man/man5/faillog.5
+usr/share/man/man5/login.defs.5
+usr/share/man/man8/faillog.8
+usr/share/man/man8/lastlog.8
+usr/share/man/man8/nologin.8

debian/login.pam

@@ -0,0 +1,100 @@
+#
+# The PAM configuration file for the Shadow `login' service
+#
+
+# Enforce a minimal delay in case of failure (in microseconds).
+# (Replaces the `FAIL_DELAY' setting from login.defs)
+# Note that other modules may require another minimal delay. (for example,
+# to disable any delay, you should add the nodelay option to pam_unix)
+auth       optional   pam_faildelay.so  delay=3000000
+
+# Outputs an issue file prior to each login prompt (Replaces the
+# ISSUE_FILE option from login.defs). Uncomment for use
+# auth       required   pam_issue.so issue=/etc/issue
+
+# Disallows other than root logins when /etc/nologin exists
+# (Replaces the `NOLOGINS_FILE' option from login.defs)
+auth       requisite  pam_nologin.so
+
+# SELinux needs to be the first session rule. This ensures that any
+# lingering context has been cleared. Without this it is possible
+# that a module could execute code in the wrong domain.
+# When the module is present, "required" would be sufficient (When SELinux
+# is disabled, this returns success.)
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
+
+# Sets the loginuid process attribute
+session    required     pam_loginuid.so
+
+# Prints the message of the day upon successful login.
+# (Replaces the `MOTD_FILE' option in login.defs)
+# This includes a dynamically generated part from /run/motd.dynamic
+# and a static (admin-editable) part from /etc/motd.
+session    optional   pam_motd.so motd=/run/motd.dynamic
+session    optional   pam_motd.so noupdate
+
+# SELinux needs to intervene at login time to ensure that the process
+# starts in the proper default security context. Only sessions which are
+# intended to run in the user's context should be run after this.
+# pam_selinux.so changes the SELinux context of the used TTY and configures
+# SELinux in order to transition to the user context with the next execve()
+# call.
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
+# When the module is present, "required" would be sufficient (When SELinux
+# is disabled, this returns success.)
+
+# This module parses environment configuration file(s)
+# and also allows you to use an extended config
+# file /etc/security/pam_env.conf.
+# 
+# parsing /etc/environment needs "readenv=1"
+session       required   pam_env.so readenv=1
+# locale variables can also be set in /etc/default/locale
+# reading this file *in addition to /etc/environment* does not hurt
+session       required   pam_env.so readenv=1 envfile=/etc/default/locale
+
+# Standard Un*x authentication.
+@include common-auth
+
+# This allows certain extra groups to be granted to a user
+# based on things like time of day, tty, service, and user.
+# Please edit /etc/security/group.conf to fit your needs
+# (Replaces the `CONSOLE_GROUPS' option in login.defs)
+auth       optional   pam_group.so
+
+# Uncomment and edit /etc/security/time.conf if you need to set
+# time restraint on logins.
+# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
+# as well as /etc/porttime)
+# account    requisite  pam_time.so
+
+# Uncomment and edit /etc/security/access.conf if you need to
+# set access limits.
+# (Replaces /etc/login.access file)
+# account  required       pam_access.so
+
+# Sets up user limits according to /etc/security/limits.conf
+# (Replaces the use of /etc/limits in old login)
+session    required   pam_limits.so
+
+# Prints the last login info upon successful login
+# (Replaces the `LASTLOG_ENAB' option from login.defs)
+session    optional   pam_lastlog.so
+
+# Prints the status of the user's mailbox upon successful login
+# (Replaces the `MAIL_CHECK_ENAB' option from login.defs). 
+#
+# This also defines the MAIL environment variable
+# However, userdel also needs MAIL_DIR and MAIL_FILE variables
+# in /etc/login.defs to make sure that removing a user 
+# also removes the user's mail spool file.
+# See comments in /etc/login.defs
+session    optional   pam_mail.so standard
+
+# Create a new session keyring.
+session    optional   pam_keyinit.so force revoke
+
+# Standard Un*x account and session
+@include common-account
+@include common-session
+@include common-password

debian/login.postinst

@@ -0,0 +1,30 @@
+#!/bin/sh
+
+set -e
+
+
+if [ "$1" = "configure" ]; then
+	# Install faillog during initial installs only
+	if [ "$2" = "" ] && [ ! -f "$DPKG_ROOT/var/log/faillog" ] ; then
+		touch "$DPKG_ROOT/var/log/faillog"
+		chown 0:0 "$DPKG_ROOT/var/log/faillog"
+		chmod 644 "$DPKG_ROOT/var/log/faillog"
+	fi
+
+	# Create subuid/subgid if missing
+	if [ ! -e "$DPKG_ROOT/etc/subuid" ]; then
+		touch "$DPKG_ROOT/etc/subuid"
+		chown 0:0 "$DPKG_ROOT/etc/subuid"
+		chmod 644 "$DPKG_ROOT/etc/subuid"
+	fi
+
+	if [ ! -e "$DPKG_ROOT/etc/subgid" ]; then
+		touch "$DPKG_ROOT/etc/subgid"
+		chown 0:0 "$DPKG_ROOT/etc/subgid"
+		chmod 644 "$DPKG_ROOT/etc/subgid"
+	fi
+fi
+
+#DEBHELPER#
+
+exit 0

debian/not-installed

@@ -0,0 +1,36 @@
+bin/groups
+etc/default/useradd
+etc/login.defs
+etc/pam.d/chfn
+etc/pam.d/chage
+etc/pam.d/chpasswd
+etc/pam.d/chsh
+etc/pam.d/groupadd
+etc/pam.d/groupdel
+etc/pam.d/groupmems
+etc/pam.d/groupmod
+etc/pam.d/login
+etc/pam.d/newusers
+etc/pam.d/passwd
+etc/pam.d/useradd
+etc/pam.d/userdel
+etc/pam.d/usermod
+usr/bin/sg
+usr/lib/*/libsubid.la
+usr/sbin/logoutd
+usr/sbin/vigr
+usr/share/man/*/man1/groups.1
+usr/share/man/*/man1/logoutd.1
+usr/share/man/*/man1/su.1
+usr/share/man/*/man3/getspnam.3
+usr/share/man/*/man3/shadow.3
+usr/share/man/*/man5/suauth.5
+usr/share/man/*/man8/logoutd.8
+usr/share/man/man1/groups.1
+usr/share/man/man1/logoutd.1
+usr/share/man/man1/su.1
+usr/share/man/man3/getspnam.3
+usr/share/man/man3/shadow.3
+usr/share/man/man5/suauth.5
+usr/share/man/man8/logoutd.8
+

debian/passwd.chage.pam

@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'chage' service
+#
+
+# This allows root to change password aging being prompted for a password
+auth		sufficient	pam_rootok.so
+
+# checks for account validity
+account	required	pam_permit.so

debian/passwd.chfn.pam

@@ -0,0 +1,16 @@
+#
+# The PAM configuration file for the Shadow `chfn' service
+#
+
+# This allows root to change user infomation without being
+# prompted for a password
+auth		sufficient	pam_rootok.so
+
+# The standard Unix authentication modules, used with
+# NIS (man nsswitch) as well as normal /etc/passwd and
+# /etc/shadow entries.
+@include common-auth
+@include common-account
+@include common-session
+
+

debian/passwd.dirs

@@ -0,0 +1,2 @@
+usr/share/lintian/overrides
+etc/default

debian/passwd.examples

@@ -0,0 +1 @@
+debian/passwd.expire.cron

debian/passwd.expire.cron

@@ -0,0 +1,57 @@
+#!/usr/bin/perl
+#
+# passwd.expire.cron: sample expiry notification script for use as a cronjob
+#
+# Copyright 1999 by Ben Collins <bcollins@debian.org>, complete rights granted
+# for use, distribution, modification, etc.
+#
+# Usage:
+#	edit the listed options, including the actual email, then rename to
+#	/etc/cron.daily/passwd
+#
+#	If your users don't have a valid login shell (ie. they are ftp or mail
+#	users only), they will need some other way to change their password
+#	(telnet will work since login will handle password aging, or a poppasswd
+#	program, if they are mail users).
+
+# <CONFIG> #
+
+# should be same as /etc/adduser.conf
+$LOW_UID=1000;
+$HIGH_UID=29999;
+
+# this let's the MTA handle the domain,
+# set it manually if you want. Make sure
+# you also add the @ like "\@domain.com"
+$MAIL_DOM="";
+
+# </CONFIG> #
+
+# Set the current day reference
+$curdays = int(time() / (60 * 60 * 24));
+
+# Now go through the list
+
+open(SH, "< /etc/shadow");
+while (<SH>) {
+    @shent = split(':', $_);
+    @userent = getpwnam($shent[0]);
+    if ($userent[2] >= $LOW_UID && $userent[2] <= $HIGH_UID) {
+	if ($curdays > $shent[2] + $shent[4] - $shent[5] &&
+		$shent[4] != -1 && $shent[4] != 0 &&
+		$shent[5] != -1 && $shent[5] != 0) {
+	    $daysleft = ($shent[2] + $shent[4]) - $curdays;
+	    if ($daysleft == 1) { $days = "day"; } else {$days = "days"; }
+            if ($daysleft < 0) { next; }
+	    open (MAIL, "| mail -s '[WARNING] account will expire in $daysleft $days' $shent[0]${MAIL_DOM}");
+	    print MAIL <<EOF;
+Your account will expire in $daysleft $days. Please change your password before
+then or your account will expire
+EOF
+	    close (MAIL);
+	    # This makes sure we also get a list of almost expired users
+	    print "$shent[0]'s account will expire in $daysleft days\n";
+	}
+    }
+    @userent = getpwent();
+}

debian/passwd.groupadd.pam

@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'groupadd' service
+#
+
+# This allows root to add groups without being prompted for a password
+auth		sufficient	pam_rootok.so
+
+# checks for account validity
+account	required	pam_permit.so

debian/passwd.groupdel.pam

@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'groupdel' service
+#
+
+# This allows root to remove groups without being prompted for a password
+auth		sufficient	pam_rootok.so
+
+# checks for account validity
+account	required	pam_permit.so

