\documentclass[letterpaper]{article}
\nonstopmode
\akai
\usepackage{linuxdoc-sgml}
\usepackage{qwertz}
\usepackage{url}
\usepackage[latin1]{inputenc}
\usepackage{t1enc}
\usepackage[english]{babel}
\usepackage{epsfig}
\usepackage{null}
\def\addbibtoc{
\addcontentsline{toc}{section}{\numberline{\mbox{}}\relax\bibname}
}%end-preamble
\setcounter{page}{1}
\title{¦p¦ó¨ú±o¡A¦w¸Ë¡A³]©w shadow ±K½X}
\author{§@ªÌ:¡@Michael H. Jackson, {\ttfamily \onlynameurl{mhjack@tscnet.com}}\\ 
                Ä¶ªÌ:¡@Sung Min-Ju, {\ttfamily \onlynameurl{songmj@ms1.hinet.net}}
                }
\date{v1.3, 3 April 1996
        Â½Ä¶¤é´Á:¡@15 MAY 2000}
\abstract{³o¥÷¤å¥ó¥D­n´y­z¦p¦ó¨ú±o¡A¦w¸Ë©M³]©w {\itshape Shadow Suite\/} ±K½X¡C¥¦¤]´y­z¨ú±o©M¦w¸Ë»Ý­n¦s¨ú¨Ï¥ÎªÌ±K½X¤§¨ä¥L³nÅé©Mºô¸ôºÊ±±µ{¦¡(network daemons)¡C³o¨Ç¨ä¥L³nÅé¤£¬O Shadow Suit ªº¯u¹ê³¡¤À¡A¦ý¬O³o¨Çµ{¦¡±N»Ý­n³Q­«·s½sÄ¶¥Î¥H¤ä´©{\itshape Shadow Suite\/} ¡C³o¥÷¤å¥ó¥ç¥]¬A¤@­Óµ{¦¡½d¨Ò¡G¹ïµ{¦¡¥[¤J shadow ¤ä´©¡C¥»¤åµ²§À³¡¤À¬°±`°Ý°ÝÃD¤Îµª®×¡C}


\begin{document}
\maketitle
\tableofcontents

\section{Â²¤¶}

³o½g¤å³¹¬° Linux Shadow-Password-HOWTO¡C  ¥D­n¬O¦b´y­z¬°¦ó¤Î¦p¦ó©ó Linux ¨t²Î¥[¤J
shadow ±K½X¤ä´©¡C ¨ä¥ç¥]¬A¦p¦ó¨Ï¥Î {\itshape Shadow Suite's\/} ¬Y¨Ç½d¨Ò¡C

·í¶i¦æ {\itshape Shadow Suite\/} ¦w¸Ë¤Î¨Ï¥Î³\¦hªº utility µ{¦¡®É¡E§A¥²¶·¥H {\itshape root\/} 
Åv­­Ã±¤J¡C ¥B¶i¦æ {\itshape Shadow Suite\/} ¦w¸Ë®É¡A¨t²Î³nÅé±N³Q§ïÅÜ¡A¦]¦¹±j¯Pªº«ØÄ³
±z·Ó»¡©úÀÉ³Æ¤Àµ{¦¡¡C¦b¦¹±j½Õ¦b±z¶}©l§@·~«e»Ý¥ý¾\Åª¤Î¤F¸Ñ©Ò¦³ªº»¡©ú®Ñ¡C




\subsection{§ó§ï¤W¤@ª©¥»³¡¤À}

\begin{verbatim}
·s¼W¡G
        ·s¼W¤@­Ó¤l¸`¡G¬°¦ó±z¤£­n¦w¸Ë shadow 
        ·s¼W¤@­Ó¤l¸`¡G­×§ï xdm µ{¦¡
        ·s¼W¤@¸`¡G¬°¦ó±z¤£­n¦w¸Ë shadow 
        ·s¼W¤@¸`¡G¦p¦ó©ó¥¼¨Ó¹B§@ Shadow Suite 
        ·s¼W¤@¸`¡G±`°Ý°ÝÃD¤Îµª®×
        

§ó¥¿/­×§ï¡G
        §ó¥¿¦b Sunsite ªº html °Ñ¦Ò¸ê®Æ
        §ó¥¿¦b wu-ftp ¸`¦b Makefile ·s¼W -lshadow
        §ó¥¿¸û¤£ÄY­««÷­µ©M±¹µü¿ù»~
        §ó§ï wu-ftp ¸`¥Î¥H¤ä´© ELF
        ­×§ï¦b¤£¦PÃ±¤J(login)µ{¦¡¦w¥þ°ÝÃD 
        ­×§ï Linux Shadow Suite «ØÄ³¬° Marek Michalkiewicz
        
\end{verbatim}





\subsection{·sª©¤å¥ó}

±z¥i§Q¥Î°Î¦WÀÉ¶i¤J¸Ó FTP ¯¸¤U¸ü³Ì·sª©¤å¥ó¡G
{\bfseries sunsite.unc.edu}
\begin{verbatim}
/pub/Linux/docs/HOWTO/Shadow-Password-HOWTO
\end{verbatim}

or:
\begin{verbatim}
/pub/Linux/docs/HOWTO/other-formats/Shadow-Password-HOWTO{-html.tar,ps,dvi}.gz
\end{verbatim}


©Î³z¹Lºô¯¸¡G
\nameurl{http://sunsite.unc.edu/mdw/linux.html}{Linux Documentation Project Web Server}¡Aºô­¶¡G
\nameurl{http://sunsite.unc.edu/linux/HOWTO/Shadow-Password-HOWTO.html}{Shadow-Password-HOWTO}
©Î»P§ÚÁpµ¸¡G {\ttfamily $<$mhjack@tscnet.com{$>$}}. ¥ç¥i³z¹L·s»D¸s²Õ±i¶K¡G
{\ttfamily comp.os.linux.answers}

³o¨Ç¤å¥ó²{¦b¤w¸g¥]©ó Shadow-YYDDMM ®M¥ó¤¤¡C




\subsection{¦^ÂÐ}

½Ð±N¥ô¦óµû»y¡B­×§ï©Î«ØÄ³±H¦Ü¡G
\onlynameurl{Michael H. Jackson $<$mhjack@tscnet.com{$>$}}  §Ú·|ºÉ§Ö¦^ÂÐ¨Ã§ó¥¿¸Ó¤å¥ó¡C
¦pªG§Aµo²{¥ô¦ó°ÝÃD¡A½Ðª½±µ email µ¹§Ú¡A§Ú·|±N¦¹³Ì·s§Þ³N±i¶K©ó·s»D¸s²Õ¡C




\section{¬°¦ó shadow §Aªº passwd ÀÉ?}

¤j³¡¤À¥Ø«e Linux µo¦æª©¥»¹w³]­È¨Ã¥¼¥]§t{\itshape Shadow Suite\/} ¦w¸Ë¡C
³o¨Çª©¥»¥]¬A Slackware 2.3, Slackware 3.0 ©M¨ä¥L¨üÅwªïªºµo¦æª©¥»¡C
¥D­n­ì¦]¤§¤@¬O¦b­ì©l{\itshape Shadow Suite\/}ª©ÅvÁn©ú¤¤¨Ã¥¼«Ü²M·¡ªº´y­z¸Ó³nÅé¬O
§_»Ý¨Ï¥ÎªÌ¥I¶O¡C Linux ¨Ï¥Î GNU ª©Åv³q±`¤¹Äò¨Ï¥ÎªÌ¥i§K¶O¥B¥ô·N¨Ï¥Î¬ÛÃö®M¥ó¡C



{\itshape Shadow Suite\/}²{¦bºûÅ@¤H­û\onlynameurl{Marek Michalkiewicz $<$marekm@i17linuxb.ists.pwr.wroc.pl{$>$}} 
¤w¸g¥i¥H±q¦b BSD ¼Ë¦¡¤¹»Ý¦A¨Ï¥Îª©Åv¤§­ì©l§@ªÌ¨º±µ¦¬­ì©l½X¡C ¥Ø«eª©Åvµo¦æ¤w
¸Ñ¨M¡A¦]¦¹¥i¥H¹w´Á¦b¥¼¨Óª©¥»¤§¹w³]­È±N¥]¬A password shadowing¡C §Y¨Ï¦p¦¹¡A
§A¤´»Ý­n¦Û¦æ¦w¸Ë¡C



¦pªG§Aªºª©¥»¬O±q CD-ROM ¦w¸Ë¡C§A¥i¯àµo²{§Y¨Ï¥Ø«eª©¥»¨Ã¥¼¦³{\itshape Shadow Suite\/} 
¦w¸Ë¡A¦ý§A¤´µM¥i¥H¦b¸Ó¤ù CD-ROM §ä¨ì§A»Ý­n¦w¸Ëªº{\itshape Shadow Suite\/}¡C



{\itshape µM¦Ó¡A©Ò¦³Shadow Suite 3.3.1, 3.3.1-2 ª©¥»©M shadow-mk ¦ñÀHÃ±¤J(login)µ{¦¡©M
¨ä¥L{\itshape suid root\/}µ{¦¡§¡¦³¦w¥þ¤W°ÝÃD¡A¦]¦¹¤£À³¸Ó¨Ï¥Î¤Ó¤[¡C\/}



©Ò¦³¥²­nÀÉ®×§¡¥i¥H³z¹L°Î¦W FTP ¯¸©Îºô¯¸§ä¨ì¡C

¦b¨S¦³¦w¸Ë{\itshape Shadow Suite\/}ªº Linux ¨t²Î¡A¥]¬A±K½Xªº±b¸¹¨Ï¥ÎªÌ¸ê°T³q±`Àx¦s¦b 
{\ttfamily /etc/passwd} ÀÉ¡C
Àx¦sªº±K½X¬° {\itshape ¥[±K(encrypted)\/}®æ¦¡¡C  µM¦Ó¡A¦pªG§A°Ý¤@­Ó±K½X±M®a¡A¥L/¦o±N
§i¶D§A¯u¥¿ªº±K½XÀÉ¥u¬O{\itshape ½s½X(encoded)\/}¦Ó¤£¬O{\itshape ¥[±K\/}®æ¦¡¡A¦]¬°·í¨Ï¥Î 
crypt(3) ®É¡A¤å¦rÀÉ­¿³]¬° null ¥B±K½X¬OÁä­È(key)¡C ¦]¦¹¡A±µ¤U¨Ó§Ú±N¦b³o½g¤å¥ó¤¤¨Ï¥Î
{\itshape ½s½X\/}¡C



¨Ï¥Î¦b±K½XÄæ¦ì½s½Xªººtºâªk©ó§Þ³N¤W¬O¨Ï¥Î{\itshape one way hash function\/}¡C³o¬O¤@­Ó
¦b³æ¤@¤è¦V­pºâÂ²³æ¦ý°f¦V­pºâ«D±`§xÃøªººtºâªk¡CÃö©ó³o¥¿½Tªººtºâªk¥i¥H¦b 2.4 ¸`©Î
©ó crypt(3) ¾Þ§@¤â¥U§ä¨ì¡C