debian/passwd.groupmod.pam

@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'groupmod' service
+#
+
+# This allows root to modify groups without being prompted for a password
+auth		sufficient	pam_rootok.so
+
+# checks for account validity
+account	required	pam_permit.so

debian/passwd.install

@@ -0,0 +1,26 @@
+debian/default/useradd etc/default
+debian/shadowconfig usr/sbin
+usr/bin/chage
+usr/bin/chfn
+usr/bin/chsh
+usr/bin/expiry
+usr/bin/gpasswd
+usr/bin/passwd
+usr/sbin/chpasswd
+usr/sbin/chgpasswd
+usr/sbin/cppw
+usr/sbin/groupadd
+usr/sbin/groupdel
+usr/sbin/groupmod
+usr/sbin/groupmems
+usr/sbin/grpck
+usr/sbin/grpconv
+usr/sbin/grpunconv
+usr/sbin/newusers
+usr/sbin/pwck
+usr/sbin/pwconv
+usr/sbin/pwunconv
+usr/sbin/useradd
+usr/sbin/userdel
+usr/sbin/usermod
+usr/sbin/vipw

debian/passwd.links

@@ -0,0 +1,2 @@
+usr/sbin/vipw usr/sbin/vigr
+usr/sbin/cppw usr/sbin/cpgr

debian/passwd.lintian-overrides

@@ -0,0 +1,6 @@
+passwd: elevated-privileges 2755 root/shadow [usr/bin/chage]
+passwd: elevated-privileges 4755 root/root [usr/bin/chfn]
+passwd: elevated-privileges 4755 root/root [usr/bin/chsh]
+passwd: elevated-privileges 2755 root/shadow [usr/bin/expiry]
+passwd: elevated-privileges 4755 root/root [usr/bin/gpasswd]
+passwd: elevated-privileges 4755 root/root [usr/bin/passwd]

debian/passwd.maintscript

@@ -0,0 +1 @@
+rm_conffile /etc/cron.daily/passwd 1:4.7-2~

debian/passwd.manpages

@@ -0,0 +1,60 @@
+debian/cpgr.8
+debian/cppw.8
+usr/share/man/*/man1/chage.1
+usr/share/man/*/man1/chfn.1
+usr/share/man/*/man1/chsh.1
+usr/share/man/*/man1/expiry.1
+usr/share/man/*/man1/gpasswd.1
+usr/share/man/*/man1/passwd.1
+usr/share/man/*/man5/passwd.5
+usr/share/man/*/man5/subgid.5
+usr/share/man/*/man5/subuid.5
+usr/share/man/*/man5/shadow.5
+usr/share/man/*/man5/gshadow.5
+usr/share/man/*/man8/chpasswd.8
+usr/share/man/*/man8/chgpasswd.8
+usr/share/man/*/man8/groupadd.8
+usr/share/man/*/man8/groupdel.8
+usr/share/man/*/man8/groupmod.8
+usr/share/man/*/man8/groupmems.8
+usr/share/man/*/man8/grpck.8
+usr/share/man/*/man8/grpconv.8
+usr/share/man/*/man8/grpunconv.8
+usr/share/man/*/man8/newusers.8
+usr/share/man/*/man8/pwck.8
+usr/share/man/*/man8/pwconv.8
+usr/share/man/*/man8/pwunconv.8
+usr/share/man/*/man8/useradd.8
+usr/share/man/*/man8/userdel.8
+usr/share/man/*/man8/usermod.8
+usr/share/man/*/man8/vigr.8
+usr/share/man/*/man8/vipw.8
+usr/share/man/man1/chage.1
+usr/share/man/man1/chfn.1
+usr/share/man/man1/chsh.1
+usr/share/man/man1/expiry.1
+usr/share/man/man1/gpasswd.1
+usr/share/man/man1/passwd.1
+usr/share/man/man5/passwd.5
+usr/share/man/man5/shadow.5
+usr/share/man/man5/gshadow.5
+usr/share/man/man5/subuid.5
+usr/share/man/man5/subgid.5
+usr/share/man/man8/chgpasswd.8
+usr/share/man/man8/chpasswd.8
+usr/share/man/man8/groupadd.8
+usr/share/man/man8/groupdel.8
+usr/share/man/man8/groupmems.8
+usr/share/man/man8/groupmod.8
+usr/share/man/man8/grpck.8
+usr/share/man/man8/grpconv.8
+usr/share/man/man8/grpunconv.8
+usr/share/man/man8/newusers.8
+usr/share/man/man8/pwck.8
+usr/share/man/man8/pwconv.8
+usr/share/man/man8/pwunconv.8
+usr/share/man/man8/useradd.8
+usr/share/man/man8/userdel.8
+usr/share/man/man8/usermod.8
+usr/share/man/man8/vigr.8
+usr/share/man/man8/vipw.8

debian/passwd.newusers.pam

@@ -0,0 +1,5 @@
+# The PAM configuration file for the Shadow 'newusers' service
+#
+
+@include common-password
+

debian/passwd.passwd.pam

@@ -0,0 +1,6 @@
+#
+# The PAM configuration file for the Shadow `passwd' service
+#
+
+@include common-password
+

debian/passwd.postinst

@@ -0,0 +1,30 @@
+#!/bin/sh
+
+set -e
+
+case "$1" in
+configure)
+	if ! getent group shadow | grep -q '^shadow:[^:]*:42'
+	then
+		groupadd -g 42 shadow || (
+    			cat <<EOF
+Group ID 42 has been allocated for the shadow group.  You have either
+used 42 yourself or created a shadow group with a different ID.
+Please correct this problem and reconfigure with ``dpkg --configure passwd''.
+
+Note that both user and group IDs in the range 0-99 are globally
+allocated by the Debian project and must be the same on every Debian
+system.
+EOF
+    			exit 1
+		)
+	fi
+    ;;
+esac
+
+# Run shadowconfig only on new installs
+[ -z "$2" ] && shadowconfig on
+
+#DEBHELPER#
+
+exit 0

debian/passwd.tmpfiles

@@ -0,0 +1,8 @@
+# If a password operation is in progress and we lose power, stale lockfiles
+# can be left behind.  Clear them on boot.
+r! /etc/gshadow.lock
+r! /etc/shadow.lock
+r! /etc/passwd.lock
+r! /etc/group.lock
+r! /etc/subuid.lock
+r! /etc/subgid.lock

debian/passwd.useradd.pam

@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'useradd' service
+#
+
+# This allows root to add users without being prompted for a password
+auth		sufficient	pam_rootok.so
+
+# checks for account validity
+account	required	pam_permit.so

debian/passwd.userdel.pam

@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'userdel' service
+#
+
+# This allows root to remove users without being prompted for a password
+auth		sufficient	pam_rootok.so
+
+# checks for account validity
+account	required	pam_permit.so

debian/passwd.usermod.pam

@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'groupdel' service
+#
+
+# This allows root to remove groups without being prompted for a password
+auth		sufficient	pam_rootok.so
+
+# checks for account validity
+account	required	pam_permit.so

debian/patches/0001-gpasswd-1-Fix-password-leak.patch

@@ -0,0 +1,137 @@
+From 65c88a43a23c2391dcc90c0abda3e839e9c57904 Mon Sep 17 00:00:00 2001
+From: Alejandro Colomar <alx@kernel.org>
+Date: Sat, 10 Jun 2023 16:20:05 +0200
+Subject: [PATCH] gpasswd(1): Fix password leak
+
+How to trigger this password leak?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+When gpasswd(1) asks for the new password, it asks twice (as is usual
+for confirming the new password).  Each of those 2 password prompts
+uses agetpass() to get the password.  If the second agetpass() fails,
+the first password, which has been copied into the 'static' buffer
+'pass' via STRFCPY(), wasn't being zeroed.
+
+agetpass() is defined in <./libmisc/agetpass.c> (around line 91), and
+can fail for any of the following reasons:
+
+-  malloc(3) or readpassphrase(3) failure.
+
+   These are going to be difficult to trigger.  Maybe getting the system
+   to the limits of memory utilization at that exact point, so that the
+   next malloc(3) gets ENOMEM, and possibly even the OOM is triggered.
+   About readpassphrase(3), ENFILE and EINTR seem the only plausible
+   ones, and EINTR probably requires privilege or being the same user;
+   but I wouldn't discard ENFILE so easily, if a process starts opening
+   files.
+
+-  The password is longer than PASS_MAX.
+
+   The is plausible with physical access.  However, at that point, a
+   keylogger will be a much simpler attack.
+
+And, the attacker must be able to know when the second password is being
+introduced, which is not going to be easy.
+
+How to read the password after the leak?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Provoking the leak yourself at the right point by entering a very long
+password is easy, and inspecting the process stack at that point should
+be doable.  Try to find some consistent patterns.
+
+Then, search for those patterns in free memory, right after the victim
+leaks their password.
+
+Once you get the leak, a program should read all the free memory
+searching for patterns that gpasswd(1) leaves nearby the leaked
+password.
+
+On 6/10/23 03:14, Seth Arnold wrote:
+> An attacker process wouldn't be able to use malloc(3) for this task.
+> There's a handful of tools available for userspace to allocate memory:
+>
+> -  brk / sbrk
+> -  mmap MAP_ANONYMOUS
+> -  mmap /dev/zero
+> -  mmap some other file
+> -  shm_open
+> -  shmget
+>
+> Most of these return only pages of zeros to a process.  Using mmap of an
+> existing file, you can get some of the contents of the file demand-loaded
+> into the memory space on the first use.
+>
+> The MAP_UNINITIALIZED flag only works if the kernel was compiled with
+> CONFIG_MMAP_ALLOW_UNINITIALIZED.  This is rare.
+>
+> malloc(3) doesn't zero memory, to our collective frustration, but all the
+> garbage in the allocations is from previous allocations in the current
+> process.  It isn't leftover from other processes.
+>
+> The avenues available for reading the memory:
+> -  /dev/mem and /dev/kmem (requires root, not available with Secure Boot)
+> -  /proc/pid/mem (requires ptrace privileges, mediated by YAMA)
+> -  ptrace (requires ptrace privileges, mediated by YAMA)
+> -  causing memory to be swapped to disk, and then inspecting the swap
+>
+> These all require a certain amount of privileges.
+
+How to fix it?
+~~~~~~~~~~~~~~
+
+memzero(), which internally calls explicit_bzero(3), or whatever
+alternative the system provides with a slightly different name, will
+make sure that the buffer is zeroed in memory, and optimizations are not
+allowed to impede this zeroing.
+
+This is not really 100% effective, since compilers may place copies of
+the string somewhere hidden in the stack.  Those copies won't get zeroed
+by explicit_bzero(3).  However, that's arguably a compiler bug, since
+compilers should make everything possible to avoid optimizing strings
+that are later passed to explicit_bzero(3).  But we all know that
+sometimes it's impossible to have perfect knowledge in the compiler, so
+this is plausible.  Nevertheless, there's nothing we can do against such
+issues, except minimizing the time such passwords are stored in plain
+text.
+
+Security concerns
+~~~~~~~~~~~~~~~~~
+
+We believe this isn't easy to exploit.  Nevertheless, and since the fix
+is trivial, this fix should probably be applied soon, and backported to
+all supported distributions, to prevent someone else having more
+imagination than us to find a way.
+
+Affected versions
+~~~~~~~~~~~~~~~~~
+
+All.  Bug introduced in shadow 19990709.  That's the second commit in
+the git history.
+
+Fixes: 45c6603cc86c ("[svn-upgrade] Integrating new upstream version, shadow (19990709)")
+Reported-by: Alejandro Colomar <alx@kernel.org>
+Cc: Serge Hallyn <serge@hallyn.com>
+Cc: Iker Pedrosa <ipedrosa@redhat.com>
+Cc: Seth Arnold <seth.arnold@canonical.com>
+Cc: Christian Brauner <christian@brauner.io>
+Cc: Balint Reczey <rbalint@debian.org>
+Cc: Sam James <sam@gentoo.org>
+Cc: David Runge <dvzrv@archlinux.org>
+Cc: Andreas Jaeger <aj@suse.de>
+Cc: <~hallyn/shadow@lists.sr.ht>
+Signed-off-by: Alejandro Colomar <alx@kernel.org>
+---
+ src/gpasswd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/src/gpasswd.c
++++ b/src/gpasswd.c
+@@ -896,6 +896,7 @@
+ 		strzero (cp);
+ 		cp = getpass (_("Re-enter new password: "));
+ 		if (NULL == cp) {
++			memzero (pass, sizeof pass);
+ 			exit (1);
+ 		}
+ 

debian/patches/0002-Added-control-character-check.patch

@@ -0,0 +1,45 @@
+From e5905c4b84d4fb90aefcd96ee618411ebfac663d Mon Sep 17 00:00:00 2001
+From: tomspiderlabs <128755403+tomspiderlabs@users.noreply.github.com>
+Date: Thu, 23 Mar 2023 23:39:38 +0000
+Subject: [PATCH] Added control character check
+
+Added control character check, returning -1 (to "err") if control characters are present.
+---
+ lib/fields.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/lib/fields.c b/lib/fields.c
+index 640be931..fb51b582 100644
+--- a/lib/fields.c
++++ b/lib/fields.c
+@@ -21,9 +21,9 @@
+  *
+  * The supplied field is scanned for non-printable and other illegal
+  * characters.
+- *  + -1 is returned if an illegal character is present.
+- *  +  1 is returned if no illegal characters are present, but the field
+- *       contains a non-printable character.
++ *  + -1 is returned if an illegal or control character is present.
++ *  +  1 is returned if no illegal or control characters are present,
++ *       but the field contains a non-printable character.
+  *  +  0 is returned otherwise.
+  */
+ int valid_field (const char *field, const char *illegal)
+@@ -45,10 +45,13 @@ int valid_field (const char *field, const char *illegal)
+ 	}
+ 
+ 	if (0 == err) {
+-		/* Search if there are some non-printable characters */
++		/* Search if there are non-printable or control characters */
+ 		for (cp = field; '\0' != *cp; cp++) {
+ 			if (!isprint (*cp)) {
+ 				err = 1;
++			}
++			if (!iscntrl (*cp)) {
++				err = -1;
+ 				break;
+ 			}
+ 		}
+-- 
+2.34.1
+

debian/patches/0003-Overhaul-valid_field.patch

@@ -0,0 +1,61 @@
+From 2eaea70111f65b16d55998386e4ceb4273c19eb4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
+Date: Fri, 31 Mar 2023 14:46:50 +0200
+Subject: [PATCH] Overhaul valid_field()
+
+e5905c4b ("Added control character check") introduced checking for
+control characters but had the logic inverted, so it rejects all
+characters that are not control ones.
+
+Cast the character to `unsigned char` before passing to the character
+checking functions to avoid UB.
+
+Use strpbrk(3) for the illegal character test and return early.
+---
+ lib/fields.c | 24 ++++++++++--------------
+ 1 file changed, 10 insertions(+), 14 deletions(-)
+
+diff --git a/lib/fields.c b/lib/fields.c
+index fb51b582..53929248 100644
+--- a/lib/fields.c
++++ b/lib/fields.c
+@@ -37,26 +37,22 @@ int valid_field (const char *field, const char *illegal)
+ 
+ 	/* For each character of field, search if it appears in the list
+ 	 * of illegal characters. */
++	if (illegal && NULL != strpbrk (field, illegal)) {
++		return -1;
++	}
++
++	/* Search if there are non-printable or control characters */
+ 	for (cp = field; '\0' != *cp; cp++) {
+-		if (strchr (illegal, *cp) != NULL) {
++		unsigned char c = *cp;
++		if (!isprint (c)) {
++			err = 1;
++		}
++		if (iscntrl (c)) {
+ 			err = -1;
+ 			break;
+ 		}
+ 	}
+ 
+-	if (0 == err) {
+-		/* Search if there are non-printable or control characters */
+-		for (cp = field; '\0' != *cp; cp++) {
+-			if (!isprint (*cp)) {
+-				err = 1;
+-			}
+-			if (!iscntrl (*cp)) {
+-				err = -1;
+-				break;
+-			}
+-		}
+-	}
+-
+ 	return err;
+ }
+ 
+-- 
+2.34.1
+

debian/patches/008_login_log_failure_in_FTMP

@@ -0,0 +1,51 @@
+Goal: Log login failures to the btmp file
+
+Notes:
+ * I'm not sure login should add an entry in the FTMP file when PAM is used.
+   (but nothing in /etc/login.defs indicates that the failure is not logged)
+
+--- a/src/login.c
++++ b/src/login.c
+@@ -827,6 +827,24 @@
+ 			(void) puts ("");
+ 			(void) puts (_("Login incorrect"));
+ 
++			if (getdef_str("FTMP_FILE") != NULL) {
++#ifdef USE_UTMPX
++				struct utmpx *failent =
++					prepare_utmpx (failent_user,
++					               tty,
++					/* FIXME: or fromhost? */hostname,
++					               utent);
++#else				/* !USE_UTMPX */
++				struct utmp *failent =
++					prepare_utmp (failent_user,
++					              tty,
++					              hostname,
++					              utent);
++#endif				/* !USE_UTMPX */
++				failtmp (failent_user, failent);
++				free (failent);
++			}
++
+ 			if (failcount >= retries) {
+ 				SYSLOG ((LOG_NOTICE,
+ 				         "TOO MANY LOGIN TRIES (%u)%s FOR '%s'",
+--- a/lib/getdef.c
++++ b/lib/getdef.c
+@@ -38,7 +38,6 @@
+ 	{"ENVIRON_FILE", NULL},			\
+ 	{"ENV_TZ", NULL},			\
+ 	{"FAILLOG_ENAB", NULL},			\
+-	{"FTMP_FILE", NULL},			\
+ 	{"HMAC_CRYPTO_ALGO", NULL},		\
+ 	{"ISSUE_FILE", NULL},			\
+ 	{"LASTLOG_ENAB", NULL},			\
+@@ -80,6 +79,7 @@
+ 	{"ERASECHAR", NULL},
+ 	{"FAIL_DELAY", NULL},
+ 	{"FAKE_SHELL", NULL},
++	{"FTMP_FILE", NULL},
+ 	{"GID_MAX", NULL},
+ 	{"GID_MIN", NULL},
+ 	{"HOME_MODE", NULL},