·í¨Ï¥ÎªÌ¬D¿ï©Î«ü©w¤@­Ó±K½X¡A¨t²Î±NÀH¾÷²£¥Í¤@­Ó­È¡A¥s°µ{\itshape salt\/}¡A±N±K½X¶i¦æ
½s½X¡C ³oªí¥Ü¥ô¦ó¯S©wªº±K½X¥i¥H 4096 ¤¤¤£¦P¤èªkÀx¦s¡C {\itshape salt\/} ­È±NÀx¦s³Q½s
½Xªº±K½X ¡C

·í¨Ï¥ÎªÌÃ±¤J©Î´£¨Ñ¤@­Ó±K½X¡A {\itshape salt\/} ­º¥ý±µ¦¬±ýÀx¦s½s½X±K½X¡CµM«á³o´£¨Ñ±K½X
·|©M {\itshape salt\/} ­È¤@°_{\itshape ½s½X\/}¡A¥B¤ñ¸û¤w¸g{\itshape ½s½X\/}±K½X¡C¦pªG¦³ match
¡A¸Ó¨Ï¥ÎªÌ³q¹LÅv­­ÀË¬d¡C 



ÀH¾÷{\itshape ½s½X\/}©M´_­ì­ì©l±K½X¬O¦³­pºâ½ÆÂø«×ªº(¦ý¤£¬O¤£¥i¯àªº)¡CµM¦Ó¡A¦b¬Y¨Ç¨t²Î
«Ü¦h¨Ï¥ÎªÌªº±K½X³£³]¬°¤@¯ë¤å¦r(©Î¬O¤@¯ë¤å¦rªºÂ²³æÅÜ¤Æ)



¨t²ÎÀb«Èª¾¹D³o¥ó¨Æ¡A¥B±NÂ²³æªº¥[±K¤å¦r©M¤@¯ë¨Ï¥Î4096 {\itshape salt\/} ­È±K½X¤§¥Ø¿ý¡CµM
«á¥L­Ì±N¤ñ¸û¦b¸ê®Æ®w¤§ {\ttfamily /etc/passwd} ÀÉ¤§½s½X±K½X¡A¥u­n¥L­Ì§ä¨ì¤@­Ó¤ñ¹ï¡A¥L­Ì
¥i¥H§ä¨ì¤@­Ó±b¸¹¤§±K½X¡C³o©M{\itshape dictionary attack\/}¦³Ãö¡A¥B¥Î©ó¥¼¸g³\¥i¦s¨ú¨t²Î¨ú
±o©M®i¶}±`¥Îªº¤èªk¤§¤@¡C



¦pªG§A·Q¹L¤@­Ó 8 ½Xªº±K½X½s½X¦¨ 4096 * 13 ½Xªº¦r¦ê¡A¨º»ò¤@­Ó¥Î¦b´y­z 400,000 ¤@¯ë¤å¦r
¡B¦W¦r¡B±K½X©MÂ²³æÅÜ¤Æªº¦r¨å±N»Ý­n 4GB µwºÐ¦s¨úªÅ¶¡¡C  Àb«È»Ý­n°µªº¥u¬O¤ÀÃþ¦r¦ê¸òÀË¬d
¤ñ¹ïµ²ªG¡C  ¦Û±q 4GB µwºÐ¥i¥H¥H¬üª÷ 1000.00 ¥H¤U¶R¨ì«á¡A¹ï¤j¦h¼Æ¨t²ÎÀb«Èªº·N¸q¥i·Q¦Ó
ª¾ ¡C

¦pªGÀb«È­º¥ýµo²{§Aªº {\ttfamily /etc/passwd} ÀÉ¡A¥L­Ì¥u»Ý­n±N¯u¥¿¥]§t¦b 
{\ttfamily /etc/passwd} ÀÉ {\ttfamily salt} ­Èªº¦r¨å½s½X¡A³o¤èªk¥i¥Ñ¾Ö¦³486¯Å¹q¸£©Î´X­Ó¦³
´X¦Ê MB µwºÐªÅ¶¡ªº¤Q¨Ó·³ªº¤p«Ä¾A¥Î¡C



§Y¨Ï¨S¦³«Ü¤jªººÏºÐªÅ¶¡¡A¹³ crack(1) ªº¤u¨ãµ{¦¡³q±`¥i¥H¦b¨¬°÷¨Ï¥ÎªÌ¨t²Î¤¤¦Ü¤Ö¯}¸Ñ¤@¹ï
±K½X¡]°²³]¨t²Î¨Ï¥ÎªÌ­¿¤¹³\¬D¿ï¥L­Ì·Q­nªº±K½X¡^¡C



{\ttfamily /etc/passwd} ÀÉ¤]¥]¬A¤@¨Ç¬ÛÃö¸ê°T¡A¹³¨Ï¥ÎªÌ ID¡@©M¸s²Õ ID©Ò¨Ï¥Îªº¨t²Îµ{¦¡¡F¦]¦¹
{\ttfamily /etc/passwd} ÀÉ {\itshape ¥²¶·\/} «O«ù¥þ¥@¬É¥iÅª©Ê.  ¦pªG§A§ïÅÜ {\ttfamily /etc/passwd} 
ÀÉ¥H­P©ó¨S¦³¤H¥i¥HÅª¨ú¡A§A±Nµo²{ªº²Ä¤@¥ó¨Æ¬O {\ttfamily ls -l} ©R¥O±N¨ú¥N¦WºÙ¦ÓÅã¥Ü¨Ï¥ÎªÌ ID
¡C

{\itshape Shadow Suite\/} ³z¹L±N±K½X¦s¦Ü¥t¤@­ÓÀÉ¡]³q±`¬O {\ttfamily /etc/shadow} ÀÉ¡^¨Ó¸Ñ¨M¸Ó
°ÝÃD¡C {\ttfamily /etc/shadow} ÀÉ¹ï¥ô¦ó¤H³]©w¥iÅªÀÉ¡A¥u¦³ {\itshape root\/} Åv­­¥i¥HÅª¼g
{\ttfamily /etc/shadow} ÀÉ¡C¬Y¨Çµ{¦¡¡]¹³ xlock¡^¤£»Ý­n§ïÅÜ±K½X¡A¥u»Ý­n½T»{±K½X§Y¥i¡C³o¨Çµ{¦¡
¥i¥H¥H {\itshape suid root\/} °õ¦æ©ÎªÌ§A¥i¥H³]©w¤@­Ó¸s²Õ {\itshape shadow\/} ¥Î¨Ó°ßÅª 
{\ttfamily /etc/shadow} ÀÉ¡AµM«á³o¨Çµ{¦¡¥i¥H°õ¦æ {\itshape sgid¡@shadow\/}¡C

³z¹L²¾°Ê±K½X¦Ü {\ttfamily /etc/shadow} ÀÉ¡A§Ú­Ì¥i¥H¦³¤Oªº³Æ¦³Àb«È±q¦s¨ú½s½X±K½X¨ì°õ¦æ
{\itshape dictionary attack\/} ªºÃÒ¾Ú¡C

°£¦¹¤§¥~¡A {\itshape Shadow Suite\/} ·s¼W³\¦h¯S¦â¡G
\begin{itemize}
\item ³]©wÀÉ©ó³]©w¬°Ã±¤J®É¹w³]({\ttfamily /etc/login.defs})
\item ·s¼W¡B­×§ï©M§R°£¨Ï¥ÎªÌ±b¸¹¸s²Õ¤§¤u¨ãµ{¦¡
\item ±K½X¹Ø©R­pºâ¤Î¨ì´Á¤é
\item ±b¸¹¨ì´Á¤é¸òÂê¦º
\item ÁôÂÃ¸s²Õ±K½X (¥i¿ï¾Üªº)
\item ¨â­¿ªø«×±K½X (16 ¦r¤¸±K½X) {[}¤£«ØÄ³¨Ï¥Î{]}
\item °w¹ï¨Ï¥ÎªÌ±K½X¿ï¾Ü¦³¸û¦nªº±±¨î
\item ¥i¼·±µ±K½X
\item ³Æ¥Î¦³®ÄÅv­­µ{¦¡ {[}¤£«ØÄ³¨Ï¥Î{]}
\end{itemize}


¦w¸Ë {\itshape Shadow Suite\/} °^Äm¬°¦³§ó¦w¥þ¨t²Î¡A¦ý¬OÁÙ¦³¨ä¥L¤èªk¥i¥H§ïµ½ Linux ¨t²Îªº¦w¥þ
¡A¥B³Ì²×±N¦³¤@¨t¦Cªº Linux ¦w¥þ HOWTO's ±N°Q½×¨ä¥L¦w¥þ°ò·Ç©M¬ÛÃö¤å¥óª©¥»¡E



°w¹ï¥Ø«e¨ä¥L Linux ¦w¥þ¤å¥ó¸ê°T¡A½Ð°Ñ·Óºô§}¡G\nameurl{http://bach.cis.temple.edu/linux/linux-security/}{Linux Security home page.}






\subsection{¬°¦ó±z¤£­n shadow §Aªº passwd ÀÉ}

¦³¤@¨Çª¬ªp¸ò³]©w¹B¥Î¦b¦w¸Ë {\itshape Shadow Suite\/} ±N {\itshape ¤£¬O\/} ¦n¥D·N¡G¡@ 
There are a few circumstances and configurations in which installing the
{\itshape Shadow Suite\/} would {\itshape NOT\/} be a good idea:
\begin{itemize}
\item ¥D¾÷¨S¦³¥]§t¨Ï¥ÎªÌ±b¸¹¡C
\item ¥D¾÷¬O¦b LAN ¤W¶]¥B¨Ï¥Îºô¸ô¸ê°TªA°È(Network Information
Services, NIS)±o¨ì©Î¨ÑÀ³¨Ï¥ÎªÌ¦WºÙ©M±Kµ¹ºô¸ô¤Wªº¨ä¥L¾÷¾¹¨Ï¥Î(¨Æ¹ê¤W³oÁÙ¬O
¥i¥H°õ¦æ¡A¦ý¬O¹ê»Ú¤W¨Ã¤£¯à¼W¥[¥ô¦ó¦w¥þ)¡C
\item ¾÷¾¹¬O¨Ï¥Î²×ºÝ¥D¾÷¨ÓÅçÃÒ¨Ï¥ÎªÌ¸g¥Ñ NFS(Network File System), NIS ©Î
¬Y¨Ç¨ä¥L¤èªk¡C
\item ¾÷¾¹¶]¨ä¥L³nÅéÅçÃÒ¨Ï¥ÎªÌ¥B¨S¦³¥ô¦ó shadow ª©¥»©Î­ì©l½X¥iÀò±o¡C
\end{itemize}







\subsection{®æ¦¡¤Æ /etc/passwd ÀÉ}

¤@­Ó non-shadowed {\ttfamily /etc/passwd} ÀÉ®æ¦¡¦p¤U©Ò¥Ü¡G
\begin{tscreen}
\begin{verbatim}
username:passwd:UID:GID:full_name:directory:shell
\end{verbatim}
\end{tscreen}

¨ä¤¤
\begin{description}
\item[{\ttfamily username}] \mbox{}

¨Ï¥ÎªÌ(Ã±¤J)¦WºÙ

\item[{\ttfamily passwd}] \mbox{}

½s½X±K½X

\item[{\ttfamily UID}] \mbox{}

¨Ï¥ÎªÌ½s¸¹

\item[{\ttfamily GID}] \mbox{}

¹w³]¦s²Õ½s¸¹

\item[{\ttfamily full\_name}] \mbox{}

¨Ï¥ÎªÌ¥þ¦W - ¨Æ¹ê¤W³o­ÓÄæ¦ìºÙ§@ GECOS (General 
Electric Comprehensive Operating System) Äæ¦ì¥B¥i¥HÀx¦s¥þ¦W¥~ªº¸ê°T¡CShadow
commands and manual pages refer to this field as the comment field.