debian/patches/401_cppw_src.dpatch

@@ -0,0 +1,276 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 401_cppw_src.dpatch by  Nicolas FRANCOIS <nicolas.francois@centraliens.net>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Add cppw / cpgr
+
+@DPATCH@
+--- /dev/null
++++ b/src/cppw.c
+@@ -0,0 +1,238 @@
++/*
++  cppw, cpgr  copy with locking given file over the password or group file
++  with -s will copy with locking given file over shadow or gshadow file
++
++  Copyright (C) 1999 Stephen Frost <sfrost@snowman.net>
++
++  Based on vipw, vigr by:
++  Copyright (C) 1997 Guy Maor <maor@ece.utexas.edu>
++
++  This program is free software; you can redistribute it and/or modify
++  it under the terms of the GNU General Public License as published by
++  the Free Software Foundation; either version 2 of the License, or
++  (at your option) any later version.
++
++  This program is distributed in the hope that it will be useful, but
++  WITHOUT ANY WARRANTY; without even the implied warranty of
++  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++  General Public License for more details.
++
++  You should have received a copy of the GNU General Public License
++  along with this program; if not, write to the Free Software
++  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
++
++  */
++
++#include <config.h>
++#include "defines.h"
++
++#include <errno.h>
++#include <sys/stat.h>
++#include <unistd.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <sys/types.h>
++#include <signal.h>
++#include <utime.h>
++#include "exitcodes.h"
++#include "prototypes.h"
++#include "pwio.h"
++#include "shadowio.h"
++#include "groupio.h"
++#include "sgroupio.h"
++
++
++const char *Prog;
++
++const char *filename, *filenewname;
++static bool filelocked = false;
++static int (*unlock) (void);
++
++/* local function prototypes */
++static int create_copy (FILE *fp, const char *dest, struct stat *sb);
++static void cppwexit (const char *msg, int syserr, int ret);
++static void cppwcopy (const char *file,
++                      const char *in_file,
++                      int (*file_lock) (void),
++                      int (*file_unlock) (void));
++
++static int create_copy (FILE *fp, const char *dest, struct stat *sb)
++{
++	struct utimbuf ub;
++	FILE *bkfp;
++	int c;
++	mode_t mask;
++
++	mask = umask (077);
++	bkfp = fopen (dest, "w");
++	(void) umask (mask);
++	if (NULL == bkfp) {
++		return -1;
++	}
++
++	rewind (fp);
++	while ((c = getc (fp)) != EOF) {
++		if (putc (c, bkfp) == EOF) {
++			break;
++		}
++	}
++
++	if (   (c != EOF)
++	    || (fflush (bkfp) != 0)) {
++		(void) fclose (bkfp);
++		(void) unlink (dest);
++		return -1;
++	}
++	if (   (fsync (fileno (bkfp)) != 0)
++	    || (fclose (bkfp) != 0)) {
++		(void) unlink (dest);
++		return -1;
++	}
++
++	ub.actime = sb->st_atime;
++	ub.modtime = sb->st_mtime;
++	if (   (utime (dest, &ub) != 0)
++	    || (chmod (dest, sb->st_mode) != 0)
++	    || (chown (dest, sb->st_uid, sb->st_gid) != 0)) {
++		(void) unlink (dest);
++		return -1;
++	}
++	return 0;
++}
++
++static void cppwexit (const char *msg, int syserr, int ret)
++{
++	int err = errno;
++	if (filelocked) {
++		(*unlock) ();
++	}
++	if (NULL != msg) {
++		fprintf (stderr, "%s: %s", Prog, msg);
++		if (0 != syserr) {
++			fprintf (stderr, ": %s", strerror (err));
++		}
++		(void) fputs ("\n", stderr);
++	}
++	if (NULL != filename) {
++		fprintf (stderr, _("%s: %s is unchanged\n"), Prog, filename);
++	} else {
++		fprintf (stderr, _("%s: no changes\n"), Prog);
++	}
++
++	exit (ret);
++}
++
++static void cppwcopy (const char *file,
++                      const char *in_file,
++                      int (*file_lock) (void),
++                      int (*file_unlock) (void))
++{
++	struct stat st1;
++	FILE *f;
++	char filenew[1024];
++
++	snprintf (filenew, sizeof filenew, "%s.new", file);
++	unlock = file_unlock;
++	filename = file;
++	filenewname = filenew;
++
++	if (access (file, F_OK) != 0) {
++		cppwexit (file, 1, 1);
++	}
++	if (file_lock () == 0) {
++		cppwexit (_("Couldn't lock file"), 0, 5);
++	}
++	filelocked = true;
++
++	/* file to copy has same owners, perm */
++	if (stat (file, &st1) != 0) {
++		cppwexit (file, 1, 1);
++	}
++	f = fopen (in_file, "r");
++	if (NULL == f) {
++		cppwexit (in_file, 1, 1);
++	}
++	if (create_copy (f, filenew, &st1) != 0) {
++		cppwexit (_("Couldn't make copy"), errno, 1);
++	}
++
++	/* XXX - here we should check filenew for errors; if there are any,
++	 * fail w/ an appropriate error code and let the user manually fix
++	 * it. Use pwck or grpck to do the check.  - Stephen (Shamelessly
++	 * stolen from '--marekm's comment) */
++
++	if (rename (filenew, file) != 0) {
++		fprintf (stderr, _("%s: can't copy %s: %s)\n"),
++                         Prog, filenew, strerror (errno));
++		cppwexit (NULL,0,1);
++	}
++
++	(*file_unlock) ();
++}
++
++int main (int argc, char **argv)
++{
++	int flag;
++	bool cpshadow = false;
++	char *in_file;
++	int e = E_USAGE;
++	bool do_cppw = true;
++
++	(void) setlocale (LC_ALL, "");
++	(void) bindtextdomain (PACKAGE, LOCALEDIR);
++	(void) textdomain (PACKAGE);
++
++	Prog = Basename (argv[0]);
++	if (strcmp (Prog, "cpgr") == 0) {
++		do_cppw = false;
++	}
++
++	while ((flag = getopt (argc, argv, "ghps")) != EOF) {
++		switch (flag) {
++		case 'p':
++			do_cppw = true;
++			break;
++		case 'g':
++			do_cppw = false;
++			break;
++		case 's':
++			cpshadow = true;
++			break;
++		case 'h':
++			e = E_SUCCESS;
++			/*pass through*/
++		default:
++			(void) fputs (_("Usage:\n\
++`cppw <file>' copys over /etc/passwd   `cppw -s <file>' copys over /etc/shadow\n\
++`cpgr <file>' copys over /etc/group    `cpgr -s <file>' copys over /etc/gshadow\n\
++"), (E_SUCCESS != e) ? stderr : stdout);
++			exit (e);
++		}
++	}
++
++	if (argc != optind + 1) {
++		cppwexit (_("wrong number of arguments, -h for usage"),0,1);
++	}
++
++	in_file = argv[optind];
++
++	if (do_cppw) {
++		if (cpshadow) {
++			cppwcopy (SHADOW_FILE, in_file, spw_lock, spw_unlock);
++		} else {
++			cppwcopy (PASSWD_FILE, in_file, pw_lock, pw_unlock);
++		}
++	} else {
++#ifdef SHADOWGRP
++		if (cpshadow) {
++			cppwcopy (SGROUP_FILE, in_file, sgr_lock, sgr_unlock);
++		} else
++#endif				/* SHADOWGRP */
++		{
++			cppwcopy (GROUP_FILE, in_file, gr_lock, gr_unlock);
++		}
++	}
++
++	return 0;
++}
++
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -34,6 +34,7 @@
+ bin_PROGRAMS  += su
+ endif
+ usbin_PROGRAMS = \
++	cppw \
+ 	chgpasswd \
+ 	chpasswd \
+ 	groupadd \
+@@ -102,6 +103,7 @@
+ chgpasswd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT) $(LIBECONF)
+ chsh_LDADD     = $(LDADD) $(LIBPAM) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD) $(LIBECONF)
+ chpasswd_LDADD = $(LDADD) $(LIBPAM) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT) $(LIBECONF)
++cppw_LDADD     = $(LDADD) $(LIBSELINUX) $(LIBAUDIT)
+ expiry_LDADD = $(LDADD) $(LIBECONF)
+ gpasswd_LDADD  = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT) $(LIBECONF)
+ groupadd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBECONF) -ldl
+--- a/po/POTFILES.in
++++ b/po/POTFILES.in
+@@ -91,6 +91,7 @@
+ src/chgpasswd.c
+ src/chpasswd.c
+ src/chsh.c
++src/cppw.c
+ src/expiry.c
+ src/faillog.c
+ src/gpasswd.c

debian/patches/402_cppw_selinux

@@ -0,0 +1,64 @@
+Goal: Add selinux support to cppw
+
+Fix:
+
+Status wrt upstream: cppw is not available upstream.
+                     The patch was made based on the
+                     302_vim_selinux_support patch. It needs to be
+                     reviewed by an SE-Linux aware person.
+
+Depends on 401_cppw_src.dpatch
+
+Index: git/src/cppw.c
+===================================================================
+--- git.orig/src/cppw.c
++++ git/src/cppw.c
+@@ -34,6 +34,9 @@
+ #include <sys/types.h>
+ #include <signal.h>
+ #include <utime.h>
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++#endif				/* WITH_SELINUX */
+ #include "exitcodes.h"
+ #include "prototypes.h"
+ #include "pwio.h"
+@@ -139,6 +142,22 @@
+ 	if (access (file, F_OK) != 0) {
+ 		cppwexit (file, 1, 1);
+ 	}
++#ifdef WITH_SELINUX
++	/* if SE Linux is enabled then set the context of all new files
++	 * to be the context of the file we are editing */
++	if (is_selinux_enabled () > 0) {
++		security_context_t passwd_context=NULL;
++		int ret = 0;
++		if (getfilecon (file, &passwd_context) < 0) {
++			cppwexit (_("Couldn't get file context"), errno, 1);
++		}
++		ret = setfscreatecon (passwd_context);
++		freecon (passwd_context);
++		if (0 != ret) {
++			cppwexit (_("setfscreatecon () failed"), errno, 1);
++		}
++	}
++#endif				/* WITH_SELINUX */
+ 	if (file_lock () == 0) {
+ 		cppwexit (_("Couldn't lock file"), 0, 5);
+ 	}
+@@ -167,6 +186,15 @@
+ 		cppwexit (NULL,0,1);
+ 	}
+ 
++#ifdef WITH_SELINUX
++	/* unset the fscreatecon */
++	if (is_selinux_enabled () > 0) {
++		if (setfscreatecon (NULL)) {
++		cppwexit (_("setfscreatecon() failed"), errno, 1);
++		}
++	}
++#endif				/* WITH_SELINUX */
++
+ 	(*file_unlock) ();
+ }
+ 

debian/patches/429_login_FAILLOG_ENAB

@@ -0,0 +1,84 @@
+Goal: Re-enable logging and displaying failures on login when login is
+      compiled with PAM and when FAILLOG_ENAB is set to yes. And create the
+      faillog file if it does not exist on postinst (as on Woody).
+Depends: 008_login_more_LOG_UNKFAIL_ENAB
+Fixes: #192849
+
+Note: It could be removed if pam_tally could report the number of failures
+      preceding a successful login.
+
+--- a/src/login.c
++++ b/src/login.c
+@@ -114,9 +114,9 @@
+ #endif
+ 			);
+ 
+-#ifndef USE_PAM
+ static struct faillog faillog;
+ 
++#ifndef USE_PAM
+ static void bad_time_notify (void);
+ static void check_nologin (bool login_to_root);
+ #else
+@@ -787,6 +787,9 @@
+ 				SYSLOG ((LOG_NOTICE,
+ 				         "TOO MANY LOGIN TRIES (%u)%s FOR '%s'",
+ 				         failcount, fromhost, failent_user));
++				if ((NULL != pwd) && getdef_bool("FAILLOG_ENAB")) {
++					failure (pwd->pw_uid, tty, &faillog);
++				}
+ 				fprintf (stderr,
+ 				         _("Maximum number of tries exceeded (%u)\n"),
+ 				         failcount);
+@@ -804,6 +807,14 @@
+ 				         pam_strerror (pamh, retcode)));
+ 				failed = true;
+ 			}
++			if (   (NULL != pwd)
++			    && getdef_bool("FAILLOG_ENAB")
++			    && ! failcheck (pwd->pw_uid, &faillog, failed)) {
++				SYSLOG((LOG_CRIT,
++				        "exceeded failure limit for `%s' %s",
++				        failent_user, fromhost));
++				failed = 1;
++			}
+ 
+ 			if (!failed) {
+ 				break;
+@@ -827,6 +838,10 @@
+ 			(void) puts ("");
+ 			(void) puts (_("Login incorrect"));
+ 
++			if ((NULL != pwd) && getdef_bool("FAILLOG_ENAB")) {
++				failure (pwd->pw_uid, tty, &faillog);
++			}
++
+ 			if (getdef_str("FTMP_FILE") != NULL) {
+ #ifdef USE_UTMPX
+ 				struct utmpx *failent =
+@@ -1295,6 +1310,7 @@
+ 		 */
+ #ifndef USE_PAM
+ 		motd ();	/* print the message of the day */
++#endif
+ 		if (   getdef_bool ("FAILLOG_ENAB")
+ 		    && (0 != faillog.fail_cnt)) {
+ 			failprint (&faillog);
+@@ -1307,6 +1323,7 @@
+ 				         username, (int) faillog.fail_cnt));
+ 			}
+ 		}
++#ifndef USE_PAM
+ 		if (   getdef_bool ("LASTLOG_ENAB")
+ 		    && pwd->pw_uid <= (uid_t) getdef_ulong ("LASTLOG_UID_MAX", 0xFFFFFFFFUL)
+ 		    && (ll.ll_time != 0)) {
+--- a/lib/getdef.c
++++ b/lib/getdef.c
+@@ -78,6 +78,7 @@
+ 	{"ENV_SUPATH", NULL},
+ 	{"ERASECHAR", NULL},
+ 	{"FAIL_DELAY", NULL},
++	{"FAILLOG_ENAB", NULL},
+ 	{"FAKE_SHELL", NULL},
+ 	{"FTMP_FILE", NULL},
+ 	{"GID_MAX", NULL},

debian/patches/463_login_delay_obeys_to_PAM

@@ -0,0 +1,97 @@
+Goal: Do not hardcode pam_fail_delay and let pam_unix do its
+      job to set a delay...or not
+
+Fixes: #87648
+
+Status wrt upstream: Forwarded but not applied yet
+
+Note: If removed, FAIL_DELAY must be re-added to /etc/login.defs
+
+--- a/src/login.c
++++ b/src/login.c
+@@ -512,7 +512,6 @@
+ #if !defined(USE_PAM)
+ 	char ptime[80];
+ #endif
+-	unsigned int delay;
+ 	unsigned int retries;
+ 	bool subroot = false;
+ #ifndef USE_PAM
+@@ -537,6 +536,7 @@
+ 	pid_t child;
+ 	char *pam_user = NULL;
+ #else
++	unsigned int delay;
+ 	struct spwd *spwd = NULL;
+ #endif
+ 	/*
+@@ -701,7 +701,6 @@
+ 	}
+ 
+ 	environ = newenvp;	/* make new environment active */
+-	delay   = getdef_unum ("FAIL_DELAY", 1);
+ 	retries = getdef_unum ("LOGIN_RETRIES", RETRIES);
+ 
+ #ifdef USE_PAM
+@@ -717,8 +716,7 @@
+ 
+ 	/*
+ 	 * hostname & tty are either set to NULL or their correct values,
+-	 * depending on how much we know. We also set PAM's fail delay to
+-	 * ours.
++	 * depending on how much we know.
+ 	 *
+ 	 * PAM_RHOST and PAM_TTY are used for authentication, only use
+ 	 * information coming from login or from the caller (e.g. no utmp)
+@@ -727,10 +725,6 @@
+ 	PAM_FAIL_CHECK;
+ 	retcode = pam_set_item (pamh, PAM_TTY, tty);
+ 	PAM_FAIL_CHECK;
+-#ifdef HAS_PAM_FAIL_DELAY
+-	retcode = pam_fail_delay (pamh, 1000000 * delay);
+-	PAM_FAIL_CHECK;
+-#endif
+ 	/* if fflg, then the user has already been authenticated */
+ 	if (!fflg) {
+ 		unsigned int failcount = 0;
+@@ -771,12 +765,6 @@
+ 			bool failed = false;
+ 
+ 			failcount++;
+-#ifdef HAS_PAM_FAIL_DELAY
+-			if (delay > 0) {
+-				retcode = pam_fail_delay(pamh, 1000000*delay);
+-				PAM_FAIL_CHECK;
+-			}
+-#endif
+ 
+ 			retcode = pam_authenticate (pamh, 0);
+ 
+@@ -1110,14 +1098,17 @@
+ 		free (username);
+ 		username = NULL;
+ 
++#ifndef USE_PAM
+ 		/*
+ 		 * Wait a while (a la SVR4 /usr/bin/login) before attempting
+ 		 * to login the user again. If the earlier alarm occurs
+ 		 * before the sleep() below completes, login will exit.
+ 		 */
++		delay = getdef_unum ("FAIL_DELAY", 1);
+ 		if (delay > 0) {
+ 			(void) sleep (delay);
+ 		}
++#endif
+ 
+ 		(void) puts (_("Login incorrect"));
+ 
+--- a/lib/getdef.c
++++ b/lib/getdef.c
+@@ -77,7 +77,6 @@
+ 	{"ENV_PATH", NULL},
+ 	{"ENV_SUPATH", NULL},
+ 	{"ERASECHAR", NULL},
+-	{"FAIL_DELAY", NULL},
+ 	{"FAILLOG_ENAB", NULL},
+ 	{"FAKE_SHELL", NULL},
+ 	{"FTMP_FILE", NULL},

debian/patches/501_commonio_group_shadow

@@ -0,0 +1,60 @@
+Goal: save the [g]shadow files with the 'shadow' group and mode 0440
+
+Fixes: #166793
+
+--- a/lib/commonio.c
++++ b/lib/commonio.c
+@@ -21,6 +21,7 @@
+ #include <errno.h>
+ #include <stdio.h>
+ #include <signal.h>
++#include <grp.h>
+ #include "nscd.h"
+ #include "sssd.h"
+ #ifdef WITH_TCB
+@@ -970,12 +971,23 @@
+ 			goto fail;
+ 		}
+ 	} else {
++		struct group *grp;
+ 		/*
+ 		 * Default permissions for new [g]shadow files.
+ 		 */
+ 		sb.st_mode = db->st_mode;
+ 		sb.st_uid = db->st_uid;
+ 		sb.st_gid = db->st_gid;
++
++		/*
++		 * Try to retrieve the shadow's GID, and fall back to GID 0.
++		 */
++		if (sb.st_gid == 0) {
++			if ((grp = getgrnam("shadow")) != NULL)
++				sb.st_gid = grp->gr_gid;
++			else
++				sb.st_gid = 0;
++		}
+ 	}
+ 
+ 	snprintf (buf, sizeof buf, "%s+", db->filename);
+--- a/lib/sgroupio.c
++++ b/lib/sgroupio.c
+@@ -206,7 +206,7 @@
+ #ifdef WITH_SELINUX
+ 	NULL,			/* scontext */
+ #endif
+-	0400,                   /* st_mode */
++	0440,                   /* st_mode */
+ 	0,                      /* st_uid */
+ 	0,                      /* st_gid */
+ 	NULL,			/* head */
+--- a/lib/shadowio.c
++++ b/lib/shadowio.c
+@@ -84,7 +84,7 @@
+ #ifdef WITH_SELINUX
+ 	NULL,			/* scontext */
+ #endif				/* WITH_SELINUX */
+-	0400,                   /* st_mode */
++	0440,                   /* st_mode */
+ 	0,                      /* st_uid */
+ 	0,                      /* st_gid */
+ 	NULL,			/* head */

debian/patches/502_debian_useradd_defaults

@@ -0,0 +1,41 @@
+From: Balint Reczey <balint@balintreczey.hu>
+Description: Keep using Debian's adduser defaults
+ Upstream's bbf4b79bc49fd1826eb41f6629669ef0b647267b commit
+ in 4.9 merged those values from upstream's default configuration file
+ which is not shipped in Debian.
+ This patch keeps the program's compiled in defaults in sync with the
+ configuration files shipped in Debian (debian/default/useradd).
+Bug: https://github.com/shadow-maint/shadow/issues/501
+Bug-Debian: https://bugs.debian.org/1004710
+Forwarded: not-needed
+
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -79,12 +79,12 @@
+ /*
+  * These defaults are used if there is no defaults file.
+  */
+-static gid_t def_group = 1000;
++static gid_t def_group = 100;
+ static const char *def_gname = "other";
+ static const char *def_home = "/home";
+ static const char *def_shell = "/bin/bash";
+ static const char *def_template = SKEL_DIR;
+-static const char *def_create_mail_spool = "yes";
++static const char *def_create_mail_spool = "no";
+ static const char *def_log_init = "yes";
+ 
+ static long def_inactive = -1;
+diff --git a/man/useradd.8.xml b/man/useradd.8.xml
+index af02a23f..c7f95b47 100644
+--- a/man/useradd.8.xml
++++ b/man/useradd.8.xml
+@@ -248,7 +248,7 @@
+ 	    command line), useradd will set the primary group of the new
+ 	    user to the value specified by the <option>GROUP</option>
+ 	    variable in <filename>/etc/default/useradd</filename>, or
+-	    1000 by default.
++	    100 by default.
+ 	  </para>
+ 	</listitem>
+       </varlistentry>