\item[{\ttfamily directory}] \mbox{}

¨Ï¥ÎªÌ®Ú¥Ø¿ý (µ´¹ï¸ô®|)

\item[{\ttfamily shell}] \mbox{}

¨Ï¥ÎªÌÃ±¤JªºÀô¹Ò (µ´¹ï¸ô®|)

\end{description}

Á|¨Ò»¡©ú¡G
\begin{tscreen}
\begin{verbatim}
username:Npge08pfz4wuk:503:100:Full Name:/home/username:/bin/sh
\end{verbatim}
\end{tscreen}
¡@¤¤¡A{\ttfamily Np} ¬O salt ¥B {\ttfamily ge08pfz4wuk} ¬O{\itshape ½s½X\/}±K½X¡C  
¤w½s½Xªº salt/password ´N¹³ {\ttfamily kbeMVnZM0oL7I} ¥B³o¨â­Ó¦r¦ê¬O¤@¼Ëªº±K½X¡C¹ï¬Û¦P
±K½X¥i¯à¦³ 4096 ºØ¥i¯àªº½s½X¡C(¥»½d¨Òªº±K½X¬O "passwaor"¡A³o¬O¤ñ¸û {\itshape ¤£¦n\/} ªº±K½X)¡C



¥u­n shadow suite ¤w¸g¦w¸Ë¡A {\ttfamily /etc/passwd} ÀÉ±N³Q´À¥N¦¨¡G
\begin{tscreen}
\begin{verbatim}
username:x:503:100:Full Name:/home/username:/bin/sh
\end{verbatim}
\end{tscreen}

¥»½d¨Ò¤§²Ä¤GÄæ¦ì {\ttfamily x} ²{¦b¥u¬O¤@­Ó¡@place holder¡C¡@{\ttfamily /etc/passwd}ÀÉªº®æ¦¡
¨Ã¥¼¯uªº§ïÅÜ¡A¥u¬O¤£¦A¥]§t {\itshape ½s½X\/}±K½X¡C³oªí¥Ü¥ô¦óµ{¦¡¥i¥HÅª¨ú {\ttfamily /etc/passwd}
ÀÉ¡A¦ý¨Ã¤£¯uªº»Ý­n½T»{±K½X¬O¤£¬O¥¿½T¦a¹B§@¡C



³o¨Ç±K½X²{¦b³Q­«·s©ñ¦b shadow ÀÉ(³q±`¬O¦b {\ttfamily /etc/shadow} ÀÉ)¡C




\subsection{®æ¦¡¤Æ shadow ÀÉ}

{\ttfamily /etc/shadow} ÀÉ¥]¬A¤U¦C¸ê°T¡G
\begin{tscreen}
\begin{verbatim}
username:passwd:last:may:must:warn:expire:disable:reserved
\end{verbatim}
\end{tscreen}

¨ä¤¤
\begin{description}
\item[{\ttfamily username}] \mbox{}

¨Ï¥ÎªÌ¦WºÙ

\item[{\ttfamily passwd}] \mbox{}

½s½X±K½X

\item[{\ttfamily last}] \mbox{}

±K½X¤W¦¸§ó°Ê¤é´Á¡A¥H±q1970¦~1¤ë1¤éºâ°_ªº¤Ñ¼Æ¥Nªí

\item[{\ttfamily may}] \mbox{}

±K½X§ïÅÜ«e¤Ñ¼Æ

\item[{\ttfamily must}] \mbox{}

±K½X³Ì±`¨Ï¥Î¤Ñ¼Æ

\item[{\ttfamily warn}] \mbox{}

¥Nªí´Á­­«e´X¤Ñ´N¨Æ¥ýÄµ§i¨Ï¥ÎªÌ

\item[{\ttfamily expire}] \mbox{}

¶W¹L±K½X¹L´Á¤Ñ¼Æ«á¡A´NÃö³¬¸Ó±b¸¹

\item[{\ttfamily disable}] \mbox{}

±b¸¹Ãö³¬¡A¥H±q1970¦~1¤ë1¤éºâ°_ªº¤Ñ¼Æ¥Nªí

\item[{\ttfamily reserved}] \mbox{}

¹w³ÆÄæ¦ì

\end{description}

¨Ì·Ó¤§«e½d¨Ò±NÅÜ¦¨¡G
\begin{tscreen}
\begin{verbatim}
username:Npge08pfz4wuk:9479:0:10000::::
\end{verbatim}
\end{tscreen}





\subsection{¦^ÅU crypt(3).}

±q crypt(3) ¨Ï¥ÎªÌ¤å¥ó±o¨ì¡G

{\tt\char`\"}{\itshape crypt\/} ¬O±K½X¥[±K¤èµ{¦¡¡C
It is based on the {\itshape Data Encryption Standard\/} algorithm with variations
intended (among other things) to discourage use of hardware implementations of
a key search.

{[}The] key ¬O¨Ï¥ÎªÌ¿é¤Jªº±K½X¡C  {[}½s½X¦r¦ê¥þ¬O NULLs]

{[}The] {\itshape salt\/} ¬O±q {[}a-zA-Z0-9./] ¶°¦X¤¤¿ï¥Xªº¨â­Ó¦ì¤¸¦r¦ê¡C
¸Ó¦r¦ê¬O¥Î©óÂZ¶Ã¦b 4096 ºØ¤£¦P¤èªk¤§¤@­Óºtºâªk¡C

³z¹L±o¨ì key ªº¨C­Ó¦ì¤¸ªº³Ì§C 7 bit{[}s]¡A¥i¥H«Ø¥ß 56-bit key ¡C ³o56-bit key
¬O¥Î¦b­«½Æ¥[±K¤@­Ó±`¼Æ¦r¦ê(³q±`¬O¥]§t©Ò¦³ÆFªº¦r¦ê)¡C ¶Ç¦^­È«ü¨ì¥[±K±K½X¬O¤@³s¦ê
¥i¦L¥X¤§13­Ó ASCII ¦r¤¸(³Ì«e­±ªº¤@¨â­Ó¦r¤¸ªí¥Ü salt ¥»¨­)¡C ³z¹L¨C¦¸ªº©I¥s¥i±N
¶Ç¦^ª½«ü¨ìÀRºA¸ê®Æ¡C



 
{\bfseries Äµ§i°T®§¡G} Key space ¥]¬A 2**56 §Yµ¥©ó 7.2e16 ¥i¯àªº­È¡C»P¥Î­«¤jªº¥­¦æ¹q¸£
±N Key space ·¥ºÉªº·j´M{\bfseries ¬O¥i¯à}¡C¹³ {\ttfamily crack(1)} ³nÅé¥Î¨Ó·j´M³¡¤Àªº¥Ñ¤H
²£¥Í¤§±K½Xªº key space ¬O¥iÀò±oªº¡C¦]¦¹¡A±K½Xªº¿ï¾Ü¦Ü¤ÖÀ³¸ÓÁ×§K¨Ï¥Î¤@¯ë¦r¤Î¦W¦r¡C
¤@­Ó¥Î¨ÓÀË¬d¸Ñ¶}±K½X¿ï¾Üªº {\ttfamily passwd(1)} µ{¦¡¨Ï¥Î¬O­È±o±ÀÂËªº¡C



DES ºtºâªk¥»¨­¦³¤@¨Ç¨Ï {\ttfamily crypt(3)} ¦b¥ô¦ó¨ä¥L±K½XÅv­­°Ï¹j¤¶­±«Ü®t¿ï¾Üªº¨Ï¥Î
¤è­±¼@ÅÜ¡C¦pªG§A­pµe¨Ï¥Î {\ttfamily crypt(3)} ¤¶­±¨Ó¥[±K­pµe¡A¥H¤U´y­z¤d¸U§O³o»ò§@¡G
±o­n¤@¥»¥[±K¦n®Ñ©M¼sªxÀò±o DES µ{¦¡®w .{\tt\char`\"} ¤@°_¨Ï¥Î¡C

¤j¦h {\itshape Shadow Suites\/} ¥]¬A 16 ¦ì¤¸ªº±K½Xªø«×¨â­¿¤§­ì©l½X¡C ¦b {\ttfamily des} ±M
®a«ØÄ³Á×§K¨Ï¥Î·í¶}©l¹ï¸û±`±K½X¥ýÂ²³æªº½s½X¥ª¥bµM«á¥k¥b¡C¥Ñ©ó {\ttfamily crypt} ¹B§@¤èªk
¡A³o±N³y¦¨ {\itshape ¸û®tªº\/} ¦w¥þ½s½X±K½X¡C°£¦¹¤§¥~¡A¨Ï¥ÎªÌ¦³¥i¯à°O¦í 16 ¦ì¤¸±K½X¬O
¤@¥ó¤ñ¸û®tªº¨Æ±¡¡C



¥Ø«e¦³¤¹³\Åv­­²z½×¥Î¥H¨ú¥N¬Y¨Ç§ó¦w¥þ©M¤ä´©¸ûªø±K½X(¨Ò¦p MD5 ºtºâªk)¥B«O¦³©M
{\ttfamily crypt} ¤èªk¬Û®eªºµo®i¤u§@¥¿¦b¶i¦æ¡C



¦pªG§A¥¿¦b´M§ä¤@¥»¥[±Kªº¦n®Ñ¡A«ØÄ³¦p¤U¡G
\begin{verbatim}
        "Applied Cryptography: Protocols, Algorithms, and Source Code in C"
        by Bruce Schneier <schneier@chinet.com>
        ISBN: 0-471-59756-2
\end{verbatim}







\section{¨ú±o Shadow Suite.}


\subsection{Shadow Suite for Linux ªº¾ú¥v(¼È¤£Â½Ä¶)}


\subsection{History of the Shadow Suite for Linux}

{\itshape DO NOT USE THE PACKAGES IN THIS SECTION, THEY HAVE SECURITY PROBLEMS\/}

The original {\itshape Shadow Suite\/} was written by {\ttfamily John F. Haugh II}.

There are several versions that have been used on Linux systems:
\begin{itemize}
\item {\ttfamily shadow-3.3.1} is the original.
\item {\ttfamily shadow-3.3.1-2} is Linux specific patch made by
\onlynameurl{Florian La Roche $<$flla@stud.uni-sb.de{$>$}} and contains some further
enhancements.
\item {\ttfamily shadow-mk} was specifically packaged for Linux.
\end{itemize}


The {\ttfamily shadow-mk} package contains the {\ttfamily shadow-3.3.1} package
distributed by {\ttfamily John F. Haugh II} with the {\ttfamily shadow-3.3.1-2 patch} 
installed, a few fixes made by \onlynameurl{Mohan Kokal $<$magnus@texas.net{$>$}}
that make installation a lot easier, a patch by {\ttfamily Joseph R.M. Zbiciak}
for {\ttfamily login1.c} (login.secure) that eliminates the -f, -h security
holes in /bin/login, and some other miscellaneous patches.

The {\ttfamily shadow.mk} package was the {\itshape previously\/} recommended
package, but should be replaced due to a {\itshape security problem\/} with the
{\ttfamily login} program.

There are {\itshape security problems\/} with Shadow versions 3.3.1, 3.3.1-2, 
and shadow-mk involving the {\ttfamily login} program.  This {\ttfamily login} bug 
involves not checking the length of a login name.  This causes the buffer to
overflow causing crashes or worse.  It has been rumored that this buffer
overflow can allow someone with an account on the system to use this bug and
the shared libraries to gain {\itshape root\/} access.  I won't discuss exactly 
how this is possible because there are a lot of Linux systems that are 
affected, but systems with these {\itshape Shadow Suites\/} installed, and 
most pre-ELF distributions {\itshape without\/} the {\itshape Shadow Suite\/} 
are vulnerable!

For more information on this and other Linux security issues, see the \nameurl{http://bach.cis.temple.edu/linux/linux-security/Linux-Security-FAQ/Linux-telnetd.html}{Linux Security home page (Shared Libraries and login Program Vulnerability)}






\subsection{¦p¦ó¨ú±o Shadow Suite¡H}

¥Ø«e«ØÄ³ {\itshape Shadow Suite\/} ª©¥»¥Ø«eÁÙ¬O BETA ´ú¸Õª©¡AµM«á¡A³Ìªñª©¥»¦b¥Í²£Àô¹Ò
¬O¦w¥þªº¥B¨S¦³¥]§t©ö¨ü§ðÀ»ªº {\ttfamily Ã±¤J(login)} µ{¦¡¡C

¸Ó®M¥ó(package)¨Ï¥ÎºD¨Ò©R¦W¬°¡G
\begin{tscreen}
\begin{verbatim}
shadow-YYMMDD.tar.gz
\end{verbatim}
\end{tscreen}

¨ä¤¤ {\ttfamily YYMMDD} ¬OSuite ªºµo¦æ¤é´Á¡C

¥Ø«e BETA ´ú¸Õª©¥»¬O {\itshape Version 3.3.3\/} ¡A¥B¥Ñ\onlynameurl{Marek Michalkiewicz  $<$marekm@i17linuxb.ists.pwr.wroc.pl{$>$}} ºûÅ@¡C

ÁÙ¥i¥H±q¸Ó³B±o¨ì¡G
\nameurl{ftp://i17linuxb.ists.pwr.wroc.pl/pub/linux/shadow/shadow-current.tar.gz}{shadow-current.tar.gz}.

¤U¦Cºô¯¸¤]¥i¥H§ä¨ì¬ÛÃö¸ê°T¡G
\begin{itemize}
\item \onlynameurl{ftp://ftp.icm.edu.pl/pub/Linux/shadow/shadow-current.tar.gz}
\item \onlynameurl{ftp://iguana.hut.fi/pub/linux/shadow/shadow-current.tar.gz}
\item \onlynameurl{ftp://ftp.cin.net/usr/ggallag/shadow/shadow-current.tar.gz}
\item \onlynameurl{ftp://ftp.netural.com/pub/linux/shadow/shadow-current.tar.gz}
\end{itemize}


§AÀ³¸Ó¥i¥HÀò±o¥Ø«e³Ì·sªºª©¥»¡C

§AÀ³¸Ó¤£­n¬O¥Î¤ñ {\ttfamily shadow-960129} {\itshape §óÂÂ\/}ª©¥»¡A¦]¬°¥¦­Ì¦³ {\ttfamily Ã±¤J} 
ªº¦w¥þ°ÝÃD¡C





©ó°Ñ¦Ò¸ê®Æ¤è­±¡A§Ú¥Î {\ttfamily shadow-960129} ÀÉ¶i¦æ¦w¸Ë¤¶²Ð¡C

¦pªG§A¤§«e¨Ï¥Î {\ttfamily shadow-mk} ¡A§AÀ³¸Ó§ó«H³o­Óª©¥»¥B­««Ø½sÄ¶¡C




\subsection{Shadow Suite¥]§t¤°»ò¡H}

{\itshape Shadow Suite\/} ¥]¬A¹ï¤U¦C¥\¯à¤§´À¥Nµ{¦¡¡G

{\ttfamily su, login, passwd, newgrp, chfn, chsh, and id}

¸Ó®M¥óÁÙ¥]¬A·sµ{¦¡¡G

{\ttfamily chage, newusers, dpasswd, gpasswd, useradd, userdel, usermod, groupadd,
groupdel, groupmod, groups, pwck, grpck, lastlog, pwconv, and pwunconv}

°£¦¹¤§¥~¡A¨ç¦¡®w¡G {\ttfamily libshadow.a} ¤]¥]¬A»Ý­n¦s¨ú¨Ï¥ÎªÌ±K½X¤§¼g©M½sÄ¶µ{¦¡¡C

µ{¦¡¤§¾Þ§@¤â¥U¤]¥]§t¦b¨ä¤¤¡C



¤]¦³¹ïÃ±¤Jµ{¦¡ªº configuration file ¡A¥¦±N³Q¦w¸Ë¦b {\ttfamily /etc/login.defs} ÀÉ¡C




\section{½sÄ¶µ{¦¡}


\subsection{¸ÑÀ£ÁY}

¦b±µ¦¬®M¥ó«á²Ä¤@­Ó¨BÆJ´N¬O unpacking¡C¸Ó®M¥ó¬O tar ÀÉ®×®æ¦¡¨Ï¥Î gzip À£ÁY
¡A©Ò¥H­º¥ý±N¸ÓÀÉ®×²¾¨ì {\ttfamily /usr/src} ¡AµM«á¿é¤J¡G
\begin{tscreen}
\begin{verbatim}
tar -xzvf shadow-current.tar.gz
\end{verbatim}
\end{tscreen}


³o±N·| unpack ¨ì¤@­Ó¥Ø¿ý¡G{\ttfamily /usr/src/shadow-YYMMDD}




\subsection{³]©w config.h ÀÉ}

²Ä¤@¥ó¨Æ¬O§A»Ý­n½Æ»s {\ttfamily Makefile} ©M {\ttfamily config.h} ÀÉ¡G

\begin{tscreen}
\begin{verbatim}
cd /usr/src/shadow-YYMMDD
cp Makefile.linux Makefile
cp config.h.linux config.h
\end{verbatim}
\end{tscreen}




µM«á§AÀ³¸Ó¯d·N {\ttfamily config.h} ÀÉ¡C ¸ÓÀÉ®×¥]¬A¬Y¨Ç³]©w¿ï¶µªº©w¸q¡C¦pªG§A¨Ï¥Î
{\itshape «ØÄ³\/} ®M¥ó¡A§Ú«ØÄ³§A¦b²Ä¤@¦¸³]©wÃö±¼ group shadow support¡C 

shadowed group passwords ¹w³]­È¬O¶}±Òªº¡C ¦b {\ttfamily config.h} ÀÉÃö¨ì³o­Ó³]©w¡A
¥B§ïÅÜ {\ttfamily \#define SHADOWGRP} ÅÜ¦¨ {\ttfamily \#undef SHADOWGRP}¡C§Ú«ØÄ³±z¤@¶}©l
Ãö±¼¥¦­Ì¡AµM«á¦pªG§A¯uªº»Ý­n group passwords ©M group administrators ®É§A¦b
¶}±Ò¥¦­Ì©M­«·s½sÄ¶¡C ¦pªG§A¶}±Ò¥¦¡A §A {\itshape ¥²¶·\/} «Ø¥ß  {\ttfamily /etc/gshadow} ÀÉ¡C



¶}±Òªø±K½Xªº¿ï¶µ¤]¤£«ØÄ³¨Ï¥Î¡C

{\itshape ¤£­n\/} §ïÅÜ {\ttfamily \#undef AUTOSHADOW} ªº³]©w¡C

{\ttfamily AUTOSHADOW} ¿ï¶µªì©l³]­p¬O¥Î¥HÅý shadow  ¥i¥H¹³ function ¤@¼Ë°õ¦æ¡C²z½×¤W
Å¥°_¨Ó¤£¿ù¡A¦ý¬O¨S¿ìªk¥¿½Tªº¹B§@¡C ¦pªG§A¶}±Ò³o­Ó¿ï¶µ¡A¥B³o­Óµ{¦¡¥H root Åv­­¦b°õ
¦æ¡A ¥¦·|¹³ root Åv­­°õ¦æ¤@¶µ©I¥s {\ttfamily getpwnam()} ¡AµM«áÅÜ§ó
{\ttfamily /etc/passwd} ÀÉ (¦³{\itshape no-longer-shadowed ±K½X\/})¡C ³oÃþµ{¦¡¥]¬A chfn 
©M chsh¡C(¦pªG root ¦b©I¥s {\ttfamily getpwnam()} ¤§«e¨Ï¥Î chfn ©M chsh¡A¨Ï¥ÎªÌ±b¸¹±N
¨S¦³¿ìªk¯u¹ê¥B¦³®Ä¥æ©ö¡C)



¦pªG§A­n«Ø¥ß libc¡A¦P¼ËªºÄµ§i¤]¦³®Ä¡A¥¦¦³­Ó {\ttfamily SHADOW\_COMPAT} §@¬Û¦Pªº¨Æ¡C ¥¦
{\itshape ¤£À³¸Ó\/}³Q¨Ï¥Î¡I¦pªG§A¶}©l±q§Aªº {\ttfamily /etc/passwd} ÀÉÂ^¨ú½s½X±K½X¡A
³o·|¬O­Ó°ÝÃD¡C

¦pªG§A¥¿¨Ï¥Î¤ñ 4.6.27 ÁÙ°ªªº {\ttfamily libc} ª©¥»¡A§A±N»Ý­n¦b {\ttfamily config.h} ©M
{\ttfamily Makefile}¨â­ÓÀÉ°µ«Ü¦h§ïÅÜ¡C
¦b {\ttfamily config.h} ÀÉªº½s¿è©M§ïÅÜ¡G
±q¡G
\begin{tscreen}
\begin{verbatim}
#define HAVE_BASENAME
\end{verbatim}
\end{tscreen}