debian/patches/503_shadowconfig.8

@@ -0,0 +1,201 @@
+Goal: Document the shadowconfig utility
+
+Status wrt upstream: The shadowconfig utility is debian specific.
+                     Its man page also (but it used to be distributed)
+
+Index: git/man/shadowconfig.8
+===================================================================
+--- /dev/null
++++ git/man/shadowconfig.8
+@@ -0,0 +1,41 @@
++.\"Generated by db2man.xsl. Don't modify this, modify the source.
++.de Sh \" Subsection
++.br
++.if t .Sp
++.ne 5
++.PP
++\fB\\$1\fR
++.PP
++..
++.de Sp \" Vertical space (when we can't use .PP)
++.if t .sp .5v
++.if n .sp
++..
++.de Ip \" List item
++.br
++.ie \\n(.$>=3 .ne \\$3
++.el .ne 3
++.IP "\\$1" \\$2
++..
++.TH "SHADOWCONFIG" 8 "19 Apr 1997" "" ""
++.SH NAME
++shadowconfig \- toggle shadow passwords on and off
++.SH "SYNOPSIS"
++.ad l
++.hy 0
++.HP 13
++\fBshadowconfig\fR \fB\fIon\fR\fR | \fB\fIoff\fR\fR
++.ad
++.hy
++
++.SH "DESCRIPTION"
++
++.PP
++\fBshadowconfig\fR on will turn shadow passwords on; \fIshadowconfig off\fR will turn shadow passwords off\&. \fBshadowconfig\fR will print an error message and exit with a nonzero code if it finds anything awry\&. If that happens, you should correct the error and run it again\&. Turning shadow passwords on when they are already on, or off when they are already off, is harmless\&.
++
++.PP
++Read \fI/usr/share/doc/passwd/README\&.Debian\fR for a brief introduction to shadow passwords and related features\&.
++
++.PP
++Note that turning shadow passwords off and on again will lose all password aging information\&.
++
+Index: git/man/shadowconfig.8.xml
+===================================================================
+--- /dev/null
++++ git/man/shadowconfig.8.xml
+@@ -0,0 +1,52 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
++		"http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
++<refentry id='shadowconfig.8'>
++  <!-- $Id: shadowconfig.8.xml,v 1.6 2005/06/15 12:39:27 kloczek Exp $ -->
++  <refentryinfo>
++    <date>19 Apr 1997</date>
++  </refentryinfo>
++  <refmeta>
++    <refentrytitle>shadowconfig</refentrytitle>
++    <manvolnum>8</manvolnum>
++    <refmiscinfo class='date'>19 Apr 1997</refmiscinfo>
++    <refmiscinfo class='source'>Debian GNU/Linux</refmiscinfo>
++  </refmeta>
++  <refnamediv id='name'>
++    <refname>shadowconfig</refname>
++    <refpurpose>toggle shadow passwords on and off</refpurpose>
++  </refnamediv>
++
++  <refsynopsisdiv id='synopsis'>
++    <cmdsynopsis>
++      <command>shadowconfig</command>
++      <group choice='plain'>
++        <arg choice='plain'><replaceable>on</replaceable></arg>
++        <arg choice='plain'><replaceable>off</replaceable></arg>
++      </group>
++    </cmdsynopsis>
++  </refsynopsisdiv>
++
++  <refsect1 id='description'>
++    <title>DESCRIPTION</title>
++    <para><command>shadowconfig</command> on will turn shadow passwords on;
++      <emphasis remap='B'>shadowconfig off</emphasis> will turn shadow
++      passwords off. <command>shadowconfig</command> will print an error
++      message and exit with a nonzero code if it finds anything awry. If
++      that happens, you should correct the error and run it again. Turning
++      shadow passwords on when they are already on, or off when they are
++      already off, is harmless.
++    </para>
++
++    <para>
++      Read <filename>/usr/share/doc/passwd/README.Debian</filename> for a
++      brief introduction
++      to shadow passwords and related features.
++    </para>
++
++    <para>Note that turning shadow passwords off and on again will lose all
++      password
++      aging information.
++    </para>
++  </refsect1>
++</refentry>
+Index: git/man/fr/shadowconfig.8
+===================================================================
+--- /dev/null
++++ git/man/fr/shadowconfig.8
+@@ -0,0 +1,26 @@
++.\" This file was generated with po4a. Translate the source file.
++.\"
++.\"$Id: shadowconfig.8,v 1.4 2001/08/23 23:10:48 kloczek Exp $
++.TH SHADOWCONFIG 8 "19 avril 1997" "Debian GNU/Linux"
++.SH NOM
++shadowconfig \- active ou désactive les mots de passe cachés
++.SH SYNOPSIS
++\fBshadowconfig\fP \fIon\fP | \fIoff\fP
++.SH DESCRIPTION
++.PP
++\fBshadowconfig on\fP active les mots de passe cachés («\ shadow passwords\ »)\ ; \fBshadowconfig off\fP les désactive. \fBShadowconfig\fP affiche un message
++d'erreur et quitte avec une valeur de retour non nulle s'il rencontre
++quelque chose d'inattendu. Dans ce cas, vous devrez corriger l'erreur avant
++de recommencer.
++
++Activer les mots de passe cachés lorsqu'ils sont déjà activés, ou les
++désactiver lorsqu'ils ne sont pas actifs est sans effet.
++
++Lisez \fI/usr/share/doc/passwd/README.Debian\fP pour une brève introduction aux
++mots de passe cachés et à leurs fonctionnalités.
++
++Notez que désactiver puis réactiver les mots de passe cachés aura pour
++conséquence la perte des informations d'âge sur les mots de passe.
++.SH TRADUCTION
++Nicolas FRANÇOIS, 2004.
++Veuillez signaler toute erreur à <\fIdebian\-l10\-french@lists.debian.org\fR>.
+Index: git/man/ja/shadowconfig.8
+===================================================================
+--- /dev/null
++++ git/man/ja/shadowconfig.8
+@@ -0,0 +1,25 @@
++.\"     all right reserved,
++.\" Translated Tue Oct 30 11:59:11 JST 2001
++.\" by Maki KURODA <mkuroda@aisys-jp.com>
++.\"
++.TH SHADOWCONFIG 8 "19 Apr 1997" "Debian GNU/Linux"
++.SH 名前
++shadowconfig \- shadow パスワードの設定をオン及びオフに切替える
++.SH 書式
++.B "shadowconfig"
++.IR on " | " off
++.SH 説明
++.PP
++.B shadowconfig on
++は shadow パスワードを有効にする。
++.B shadowconfig off
++は shadow パスワードを無効にする。
++.B shadowconfig
++は何らかの間違いがあると、エラーメッセージを表示し、
++ゼロではない返り値を返す。
++もしそのようなことが起こった場合、エラーを修正し、再度実行しなければならない。
++shadow パスワードの設定がすでにオンの場合にオンに設定したり、
++すでにオフの場合にオフに設定しても、何の影響もない。
++
++.I /usr/share/doc/passwd/README.debian.gz
++には shadow パスワードとそれに関する特徴の簡単な紹介が書かれている。
+Index: git/man/pl/shadowconfig.8
+===================================================================
+--- /dev/null
++++ git/man/pl/shadowconfig.8
+@@ -0,0 +1,27 @@
++.\" $Id: shadowconfig.8,v 1.3 2001/08/23 23:10:51 kloczek Exp $
++.\" {PTM/WK/1999-09-14}
++.TH SHADOWCONFIG 8 "19 kwietnia 1997" "Debian GNU/Linux"
++.SH NAZWA
++shadowconfig - przełącza ochronę haseł i grup przez pliki shadow
++.SH SKŁADNIA
++.B "shadowconfig"
++.IR on " | " off
++.SH OPIS
++.PP
++.B shadowconfig on
++włącza ochronę haseł i grup przez dodatkowe, przesłaniane pliki (shadow);
++.B shadowconfig off
++wyłącza dodatkowe pliki haseł i grup.
++.B shadowconfig
++wyświetla komunikat o błędzie i kończy pracę z niezerowym kodem jeśli
++znajdzie coś nieprawidłowego. W takim wypadku powinieneś poprawić błąd
++.\" if it finds anything awry.
++i uruchomić program ponownie.
++
++Włączenie ochrony haseł, gdy jest ona już włączona lub jej wyłączenie,
++gdy jest wyłączona jest nieszkodliwe.
++
++Przeczytaj
++.IR /usr/share/doc/passwd/README.debian.gz ,
++gdzie znajdziesz krótkie wprowadzenie do ochrony haseł z użyciem dodatkowych
++plików haseł przesłanianych (shadow passwords) i związanych tematów.

debian/patches/505_useradd_recommend_adduser

@@ -0,0 +1,36 @@
+Goal: Recommend using adduser and deluser.
+
+Fixes: #406046
+
+Status wrt upstream: Debian specific patch.
+
+--- a/man/useradd.8.xml
++++ b/man/useradd.8.xml
+@@ -83,6 +83,12 @@
+   <refsect1 id='description'>
+     <title>DESCRIPTION</title>
+       <para>
++	<command>useradd</command> is a low level utility for adding
++	users.  On Debian, administrators should usually use
++	<citerefentry><refentrytitle>adduser</refentrytitle>
++	<manvolnum>8</manvolnum></citerefentry> instead.
++      </para>
++      <para>
+ 	When invoked without the <option>-D</option> option, the
+ 	<command>useradd</command> command creates a new user account using
+ 	the values specified on the command line plus the default values from
+--- a/man/userdel.8.xml
++++ b/man/userdel.8.xml
+@@ -59,6 +59,12 @@
+   <refsect1 id='description'>
+     <title>DESCRIPTION</title>
+     <para>
++      <command>userdel</command> is a low level utility for removing
++      users.  On Debian, administrators should usually use
++      <citerefentry><refentrytitle>deluser</refentrytitle>
++      <manvolnum>8</manvolnum></citerefentry> instead.
++    </para>
++    <para>
+       The <command>userdel</command> command modifies the system account
+       files, deleting all entries that refer to the user name <emphasis
+       remap='I'>LOGIN</emphasis>. The named user must exist.