¨ì¡G
\begin{tscreen}
\begin{verbatim}
#undef HAVE_BASENAME
\end{verbatim}
\end{tscreen}

µM«á¦b {\ttfamily Makefile} ÀÉªº§ïÅÜ¡G

\begin{tscreen}
\begin{verbatim}
SOBJS = smain.o env.o entry.o susetup.o shell.o \
        sub.o mail.o motd.o sulog.o age.o tz.o hushed.o

SSRCS = smain.c env.c entry.c setup.c shell.c \
        pwent.c sub.c mail.c motd.c sulog.c shadow.c age.c pwpack.c rad64.c \
        tz.c hushed.c
\end{verbatim}
\end{tscreen}

\begin{tscreen}
\begin{verbatim}
SOBJS = smain.o env.o entry.o susetup.o shell.o \
        sub.o mail.o motd.o sulog.o age.o tz.o hushed.o basename.o

SSRCS = smain.c env.c entry.c setup.c shell.c \
        pwent.c sub.c mail.c motd.c sulog.c shadow.c age.c pwpack.c rad64.c \
        tz.c hushed.c basename.c
\end{verbatim}
\end{tscreen}

³o¨Ç¥]§t¦b {\ttfamily basename.c} µ{¦¡½Xªº§ïÅÜ§¡»Ý­¿¥]¬A¦b {\ttfamily libc 4.6.27} ¤º¡C






\subsection{³Æ¥÷­ì©lµ{¦¡}

¦b shadow suite ­n§ó·s®É¡A»s§@µ{¦¡³Æ¥÷±N¬O¤@­Ó«Ü¦nªºÂI¤l¡C¦b Slackware 3.0 ¨t²Î¤¤¡A
³o¨ÇÀÉ®×¬O¡G

\begin{itemize}
\item /bin/su
\item /bin/login
\item /usr/bin/passwd
\item /usr/bin/newgrp
\item /usr/bin/chfn
\item /usr/bin/chsh
\item /usr/bin/id
\end{itemize}


³o BETA ®M¥ó¤w¸g¦³­Ó {\itshape Àx¦s\/} ¦b Makefile ªº¥ØªºÀÉ¡A¦ý¬O
¦]¬°¤£¦Pªºª©¥»³q±`±Nµ{¦¡©ñ¦b¤£¦Pªº¦a¤è¡A¦]¦¹±`³Q¤Hµû½×¡C

§AÀ³¸Ó³Æ¥÷§Aªº {\ttfamily /etc/passwd} ÀÉ¡A¦ý¬O§A­n«Ü¤p¤ß¦a©R¦W¡A¤£µM¦p§Ú§A±N¥¦©ñ¦b
¬Û¦P¥Ø¿ý¡A§A±NµLªk­«¼g {\ttfamily passwd} ©R¥O¡C




\subsection{°õ¦æ make}

{\itshape §A»Ý­n¥H root Åv­­Ã±¤J¥H°õ¦æ¦w¸Ëµ{§Ç\/}.

°õ¦æ make ¨Ó½sÄ¶®M¥ó¤¤ªº°õ¦æÀÉ¡G

\begin{tscreen}
\begin{verbatim}
make all
\end{verbatim}
\end{tscreen}


§A¥i¯à·|¬Ý¨ìÄµ§i»y¡G {\ttfamily rcsid defined but not used}.  ³o¨SÃö«Y¡A
¦]¬°§@ªÌ¨Ï¥Îª©¥»±±¨î®M¥ó¤~·|µo¥Í¡C






\section{¦w¸Ë}


\subsection{¤âÃä·Ç³Æ¤@­Ó¶}¾÷¤ù}

¦pªG¯uªºµo¥ÍÄY­«¿ù»~¡A¦³­Ó¶}¾÷ºÏ¤ù¤§¦³¥Îªº¡C¦pªG§A­n boot/root ¦X¨Öªº¦w¸Ë¡A§A¥i¥H
°Ñ¦Ò\nameurl{http://sunsite.unc.edu/mdw/HOWTO/Bootdisk-HOWTO.html}{Bootdisk-HOWTO} ¥H»s§@ root ¶}¾÷¤§¶}¾÷¤ù¡C






\subsection{²¾°£½Æ»sªº man pages}

§A¤]À³¸Ó±N¾Þ§@¤â¥U§ó·s¡A§Y¨Ï§A«Ü¼F®`¨ì¨¬¥H¤£¥Î³Æ¥÷¦w¸Ë Shadow Suite¡A§A¤´µM­n±N
±NÂÂªº¾Þ§@¤â¥U²¾°£¡A¦]¬°·sª©ªº¾Þ§@¤â¥UµLªk¥¿±`ªºÂÐ»\ÂÂª©¥»¡C

§A¥i¥H¨Ï¥Î¤@­Ó²Õ¦X¡G {\ttfamily man -aW ©R¥O} ©M {\ttfamily locate ©R¥O} ´M§ä»Ý³Æ²¾°£
ªº¾Þ§@¤â¥U¡C¦b§A°õ¦æ {\ttfamily make install} «e§ä¥X¸ûÂÂª©¥»¤ñ¸û®e©ö¡C

¦pªG§A¨Ï¥Î Slackware 3.0 ª©¥»¡AµM«á§A­n²¾°£ªº¾Þ§@¤â¥U¬O¡G
\begin{itemize}
\item /usr/man/man1/chfn.1.gz
\item /usr/man/man1/chsh.1.gz
\item /usr/man/man1/id.1.gz
\item /usr/man/man1/login.1.gz
\item /usr/man/man1/passwd.1.gz
\item /usr/man/man1/su.1.gz
\item /usr/man/man5/passwd.5.gz
\end{itemize}


¦b {\ttfamily /var/man/cat[1-9]} ¦¸¥Ø¿ý¤]¦³¬Û¦Pªº¦W¦r»Ý­n³Q§R°£¡C




\subsection{°õ¦æ make install}

²{¦b§A¤w¸g·Ç³Æ­n¿é¤J¡G (¥H root Åv­­°õ¦æ)
\begin{tscreen}
\begin{verbatim}
make install
\end{verbatim}
\end{tscreen}


³o±N¦w¸Ë³Ì·s©M§ó·sµ{¦¡¥B­×´_ÀÉ®×³\¥iÅv¡C¥¦¤]·|¦w¸Ë¾Þ§@¤â¥U¡C

³o¤]±N¦b¦w¸Ë®É¦Ò¼{±N Shadow Suite ¥]§tÀÉ®×©ñ¦b¥¿½Tªº¦ì¸m {\ttfamily /usr/include/shadow} ¡C



¨Ï¥Î BETA ®M¥ó¡A§A»Ý­n¤â°Ê½Æ»s {\ttfamily login.defs} ³o­ÓÀÉ¨ì {\ttfamily /etc} ³o­Ó¥Ø¿ý¤U¡A
¦Ó¥B­n½T»{¥u¦³ {\itshape root\/} Åv­­¥i¥H§ïÅÜ¥¦¡C

\begin{tscreen}
\begin{verbatim}
cp login.defs /etc
chmod 700 /etc/login.defs
\end{verbatim}
\end{tscreen}


³o­ÓÀÉ®×¬O {\itshape Ã±¤J\/} µ{¦¡ªº configuration file¡C §AÀ³¸ÓÀË¬d¸ò½T©w³o­ÓÀÉªº§ïÅÜª¬ªp¡C
³o¬O§A¨M©w­þ­Ó  tty ªº root ¥i¥H±q­þ¸ÌÃ±¤J©M³]©w¨ä¥L¦w¥þ¤è°wªº¦a¤è(¹³¹w³]±K½Xªº¨ì´Á¤é)¡C




\subsection{°õ¦æ pwconv}

±µ¤U¨Óªº¨BÆJ¬O°õ¦æ {\ttfamily pwconv}¡C  ³o¤]»Ý¥H {\itshape root\/}°õ¦æ¥B³Ì¦n¦b {\ttfamily /etc} 
¥Ø¿ý¤U°õ¦æ¡G
\begin{tscreen}
\begin{verbatim}
cd /etc
/usr/sbin/pwconv
\end{verbatim}
\end{tscreen}


{\ttfamily pwconv} Â^¨ú§Aªº {\ttfamily /etc/passwd} ÀÉ¥B§R°£¬Y¨ÇÄæ¦ì¬°¤F«Ø¥ß¨â­ÓÀÉ®×¡G
{\ttfamily /etc/npasswd} ©M {\ttfamily /etc/nshadow}.

¤@­Ó {\ttfamily pwunconv} ¤]´£¨Ñ§A«Ø¥ß¤@­Ó {\ttfamily /etc/passwd} ©M {\ttfamily /etc/shadow} 
²Õ¦Xªº¥¿±` {\ttfamily /etc/passwd} ÀÉ®×¡C




\subsection{­«·s©R¦W npasswd ©M nshadow}

²{¦b§A¤w¸g°õ¦æ {\ttfamily pwconv} ¡A¦Ó¥B§A¤w¸g«Ø¥ß {\ttfamily /etc/npasswd} ©M
{\ttfamily /etc/nshadow} ÀÉ®×¡C³o»Ý­n½Æ»s¨ì {\ttfamily /etc/passwd} ©M {\ttfamily /etc/shadow}
ÀÉ¡C §Ú­Ì¤]»Ý­n½Æ»s­ì©l {\ttfamily /etc/passwd} ÀÉ¡A¦Ó¥B½T©w¥u¦³ root ¥i¥HÅª¥¦¡C
§Ú­Ì±N¸ÓÀÉ®×©ñ¦b root ±o®Ú¥Ø¿ý¡G

\begin{tscreen}
\begin{verbatim}
cd /etc
cp passwd ~passwd
chmod 600 ~passwd
mv npasswd passwd
mv nshadow shadow
\end{verbatim}
\end{tscreen}


§A¤]À³¸Ó½T©wÀÉ®×ªº¾Ö¦³ªÌ¸ò¦s¨úÅv­­¬O¥¿½Tªº¡C ¦pªG§A±N­n¨Ï¥Î {\itshape X-Windows\/} ¡A
{\ttfamily xlock} ©M {\ttfamily xdm} ¥i¯à»Ý­nÅª¨ú {\ttfamily shadow} ÀÉ(¦ý»Ý¤£­n¼g¤J¸ÓÀÉ)¡C

¦³¨â­Ó¤èªk¥i¥H°µ¡C §A¥i¥H³]©w {\ttfamily xlock} ªº suid ¬O root ({\ttfamily xdm}  ³q±`¥H
root Åv­­°õ¦æ)¡C ©ÎªÌ§A¥i¥H¨Ï root ¦¨¬° {\ttfamily shadow} ªº¸s²Õ¥i¥H¾Ö¦³ {\ttfamily shadow} ÀÉ
¡A¦ý¬O¦b§@³o¤§«e¡A­n½T©w§A¤w¸g¦³­Ó shadow group (¥i¥H¦b {\ttfamily /etc/group} ÀÉ¬Ý¨ì)¡C
¤£À³§ï¦³¥ô¦ó¨Ï¥ÎªÌ¯uªº¦b  shadow group ¡C

\begin{tscreen}
\begin{verbatim}
chown root.root passwd
chown root.shadow shadow
chmod 0644 passwd
chmod 0640 shadow
\end{verbatim}
\end{tscreen}


§Aªº¨t²Î²{¦b¦³ shadow ªº±K½XÀÉÅo¡C §A²{¦b {\itshape À³¸Ó\/} ­«¶}¤@­Ó²×ºÝ¾÷µøµ¡©M½T»{§A
¥i¥HÃ±¤J(login)¡C

{\itshape ½Ð°¨¤W½T¹êªº§@³o¥ó¨Æ¡I\/}

¦p¹L§A¤£¯à¡A¥i¯à¬Y¨Ç¨Æ±¡¦³¿ù»~Åo¡I ¬°¤F­n¦^¨ì to a non-shadowed ª¬ºA¡A½Ð§@¤U¦C¨BÆJ¡G

\begin{tscreen}
\begin{verbatim}
cd /etc
cp ~passwd passwd
chmod 644 passwd
\end{verbatim}
\end{tscreen}


§A±N­«·sÀx¦s³o¨ÇÀÉ®×¨ì¥ý«e§AÀx¦s¥¦­Ìªº¥¿½T¦ì¸m¡C






\section{¨ä¥L§A»Ý­n¤É¯Å(upgrade)©Î¸É±j(patch)µ{¦¡}

§Y¨Ï shadow suite ¹ï¤j³¡¤À»Ý­n¦s¨ú±K½XÀÉªºµ{¦¡¥i¥H¥]§t§ó·sµ{¦¡¡A¦ý¬O¤´¦³¤@¨Ç»Ý­n
¦s¨ú±K½XÀÉªºÃB¥~µ{¦¡¦b¨t²Î¤¤¡C

¦pªG§A¥¿°õ¦æ {\itshape Debian ª©¥»\/}  (©ÎªÌ§Y¨Ï§A¤£¬O)¡A§A¥i¥H§ä¨ì Debian »Ý­n rebuild 
ªº­ì©l½X¡G
ftp://ftp.debian.org/debian/stable/source/

³o¸`³Ñ¾lªº³¡¤À¦b°Q½×§ó·s {\ttfamily adduser}, {\ttfamily wu\_ftpd}, {\ttfamily ftpd},
{\ttfamily pop3d}, {\ttfamily xlock},{\ttfamily xdm} ©M {\ttfamily sudo} µ{¦¡¥H«K©óÅý³o¨Çµ{¦¡¤ä´©
shadow suite¡C

½Ð¬Ý \ref{sec-adding} {(Adding Shadow Support to a C program)} ³o¸`¡A¥D­n¬O¦b
°Q½×¦p¦ó±N shadow ¤ä´©©ñ¨ì¨ä¥L»Ý­nµ{¦¡(ÁöµM³o¨Çµ{¦¡»Ý­n¥H SUID root °õ¦æ©Î SGID shadow
»Ý¥¿½T¦s¨ú shadow ÀÉ)¡C




\subsection{Slackware adduser µ{¦¡}

Slackware ª©¥»¥]§t¤@­Ó·s¼W¨Ï¥ÎªÌªº¥æ¤¬µ{¦¡¥s°µ {\ttfamily /sbin/adduser}¡C¸Óµ{¦¡ªº shadow
ª©¥»¥i¥H¦b \onlynameurl{ftp://sunsite.unc.edu/pub/Linux/system/ Admin/accounts/adduser.shadow-1.4.tar.gz}§ä¨ì¡C

§Ú«Ü¹ªÀy§A¨Ï¥Î {\itshape Shadow Suite\/} ¨ÑÀ³ªºµ{¦¡(¨Ò¦p{\ttfamily useradd}, {\ttfamily usermod}, 
©M {\ttfamily userdel}) ¨Ó¨ú¥N slackware ªº{\ttfamily adduser} µ{¦¡¡C ¥¦­Ì¥u»Ýªá¤@ÂI®É¶¡¾Ç²ß
¡A¦ý¬O¥¦±N­È±oªº¡A¦]¬°§A¥i¥H¬Ý¨ì§ó¦h±±¨î©M¦b¥¿½T®i²{Âê¦í {\ttfamily /etc/passwd} ©M 
{\ttfamily /etc/shadow} ªºÀÉ®×({\ttfamily adduser} ´N¨S¦³¿ìªkÅo)¡C



°Ñ¦Ò\ref{sec-work} {(Putting the Shadow Suite to use)} ¸Ó¸`±o¨ì§ó¦h¬ÛÃö¸ê°T¡C



¦ý¬O¦pªG§A¤w¸g¾Ö¦³Åo¡A±µ¤U¨Ó¬O§A­n°µªº³¡¤À¡G

\begin{tscreen}
\begin{verbatim}
tar -xzvf adduser.shadow-1.4.tar.gz
cd adduser
make clean
make adduser
chmod 700 adduser
cp adduser /sbin
\end{verbatim}
\end{tscreen}





\subsection{wu\_ftpd Server}

¤j³¡¤Àªº Linux ¨t²Î³£¦³ {\ttfamily wu\_ftpd} server¡C ¦pªG§Aªºª©¥»¨S¦³ªþ±a shadow ¦w¸Ë¡A
¨º»ò§Aªº {\ttfamily wu\_ftpd} ´N¨S¦³¿ìªk¹ï shadow ½sÄ¶¡C {\ttfamily wu\_ftpd} ¬O±q 
{\ttfamily inetd/tcpd} ¶}©l¥B¥H {\itshape root\/} Åv­­°õ¦æªºµ{¦¡¡C ¦pªG§A¥¿¦b¶]¤@­ÓÂÂª©ªº
{\ttfamily wu\_ftpd} daemon¡A µL½×¦p¦ó§A±N­n§ó·s¥¦¦]¬°¸ûÂÂª©¥»¦³ bug ±N¦M¤Î {\itshape root\/} 
Åv­­¡C(°Ñ¦Ò \nameurl{http://bach.cis.temple.edu/linux/linux-security/Linux-Security-FAQ/Linux-wu.ftpd-2.4-Update.html}{Linux security home page}
±o¨ì§ó¦h¬ÛÃö¸ê°T)¡C



©¯¹Bªº¬O§A¥u»Ý­n¨úªº¦³´O¤J shaow ªº­ì©l½X©M­«·s½sÄ¶´N¥i¥HÅo¡I

¦pªG§A¤£¬O¥¿¦b°õ¦æ ELF ¨t²Î¡A {\ttfamily wu\_ftp} server ¥i¥H±q Sunsite ºô§}
\nameurl{ftp://sunsite.unc.edu/pub/Linux/system/Network/file-transfer/wu-ftpd-2.4-fixed.tar.gz}{wu-ftp-2.4-fixed.tar.gz} §ä¨ì¡C

·í§AÀò±o³o­Ó server¡A§â¥¦©ñ¦b {\ttfamily /usr/src}¥Ø¿ý¡AµM«á¿é¤J¡G

\begin{tscreen}
\begin{verbatim}
cd /usr/src
tar -xzvf wu-ftpd-2.4-fixed.tar.gz
cd wu-ftpd-2.4-fixed
cp ./src/config/config.lnx.shadow ./src/config/config.lnx
\end{verbatim}
\end{tscreen}


µM«á½s¿è {\ttfamily ./src/makefiles/Makefile.lnx}¡A©M§ïÅÜ
\begin{tscreen}
\begin{verbatim}
LIBES    = -lbsd -support
\end{verbatim}
\end{tscreen}
 
³o¤@¦æ¨ì¡G
\begin{tscreen}
\begin{verbatim}
LIBES    = -lbsd -support -lshadow
\end{verbatim}
\end{tscreen}


²{¦b§A¤w¸g·Ç³Æ¦n°õ¦æ script «Ø¥ß¸ò¦w¸Ë¡G

\begin{tscreen}
\begin{verbatim}
cd /usr/src/wu-ftpd-2.4-fixed
/usr/src/wu-ftp-2.4.fixed/build lnx
cp /usr/sbin/wu.ftpd /usr/sbin/wu.ftpd.old
cp ./bin/ftpd /usr/sbin/wu.ftpd
\end{verbatim}
\end{tscreen}
 

³o¬O¥Î¦b Linux shadow configuration file¡B½sÄ¶©M¦w¸Ë server¡C

¦b§Úªº Slackware 2.3 ¨t²Î¡A§Ú¤]»Ý­n¦b°õ¦æ«e§@¤U¦C¨BÆJ¡G

{\ttfamily build}:
\begin{tscreen}
\begin{verbatim}
cd /usr/include/netinet
ln -s in_systm.h in_system.h
cd -
\end{verbatim}
\end{tscreen}


¦b ELF ¨t²Î¤U·|¦³½sÄ¶°ÝÃDªº³ø§i¡A¦ý¬O¤U¤@ª©ªº Beta ª©«h¥i¥H¥¿½Tªº°õ¦æ¡C
¥i¥H±q \nameurl{ftp://tscnet.com/pub/linux/network/ftp/wu-ftpd-2.4.2-beta-10.tar.gz}{wu-ftp-2.4.2-beta-10.tar.gz} §ä¨ì¡C

·í§AÀò±o³o­Ó server¡A§â¥¦©ñ¦b {\ttfamily /usr/src}¥Ø¿ý¡AµM«á¿é¤J¡G
\begin{tscreen}
\begin{verbatim}
cd /usr/src
tar -xzvf wu-ftpd-2.4.2-beta-9.tar.gz
cd wu-ftpd-beta-9
cd ./src/config
\end{verbatim}
\end{tscreen}


µM«á½s¿è {\ttfamily config.lnx}¡A©M§ïÅÜ¡G
\begin{tscreen}
\begin{verbatim}
#undef SHADOW.PASSWORD
\end{verbatim}
\end{tscreen}

³o¤@¦æ¨ì¡G
\begin{tscreen}
\begin{verbatim}
#define SHADOW.PASSWORD
\end{verbatim}
\end{tscreen}

µM«á¡A
\begin{tscreen}
\begin{verbatim}
cd ../Makefiles
\end{verbatim}
\end{tscreen}

¥B½s¿è {\ttfamily Makefile.lnx} ÀÉ©M§ïÅÜ

\begin{tscreen}
\begin{verbatim}
LIBES = -lsupport -lbsd # -lshadow
\end{verbatim}
\end{tscreen}

³o¤@¦æ¨ì¡G
\begin{tscreen}
\begin{verbatim}
LIBES = -lsupport -lbsd -lshadow
\end{verbatim}
\end{tscreen}