debian/patches/506_relaxed_usernames

@@ -0,0 +1,111 @@
+Goal: Relaxed usernames/groupnames checking patch.
+
+Status wrt upstream: Debian specific. Not to be used upstream
+
+Details:
+ Allows any non-empty user/grounames that don't contain ':', ',' or '\n'
+ characters and don't start with '-', '+', or '~'. This patch is more
+ restrictive than original Karl's version. closes: #264879
+ Also closes: #377844
+ 
+ Comments from Karl Ramm (shadow 1:4.0.3-9, 20 Aug 2003 02:06:50 -0400):
+ 
+ I can't come up with a good justification as to why characters other
+ than ':'s and '\0's should be disallowed in group and usernames (other
+ than '-' as the leading character).  Thus, the maintenance tools don't
+ anymore.  closes: #79682, #166798, #171179
+
+--- a/libmisc/chkname.c
++++ b/libmisc/chkname.c
+@@ -32,44 +32,26 @@
+ 	}
+ 
+ 	/*
+-         * User/group names must match gnu e-regex:
+-         *    [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?
+-         *
+-         * as a non-POSIX, extension, allow "$" as the last char for
+-         * sake of Samba 3.x "add machine script"
+-         *
+-         * Also do not allow fully numeric names or just "." or "..".
+-         */
+-	int numeric;
+-
+-	if ('\0' == *name ||
+-	    ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
+-			      '\0' == name[1])) ||
+-	    !((*name >= 'a' && *name <= 'z') ||
+-	      (*name >= 'A' && *name <= 'Z') ||
+-	      (*name >= '0' && *name <= '9') ||
+-	      *name == '_' ||
+-	      *name == '.')) {
++	 * POSIX indicate that usernames are composed of characters from the
++	 * portable filename character set [A-Za-z0-9._-], and that the hyphen
++	 * should not be used as the first character of a portable user name.
++	 *
++	 * Allow more relaxed user/group names in Debian -- ^[^-~+:,\s][^:,\s]*$
++	 */
++	if (   ('\0' == *name)
++	    || ('-'  == *name)
++	    || ('~'  == *name)
++	    || ('+'  == *name)) {
+ 		return false;
+ 	}
+-
+-	numeric = isdigit(*name);
+-
+-	while ('\0' != *++name) {
+-		if (!((*name >= 'a' && *name <= 'z') ||
+-		      (*name >= 'A' && *name <= 'Z') ||
+-		      (*name >= '0' && *name <= '9') ||
+-		      *name == '_' ||
+-		      *name == '.' ||
+-		      *name == '-' ||
+-		      (*name == '$' && name[1] == '\0')
+-		     )) {
++	do {
++		if ((':' == *name) || (',' == *name) || isspace(*name)) {
+ 			return false;
+ 		}
+-		numeric &= isdigit(*name);
+-	}
++		name++;
++	} while ('\0' != *name);
+ 
+-	return !numeric;
++	return true;
+ }
+ 
+ bool is_valid_user_name (const char *name)
+--- a/man/useradd.8.xml
++++ b/man/useradd.8.xml
+@@ -708,6 +708,14 @@
+       the <command>ls</command> output.
+     </para>
+     <para>
++      On Debian, the only constraints are that usernames must neither start
++      with a dash ('-') nor plus ('+') nor tilde ('~') nor contain a
++      colon (':'), a comma (','), or a whitespace (space: ' ',
++      end of line: '\n', tabulation: '\t', etc.). Note that using a slash
++      ('/') may break the default algorithm for the definition of the
++      user's home directory.
++    </para>
++    <para>
+       Usernames may only be up to 32 characters long.
+     </para>
+   </refsect1>
+--- a/man/groupadd.8.xml
++++ b/man/groupadd.8.xml
+@@ -72,6 +72,12 @@
+        also disallowed.
+      </para>
+      <para>
++       On Debian, the only constraints are that groupnames must neither start
++       with a dash ('-') nor plus ('+') nor tilde ('~') nor contain a
++       colon (':'), a comma (','), or a whitespace (space:' ',
++       end of line: '\n', tabulation: '\t', etc.).
++     </para>
++     <para>
+        Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
+      </para>
+   </refsect1>

debian/patches/542_useradd-O_option

@@ -0,0 +1,40 @@
+Goal: accepts the -O flag for backward compatibility. (was used by adduser?)
+
+Note: useradd.8 needs to be regenerated.
+
+Status wrt upstream: not included as this is just specific 
+                     backward compatibility for Debian
+
+--- a/man/useradd.8.xml
++++ b/man/useradd.8.xml
+@@ -326,6 +326,11 @@
+ 	    =<replaceable>100</replaceable>&nbsp;<option>-K</option>&nbsp;
+ 	    <replaceable>UID_MAX</replaceable>=<replaceable>499</replaceable>
+ 	  </para>
++          <para>
++            For the compatibility with previous Debian's
++            <command>useradd</command>, the <option>-O</option> option is
++            also supported.
++          </para>
+ 	  <!--para>
+ 	    Note: <option>-K</option>&nbsp;<replaceable>UID_MIN</replaceable>=<replaceable>10</replaceable>,<replaceable>UID_MAX</replaceable>=<replaceable>499</replaceable>
+ 	    doesn't work yet.
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -1227,7 +1227,7 @@
+ 			{NULL, 0, NULL, '\0'}
+ 		};
+ 		while ((c = getopt_long (argc, argv,
+-					 "b:c:d:De:f:g:G:hk:K:lmMNop:rR:P:s:u:U"
++					 "b:c:d:De:f:g:G:hk:O:K:lmMNop:rR:P:s:u:U"
+ #ifdef WITH_SELINUX
+ 		                         "Z:"
+ #endif				/* WITH_SELINUX */
+@@ -1367,6 +1367,7 @@
+ 				kflg = true;
+ 				break;
+ 			case 'K':
++			case 'O': /* compatibility with previous Debian useradd */
+ 				/*
+ 				 * override login.defs defaults (-K name=value)
+ 				 * example: -K UID_MIN=100 -K UID_MAX=499

debian/patches/900_testsuite_groupmems

@@ -0,0 +1,81 @@
+--- a/debian/passwd.install
++++ b/debian/passwd.install
+@@ -9,6 +9,7 @@
+ usr/sbin/cppw
+ usr/sbin/groupadd
+ usr/sbin/groupdel
++usr/sbin/groupmems
+ usr/sbin/groupmod
+ usr/sbin/grpck
+ usr/sbin/grpconv
+@@ -33,6 +34,7 @@
+ usr/share/man/*/man8/chpasswd.8
+ usr/share/man/*/man8/groupadd.8
+ usr/share/man/*/man8/groupdel.8
++usr/share/man/*/man8/groupmems.8
+ usr/share/man/*/man8/groupmod.8
+ usr/share/man/*/man8/grpck.8
+ usr/share/man/*/man8/grpconv.8
+@@ -59,6 +61,7 @@
+ usr/share/man/man8/chpasswd.8
+ usr/share/man/man8/groupadd.8
+ usr/share/man/man8/groupdel.8
++usr/share/man/man8/groupmems.8
+ usr/share/man/man8/groupmod.8
+ usr/share/man/man8/grpck.8
+ usr/share/man/man8/grpconv.8
+--- a/debian/passwd.postinst
++++ b/debian/passwd.postinst
+@@ -31,6 +31,24 @@
+     			exit 1
+ 		)
+ 	fi
++	if ! getent group groupmems | grep -q '^groupmems:[^:]*:99'
++	then
++		groupadd -g 99 groupmems || (
++    			cat <<EOF
++************************  TESTSUITE  *****************************
++Group ID 99 has been allocated for the groupmems group.  You have either
++used 99 yourself or created a groupmems group with a different ID.
++Please correct this problem and reconfigure with ``dpkg --configure passwd''.
++
++Note that both user and group IDs in the range 0-99 are globally
++allocated by the Debian project and must be the same on every Debian
++system.
++EOF
++    			exit 1
++		)
++# FIXME
++		chgrp groupmems /usr/sbin/groupmems
++	fi
+     ;;
+ esac
+ 
+--- a/debian/rules
++++ b/debian/rules
+@@ -60,6 +60,7 @@
+ 	dh_installpam -p passwd --name=chsh
+ 	dh_installpam -p passwd --name=chpasswd
+ 	dh_installpam -p passwd --name=newusers
++	dh_installpam -p passwd --name=groupmems
+ ifeq ($(DEB_HOST_ARCH_OS),hurd)
+ # login is not built on The Hurd, but some utilities of passwd depends on
+ # /etc/login.defs.
+@@ -87,3 +88,6 @@
+ 	chgrp shadow debian/passwd/usr/bin/expiry
+ 	chmod g+s debian/passwd/usr/bin/chage
+ 	chmod g+s debian/passwd/usr/bin/expiry
++	chgrp groupmems debian/passwd/usr/sbin/groupmems
++	chmod u+s debian/passwd/usr/sbin/groupmems
++	chmod o-x debian/passwd/usr/sbin/groupmems
+--- /dev/null
++++ b/debian/passwd.groupmems.pam
+@@ -0,0 +1,8 @@
++# The PAM configuration file for the Shadow 'groupmod' service
++#
++
++# This allows root to modify groups without being prompted for a password
++auth		sufficient	pam_rootok.so
++
++@include common-auth
++@include common-account

debian/patches/901_testsuite_gcov

@@ -0,0 +1,76 @@
+--- a/lib/Makefile.am
++++ b/lib/Makefile.am
+@@ -1,6 +1,8 @@
+ 
+ AUTOMAKE_OPTIONS = 1.0 foreign
+ 
++CFLAGS += -fprofile-arcs -ftest-coverage
++
+ DEFS = 
+ 
+ noinst_LTLIBRARIES = libshadow.la
+--- a/libmisc/Makefile.am
++++ b/libmisc/Makefile.am
+@@ -1,6 +1,8 @@
+ 
+ EXTRA_DIST = .indent.pro xgetXXbyYY.c
+ 
++CFLAGS += -fprofile-arcs -ftest-coverage
++
+ INCLUDES = -I$(top_srcdir)/lib
+ 
+ noinst_LIBRARIES = libmisc.a
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -7,6 +7,8 @@
+ suidperms = 4755
+ sgidperms = 2755
+ 
++CFLAGS += -fprofile-arcs -ftest-coverage
++
+ INCLUDES = \
+ 	-I${top_srcdir}/lib \
+ 	-I$(top_srcdir)/libmisc
+--- a/debian/rules
++++ b/debian/rules
+@@ -40,6 +40,12 @@
+ endif
+ export CFLAGS
+ 
++clean:: clean_gcov
++
++clean_gcov:
++	find . -name "*.gcda" -delete
++	find . -name "*.gcno" -delete
++
+ # Add extras to the install process:
+ binary-install/login::
+ 	dh_installpam -p login
+--- a/lib/defines.h
++++ b/lib/defines.h
+@@ -174,23 +174,9 @@
+    trust the formatted time received from the unix domain (or worse,
+    UDP) socket.  -MM */
+ /* Avoid translated PAM error messages: Set LC_ALL to "C".
++ * This is disabled for coverage testing
+  * --Nekral */
+-#define SYSLOG(x)							\
+-	do {								\
+-		char *old_locale = setlocale (LC_ALL, NULL);		\
+-		char *saved_locale = NULL;				\
+-		if (NULL != old_locale) {				\
+-			saved_locale = strdup (old_locale);		\
+-		}							\
+-		if (NULL != saved_locale) {				\
+-			(void) setlocale (LC_ALL, "C");			\
+-		}							\
+-		syslog x ;						\
+-		if (NULL != saved_locale) {				\
+-			(void) setlocale (LC_ALL, saved_locale);	\
+-			free (saved_locale);				\
+-		}							\
+-	} while (false)
++#define SYSLOG(x) syslog x
+ #else				/* !ENABLE_NLS */
+ #define SYSLOG(x) syslog x
+ #endif				/* !ENABLE_NLS */