µM«á«Ø¥ß(build)©M¦w¸Ë(install)¡G
\begin{tscreen}
\begin{verbatim}
cd ..
build lnx
cp /usr/sbin/wu.ftpd /usr/sbin/wu.ftpd.old
cp ./bin/ftpd /usr/sbin/wu.ftpd
\end{verbatim}
\end{tscreen}
 

µù¡G§AÀ³¸ÓÀË¬d§Aªº {\ttfamily /etc/inetd.conf} ÀÉ¨Ó½T»{§Aªº wu.ftpd server ¬O¤£¬O¯uªº¬¡µÛ¡C
¦³¨Çª©¥»¥i¯à±N  server daemons ©ñ¦b¤£¦Pªº¦a¤è©Î¥Î¤£¦Pªº¦W¦rªí¥Ü¡C




\subsection{¼Ð·Ç ftpd}

¦pªG§A¥¿¦b°õ¦æ¼Ð·Çªº {\ttfamily ftpd} server¡A§Ú±N«ØÄ³§A§ó·s {\ttfamily wu\_ftpd} server¡C
Â÷¶}¤W­zªº bug ¡A¨t²Î·|¤ñ¸û¦w¥þ¡C

¦pªG§A°í«ù¦b¼Ð·Ç¼Ò¦¡¡A©ÎªÌ§A»Ý­n {\itshape NIS\/} ¤ä´©¡A¦b Sunsite  
\nameurl{ftp://sunsite.unc.edu/pub/Linux/system/Network/file-transfer/ftpd-shadow-nis.tgz}{ftpd-shadow-nis.tgz} ¦³°Ñ¦Ò¸ê®Æ¡C




\subsection{pop3d (Post Office Protocol 3)}

¦pªG§A»Ý­n¤ä´©²Ä¤Tª© {\itshape Post Office Protocol (POP3)\/}¡A§A±N»Ý­n­«·s½sÄ¶ {\ttfamily pop3d}
µ{¦¡¡C {\ttfamily pop3d} ¥i¥H³z¹L {\ttfamily inetd/tcpd} ¥H {\ttfamily root} Åv­­¥¿±`ªº°õ¦æ¡C

±q Sunsite ¦³¨â­Óª©¥»¥i¥HÀò±o¡G 
\nameurl{ftp://sunsite.unc.edu/pub/Linux/system/Mail/pop/pop3d-1.00.4.linux.shadow.tar.gz}{pop3d-1.00.4.linux.shadow.tar.gz}
©M
\nameurl{ftp://sunsite.unc.edu/pub/Linux/system/Mail/pop/pop3d+shadow+elf.tar.gz}{pop3d+shadow+elf.tar.gz}

³o¨â­Ó³£«ÜÂ²³æ¥i¥H¦w¸Ë¡C




\subsection{xlock}



¦pªG§A¦w¸Ë shadow suite¡AµM«á°õ¦æ {\itshape X Windows System\/} ©M  
lock ¿Ã¹õ¨S¥H§ó·s§Aªº {\ttfamily xlock} ÀÉ¡A §A±N¥²¶·¨Ï¥Î {\ttfamily CNTL-ALT-Fx} ¥h¤Á´«
¥t¤@­Ó {\itshape tty\/}¡AÃ±¤J(login)©M±þ±¼(kill) {\ttfamily xlock} process 
(©Î¨Ï¥Î {\ttfamily CNTL-ALT-BS} ±þ±¼ X server)¡C
«Ü©¯¹Bªº³o¤]«Ü®e©ö¥i¥H§ó·s§Aªº {\ttfamily xlock} µ{¦¡¡C

¦pªG§A¥¿°õ¦æ XFree86 Versions 3.x.x¡A¥B¥¿¥¿½T¨Ï¥Î
{\ttfamily xlockmore} (¬O¤@­Ó«Ü´Îªº¿Ã¹õ«OÅ@µ{¦¡).
³o­Ó®M¥ó¤ä´© {\itshape shadow\/}¡A¥u­n­«·s½sÄ¶§Y¥i¡C¦pªG§A¦³¥ô¦ó¸û¦Ñªº {\ttfamily xlock}
ª©¥»¡A§Ú«ØÄ³§A§ó·s¤U¦Cª©¥»¡G

{\ttfamily xlockmore-3.5.tgz} ¥i¥H±q
\nameurl{ftp://sunsite.unc.edu/pub/Linux/X11/xutils/screensavers/xlockmore-3.7.tgz}{}
ºô¯¸Àò±o¡C

°ò¥»¤W³o¬O§A©Ò­nªº¡C

Â^¨ú {\ttfamily xlockmore-3.7.tgz} ¡A¨Ã±N¥¦©ñ¦b {\ttfamily /usr/src} ¥Ø¿ý¨Ã¸ÑÀ£ÁY¡G
\begin{tscreen}
\begin{verbatim}
tar -xzvf xlockmore-3.7.tgz
\end{verbatim}
\end{tscreen}


½s¿è³o­ÓÀÉ¡G {\ttfamily /usr/X11R6/lib/X11/config/linux.cf}, ©M§ïÅÜ
\begin{tscreen}
\begin{verbatim}
#define HasShadowPasswd    NO

³o¤@¦æ¨ì¡G

#define HasShadowPasswd    YES
\end{verbatim}
\end{tscreen}


µM«á«Ø¥ß¥i°õ¦æÀÉ¡G
\begin{tscreen}
\begin{verbatim}
cd /usr/src/xlockmore
xmkmf
make depend
make
\end{verbatim}
\end{tscreen}


µM«á·h²¾©Ò¥HÀÉ®×¨ì¥¿½T¥Ø¿ý¥B§ó·sÀÉ®×¾Ö¦³ªÌ¤Î°õ¦æÅv­­¡G

\begin{tscreen}
\begin{verbatim}
cp xlock /usr/X11R6/bin/
cp XLock /var/X11R6/lib/app-defaults/
chown root.shadow /usr/X11R6/bin/xlock
chmod 2755 /usr/X11R6/bin/xlock
chown root.shadow /etc/shadow
chmod 640 /etc/shadow
\end{verbatim}
\end{tscreen}




§Aªº xlock ±N¥i¥H¥¿½Tªº¹B§@Åo¡I




\subsection{xdm}

{\ttfamily xdm} ¬O¤@­Ó¥i¥Hªí¥Ü¦b X-Windows Ã±¤Jµe­±ªºµ{¦¡¡C¬Y¨Ç¨t²Î¶}©l {\ttfamily xdm} 
·í¨t²Î³Q§iª¾¹D¤@­Ó¯S©wªº°õ¦æ¤ô·Ç(°Ñ¦Ò {\ttfamily /etc/inittab})¡C



¦ñÀHµÛ {\itshape Shadow Suite\/} ¦w¸Ë¡A {\ttfamily xdm} »Ý­n³Q§ó·s¡C
«Ü©¯¹Bªº³o¤]«Ü®e©ö¥i¥H§ó·s§Aªº {\ttfamily xdm} µ{¦¡¡C





{\ttfamily xdm.tar.gz} ¥i¥H±q¤U¦Cºô§}Àò±o¡G
\nameurl{ftp://sunsite.unc.edu/pub/Linux/X11/xutils/xdm.tar.gz}{}

Â^¨ú {\ttfamily xdm.tar.gz} ÀÉ¨Ã±N¥¦©ñ¦b {\ttfamily /usr/src}¥Ø¿ýµM«á¸ÑÀ£ÁY¡G
\begin{tscreen}
\begin{verbatim}
tar -xzvf xdm.tar.gz
\end{verbatim}
\end{tscreen}


½s¿è³o­ÓÀÉ¡G {\ttfamily /usr/X11R6/lib/X11/config/linux.cf}¡A¥B§ïÅÜ
\begin{tscreen}
\begin{verbatim}
#define HasShadowPasswd    NO

³o¤@¦æ¨ì¡G

#define HasShadowPasswd    YES
\end{verbatim}
\end{tscreen}


µM«á«Ø¥ß¥i°õ¦æÀÉ¡G
\begin{tscreen}
\begin{verbatim}
cd /usr/src/xdm
xmkmf
make depend
make
\end{verbatim}
\end{tscreen}


µM«á·h²¾©Ò¦³ÀÉ®×¥¿½T¥Ø¿ý¡G
\begin{tscreen}
\begin{verbatim}
cp xdm /usr/X11R6/bin/
\end{verbatim}
\end{tscreen}


{\ttfamily xdm} ¥H {\itshape root\/} Åv­­¦b°õ¦æ¡A©Ò¥H§A¤£»Ý­n§ïÅÜÀÉ®×¦s¨úÅv­­¡C






\subsection{sudo}

{\ttfamily sudo} µ{¦¡¤¹³\¨t²ÎºÞ²z­ûÅý¨Ï¥ÎªÌ¥i¥H¥H root Åv­­¥¿±`ªº°õ¦æµ{¦¡¡C
³o¬O«D±`¤è«Kªº¦]¬°¥¦¥i¥H­­¨îºÞ²zªÌ°õ¦æ root ±b¸¹¥»¨­Åv­­¡AÁÙ¥i¥H¤¹³\¨Ï¥ÎªÌ§@
¹³ mounte drives ªº¨Æ±¡¡C

{\ttfamily sudo} »Ý­nÅª¨ú±K½X¦]¬°¦b°õ¦æ®É»Ý½T»{¨Ï¥ÎªÌ±K½X¡C {\ttfamily sudo} ¤w¸g°õ¦æ SUID root¡A
©Ò¥H¦s¨ú {\ttfamily /etc/shadow} ÄÒ¤£¬O°ÝÃD¡C

{\ttfamily sudo} ¤ä´© shadow suite ¥i¦b¤U¦Cºô§}¨ú±o¡G
\nameurl{ftp://sunsite.unc.edu/pub/Linux/system/Admin/sudo-1.2-shadow.tgz}{}

{\itshape Äµ§i\/}¡G·í§A¦w¸Ë {\ttfamily sudo} §Aªº {\ttfamily /etc/sudoers} ÀÉ±N¨ú¥N¹w³]­È¡A©Ò¥H§A
»Ý­n³Æ¥÷­ì©lµ{¦¡¡C¦pªG§A¦³®a¥ô¦ó³]©w¦b¹w³]µ{¦¡¡A§A¥i¯à­n½s¿è Makefile ¥B²¾°£½Æ»s¸ÓÀÉ¨ì
{\ttfamily /etc} ªº³o¦æ¡C



¸Ó®M¥ó¤w¸g¹ï shadow ¶i¦æ³]©w¡A©Ò¥H¥u­n­«·s½sÄ¶¸Ó®M¥ó§Y¥i (§â¥¦©ñ¦b {\ttfamily /usr/src} ¥Ø¿ý)¡G
\begin{tscreen}
\begin{verbatim}
cd /usr/src
tar -xzvf sudo-1.2-shadow.tgz
cd sudo-1.2-shadow
make all
make install
\end{verbatim}
\end{tscreen}