debian/patches/README.patches

@@ -0,0 +1,22 @@
+Small intro to the system for numbering the patches here...
+
+-The 00xx-... patches are forwarded to upstream's git repository
+
+-The 0xx_... series of patches are patches isolated from the latest
+ version of the shadow Debian package not using quilt in order to
+ separate upstream from Debian-specific stuff.
+
+ NO MORE PATCHES SHOULD BE ADDED IN THESE SERIES
+
+-The 4xx series are patches which have been applied to Debian's shadow
+ and have NOT been accepted and/or applied upstream. These patches MUST be kept
+ even after resynced with upstream
+
+-The 5xx series are patches which are applied to Debian's shadow
+ and will never be proposed upstream because they're too specific
+ This list SHOULD BE AS SHORT AS POSSIBLE
+
+In short, while we are working towards synchronisation with upstream,
+our goal is to make 0xx patches disappear by moving them either to 3xx
+series (things already implemented upstream) or to 4xx series
+(Debian-specific patches).

debian/patches/series

@@ -0,0 +1,23 @@
+# CVE-2023-4641
+0001-gpasswd-1-Fix-password-leak.patch
+
+# CVE-2023-29383
+0002-Added-control-character-check.patch
+0003-Overhaul-valid_field.patch
+
+# These patches are only for the testsuite:
+#900_testsuite_groupmems
+#901_testsuite_gcov
+
+008_login_log_failure_in_FTMP
+401_cppw_src.dpatch
+# 402 should be merged in 401, but should be reviewed by SE Linux experts first
+402_cppw_selinux
+429_login_FAILLOG_ENAB
+463_login_delay_obeys_to_PAM
+501_commonio_group_shadow
+502_debian_useradd_defaults
+503_shadowconfig.8
+505_useradd_recommend_adduser
+506_relaxed_usernames
+542_useradd-O_option

debian/rules

@@ -0,0 +1,82 @@
+#!/usr/bin/make -f
+# -*- mode: makefile; coding: utf-8 -*-
+
+# Enable PIE, BINDNOW, and possible future flags.
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+DPKG_EXPORT_BUILDFLAGS = 1
+include /usr/share/dpkg/buildflags.mk
+
+# Adds extra options when calling the configure script:
+DEB_CONFIGURE_EXTRA_FLAGS := --without-libcrack \
+	--mandir=/usr/share/man \
+	--with-libpam \
+	--with-yescrypt \
+	--enable-shadowgrp \
+	--enable-man \
+	--disable-account-tools-setuid \
+	--with-group-name-max-length=32 \
+	--without-acl \
+	--without-attr \
+	--without-su \
+	--without-tcb \
+	 SHELL=/bin/sh
+
+ifneq ($(filter nodoc,$(DEB_BUILD_PROFILES)),)
+DEB_CONFIGURE_EXTRA_FLAGS += --disable-man
+endif
+
+# Set the default editor for vipw/vigr
+CFLAGS += -DDEFAULT_EDITOR="\"sensible-editor\""
+
+%:
+	dh $@
+
+override_dh_auto_configure:
+	cp debian/HOME_MODE.xml man/login.defs.d/HOME_MODE.xml
+	dh_auto_configure -- $(DEB_CONFIGURE_EXTRA_FLAGS)
+
+override_dh_install-arch:
+ifneq ($(DEB_HOST_ARCH_OS),linux)
+	sed -i 's/session    optional   pam_keyinit.so/# Linux only # session    optional   pam_keyinit.so/' debian/login.pam
+endif
+	dh_install -a
+ifeq ($(DEB_HOST_ARCH_OS),hurd)
+	# /bin/login is provided by the hurd package.
+	rm -f debian/login/usr/bin/login
+endif
+
+override_dh_installpam:
+	# Distribute the pam.d files; unless for the commands with disabled PAM
+	# support
+	dh_installpam -p login
+	dh_installpam -p passwd --name=passwd
+	dh_installpam -p passwd --name=chfn
+	dh_installpam -p passwd --name=chsh
+	dh_installpam -p passwd --name=chpasswd
+	dh_installpam -p passwd --name=newusers
+
+override_dh_builddeb-arch:
+	# uidmap
+	chmod u+s debian/uidmap/usr/bin/newuidmap
+	chmod u+s debian/uidmap/usr/bin/newgidmap
+	# login
+	# No real need for login to be setuid root
+	# chmod u+s debian/login/bin/login
+	chmod u+s debian/login/usr/bin/newgrp
+	# passwd
+	chmod u+s debian/passwd/usr/bin/chfn
+	chmod u+s debian/passwd/usr/bin/chsh
+	chmod u+s debian/passwd/usr/bin/gpasswd
+	chmod u+s debian/passwd/usr/bin/passwd
+	chgrp shadow debian/passwd/usr/bin/chage
+	chgrp shadow debian/passwd/usr/bin/expiry
+	chmod g+s debian/passwd/usr/bin/chage
+	chmod g+s debian/passwd/usr/bin/expiry
+	dh_builddeb -a
+
+override_dh_auto_clean:
+	sed -i 's/# Linux only # //' debian/login.pam
+	dh_auto_clean
+
+override_dh_clean:
+	dh_clean ./man/login.defs.d/HOME_MODE.xml

debian/shadowconfig

@@ -0,0 +1,70 @@
+#!/bin/sh
+# turn shadow passwords on or off on a Debian system
+
+set -e
+
+shadowon () {
+    set -e
+
+    if [ -n "$DPKG_ROOT" ] \
+        && cmp "${DPKG_ROOT}/etc/passwd" "${DPKG_ROOT}/usr/share/base-passwd/passwd.master" 2>/dev/null \
+        && cmp "${DPKG_ROOT}/etc/group" "${DPKG_ROOT}/usr/share/base-passwd/group.master" 2>/dev/null; then
+        # If dpkg is run with --force-script-chrootless and if /etc/passwd
+        # and /etc/group are unchanged, we avoid the chroot() call by manually
+        # processing the files. This produces bit-by-bit identical results
+        # compared to the normal case as shown by the CI setup at
+        # https://salsa.debian.org/helmutg/dpkg-root-demo/-/jobs
+        for f in passwd group; do
+            cp -a "${DPKG_ROOT}/etc/$f" "${DPKG_ROOT}/etc/$f-"
+        done
+        chmod 600 "${DPKG_ROOT}/etc/passwd-"
+        sed -i 's/^\([^:]\+\):\*:/\1:x:/' "${DPKG_ROOT}/etc/group" "${DPKG_ROOT}/etc/passwd"
+        [ -n "$SOURCE_DATE_EPOCH" ] && epoch=$SOURCE_DATE_EPOCH || epoch=$(date +%s)
+        sed "s/^\([^:]\+\):.*/\1:*:$((epoch/60/60/24)):0:99999:7:::/" "${DPKG_ROOT}/etc/passwd" > "${DPKG_ROOT}/etc/shadow"
+        sed "s/^\([^:]\+\):.*/\1:*::/" "${DPKG_ROOT}/etc/group" > "${DPKG_ROOT}/etc/gshadow"
+        touch "${DPKG_ROOT}/etc/.pwd.lock"
+        chmod 600 "${DPKG_ROOT}/etc/.pwd.lock"
+    else
+        pwck -q -r
+        grpck -r
+        pwconv
+        grpconv
+    fi
+    chown root:root "${DPKG_ROOT}/etc/passwd" "${DPKG_ROOT}/etc/group"
+    chmod 644 "${DPKG_ROOT}/etc/passwd" "${DPKG_ROOT}/etc/group"
+    chown root:shadow "${DPKG_ROOT}/etc/shadow" "${DPKG_ROOT}/etc/gshadow"
+    chmod 640 "${DPKG_ROOT}/etc/shadow" "${DPKG_ROOT}/etc/gshadow"
+}
+
+shadowoff () {
+    set -e
+    pwck -q -r
+    grpck -r
+    pwunconv
+    grpunconv
+    # sometimes the passwd perms get munged
+    chown root:root /etc/passwd /etc/group
+    chmod 644 /etc/passwd /etc/group
+}
+
+case "$1" in
+    "on")
+	if shadowon ; then
+	    echo Shadow passwords are now on.
+	else
+	    echo Please correct the error and rerun \`$0 on\'
+	    exit 1
+	fi
+	;;
+    "off")
+	if shadowoff ; then
+	    echo Shadow passwords are now off.
+	else
+	    echo Please correct the error and rerun \`$0 off\'
+	    exit 1
+	fi
+	;;
+     *)
+	echo Usage: $0 on \| off
+	;;
+esac

debian/source/format

@@ -0,0 +1 @@
+3.0 (quilt)

debian/tests/control

@@ -0,0 +1,2 @@
+Tests: smoke
+Restrictions: needs-root superficial

debian/tests/smoke

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+set -e
+
+echo "Adding an user works"
+useradd shadow-test-user
+grep '^shadow-test-user:x:' /etc/passwd
+grep '^shadow-test-user:!:' /etc/shadow
+
+echo "Removing an user works"
+userdel shadow-test-user
+! grep 'shadow-test-user' /etc/passwd
+! grep 'shadow-test-user' /etc/shadow