\subsection{imapd (E-Mail {[}pine package{]})}

{\ttfamily imapd} ¬O¤@­Ó¹³ {\ttfamily pop3d} ªº email server¡C 
{\ttfamily imapd} ÀHµÛ {\itshape Pine E-mail\/} ®M¥óµo¥Í¡C ¨ä¾Þ§@¤â¥U¦b¤¶²Ð¸Ó®M¥ó®É§Y¥]§t
shadow ¤ä´©¡CµM¦Ó¡A§Úµo²{³o¤£¥þµM¥¿½T¡C ¦A¥[¤W¦b½sÄ¶®É¥[¤W  {\ttfamily libshadow.a} ¨ç¦¡®w
©M¸Ó®M¥óµ²¦X build script / Makefile ¬O«D±`¤£®e©öªº¡C©Ò¥H¹ï {\ttfamily imapd} ¥[¤J shadow
¤ä´©¬O¤£¤Ó¥i¯àªº¡C



¦pªG¦³¥ô¦óµª®×¡A¥i¥H Email µ¹§Ú¡A§Ú·|±N¸Ó¸Ñµª©ñ¨ì³o¸Ì¡C




\subsection{pppd (Point-to-Point Protocol Server)}

pppd server ¥i¥H¨Ï¥Î´XºØÅv­­³]©w¡G
{\itshape Password Authentication Protocol\/} (PAP) ©M {\itshape Cryptographic
Handshake Authentication Protocol\/} (CHAP)¡C   pppd server ±q
{\ttfamily /etc/ppp/chap-secrets} ©M/©Î {\ttfamily /etc/ppp/pap-secrets} ÀÉÅª¨ú±K½X¦r¦ê¡C
¦pªG§A¥¿¨Ï¥Î¹w³] pppd ªº°õ¦æ¡A´N¨S¦³¥²­n¦A­«·s¦w¸Ë pppd ¡C

pppd ¥H¤¹³\§A¨Ï¥Î {\itshape login\/} °Ñ¼Æ¡C ¦pªG {\itshape login\/} ¿ï¶µ³Q¿ï¨ú¡A
pppd ±N¨Ï¥Î {\ttfamily /etc/passwd} ÀÉªº±b¸¹±K½Xµ¹ {\itshape PAP\/}. ·íµM¦b¤£¤[±K½XÀÉ·|¬O 
shadowedm¡Cpppd-1.2.1d ÀÉ¤w¸g¥[¤J¹ï shadow ªº¤ä´©¡C



¤U¤@¸`¥[¤J¤ä´© shadow ªº½d¨Ò¬O°w¹ï
{\ttfamily pppd-1.2.1d} (¤@­Ó¸û¦Ñª©¥»ªº pppd).

{\ttfamily pppd-2.2.0} ª©´N¤w¸g¥]¬A shadow ¤ä´©Åo¡C




\section{±N Shadow Suite ©ñ¶i¨Ó¨Ï¥Î¡C\label{sec-work}}

³o¸`´y­z§A»Ý­nª¾¹D¦³¨Çµ{¦¡¦b¦w¸Ë®É´N¤w¸g¦³ {\itshape Shadow Suite\/}¡C
¤j³¡¤Àªº¸ê°T¦b¾Þ§@¤â¥U¥i¥H§ä¨ì¡C




\subsection{·s¼W¡B­×§ï©M§R°£¨Ï¥ÎªÌ}

{\itshape Shadow Suite\/} ·s¼W¤U¦C«ü¥O¥Î¨Ó·s¼W¡B­×§ï©M§R°£¨Ï¥ÎªÌ¡C ³o¤]¬O¥i¥H¦w¸Ë
{\ttfamily adduser} µ{¦¡¡C




\subsubsection{useradd}

{\ttfamily useradd} ¨Ï¥O¥i¥Î¦b¨t²Î¤¤·s¼W¨Ï¥ÎªÌ¡C §A¤]¥i¥H±Ä¥Î¦¹«ü¥O¨Ó§ïÅÜ¹w³]¦r¦ê¡C

§AÀ³¸Ó°µªº²Ä¤@¥ó¨Æ¬OÀË¬d¹w³]­È³]©w©M°w¹ï§Aªº¨t²Î¶i¦æ§ïÅÜ¡G
\begin{tscreen}
\begin{verbatim}
useradd -D
\end{verbatim}
\end{tscreen}
\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
GROUP=1
HOME=/home
INACTIVE=0
EXPIRE=0
SHELL=
SKEL=/etc/skel
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}


¹w³]­È¤£¥þ¬O§A­nªº¡A©Ò¥H¦pªG§A¶}©l·s¼W¨Ï¥ÎªÌ¡A§A¥²¶·¸Ô¾\¨C­Ó¨Ï¥ÎªÌ¸ê°T¡C
¦Ó¥B¡A§Ú­Ì¥i¯à©MÀ³¸Ó§ïÅÜ³]©w­È¡C

¦b§Úªº¨t²Î¤W¡G
\begin{itemize}
\item §Ú­n¹w³]¸s²Õ¬O 100
\item §Ú­n±K½X¨C¨ì 60 ¤Ñ´N¨ì´Á
\item §Ú¤£­nÂê¦í±b¸¹¦]¬°±K½X·|¨ì´Á
\item §Ú­n¹w³] shell ¬O {\ttfamily /bin/bash}
\end{itemize}

¬°¤F³o¨Ç§ïÅÜ¡A§Ú­n¨Ï¥Î¡G
\begin{tscreen}
\begin{verbatim}
useradd -D -g100 -e60 -f0 -s/bin/bash
\end{verbatim}
\end{tscreen}
 

²{¦b°õ¦æ {\ttfamily useradd -D} ±N±o¨ì¡G
\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
GROUP=100
HOME=/home
INACTIVE=0
EXPIRE=60
SHELL=/bin/bash
SKEL=/etc/skel
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}




¾¨ºÞ¨Ì·Ó§A»Ý­n­×§ï¡A¹w³]­È±N¦s¦b {\ttfamily /etc/default/useradd}.

¥ý¦b§A¥i¥H¨Ï¥Î {\ttfamily useradd} ¨Ó·s¼W¨t²Î¨Ï¥ÎªÌ¡CÁ|¨Ò»¡©ú¡A·s¼W¤@¨Ï¥ÎªÌ {\ttfamily fred}
¨Ï¥Î¹w³]­È¤è¦¡¦p¤U¡G
\begin{tscreen}
\begin{verbatim}
useradd -m -c "Fred Flintstone" fred
\end{verbatim}
\end{tscreen}


³o±N¦b {\ttfamily /etc/passwd} ÀÉ¤¤ªº¤@¦æ«Ø¥ß¦p¤U¡G
\begin{tscreen}
\begin{verbatim}
fred:*:505:100:Fred Flintstone:/home/fred:/bin/bash
\end{verbatim}
\end{tscreen}

¥B¦b {\ttfamily /etc/shadow} ÀÉ¤¤ªº¤@¦æ«Ø¥ß¦p¤U¡F
\begin{tscreen}
\begin{verbatim}
fred:!:0:0:60:0:0:0:0
\end{verbatim}
\end{tscreen}

{\ttfamily fred}ªº®Ú¥Ø¿ý±N³Q«Ø¥ß¥B {\ttfamily /etc/skel} ªº¤º®e±N³Q½Æ»s¦]¬°«ü¥O¥y¤¤¦³
{\ttfamily -m} ³]©w¡C

¦]¬°§Ú­Ì¨Ã¥¼¸Ô­z UID¡A¨t²Î·|ª½±µ´M§ä¤U¤@­Ó¥iÀò±oªº½s¸¹¡C

{\ttfamily fred}ªº±b¸¹³Q«Ø¥ßÅo¡A¦ý¬O {\ttfamily fred} ¤´µM¤£¯àÃ±¤Jª½¨ì§Ú­Ì¤£¦AÂê¦í(unlock)³o­Ó±b¸¹¡C
³z¹L§ó§ï±K½X§¹¦¨ unlock ±b¸¹¡A¤èªk¦p¤U¡G

\begin{tscreen}
\begin{verbatim}
passwd fred
\end{verbatim}
\end{tscreen}

\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
Changing password for fredó
Enter the new password (minimum of 5 characters)
Please use a combination of upper and lower case letters and numbers.
New Password: *******
Re-enter new password: *******
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}

²{¦b {\ttfamily /etc/shadow} ÀÉ±N¥]§t¡G
\begin{tscreen}
\begin{verbatim}
fred:J0C.WDR1amIt6:9559:0:60:0:0:0:0
\end{verbatim}
\end{tscreen}

¥B {\ttfamily fred} ±N¥i¥HÃ±¤J©M¨Ï¥Î¸Ó¨t²Î¡C 
{\ttfamily useradd} ©M¨ä¥Lªþ±a {\itshape Shadow Suite\/} ¤ñ¸û¦nªº¦a¤è¬O¥i¥H¦Û°Ê§ïÅÜ
{\ttfamily /etc/passwd} ©M {\ttfamily /etc/shadow} ¡C ©Ò¥H¦pªG§A¥¿¦b·s¼W¤@­Ó¨Ï¥ÎªÌ¡A
¥B¥t¤@­Ó¨Ï¥ÎªÌ¥¿¦b§ó§ï±K½X¡A³o¨â­Ó¾Þ§@³£¥i¥H¥¿½Tªº°õ¦æ¡C

§A¨Ï¥Î´£¨Ñªº«ü¥O¤ñª½±µ¦s¨ú {\ttfamily /etc/passwd} ©M {\ttfamily /etc/shadow} ÀÉÁÙ¦n¡C  
¦pªG§A¥¿½s¿è {\ttfamily /etc/shadow} ÀÉ¡A¥B¦³­Ó¨Ï¥ÎªÌ¦b§A½s¿è®É­n§ïÅÜ¥Lªº±K½X¡A
µM«á§AÀx¦s½s¿èµ²ªG¡A³o­Ó¨Ï¥ÎªÌªº±K½X±N·|¿ò¥¢±¼¡C

³o¸Ì¬O¨Ï¥Î {\ttfamily useradd} ©M {\ttfamily passwd} ·s¼W¨Ï¥ÎªÌªº¤@¨Ç interactive script ¡G
\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
#!/bin/bash
#
# /sbin/newuser - A script to add users to the system using the Shadow
#                 Suite's useradd and passwd commands.
#
# Written my Mike Jackson <mhjack@tscnet.com> as an example for the Linux
# Shadow Password Howto.  Permission to use and modify is expressly granted.
#
# This could be modified to show the defaults and allow modification similar
# to the Slackware Adduser program.  It could also be modified to disallow
# stupid entries.  (i.e. better error checking).
#
##
#  Defaults for the useradd command
##
GROUP=100        # Default Group
HOME=/home       # Home directory location (/home/username)
SKEL=/etc/skel   # Skeleton Directory
INACTIVE=0       # Days after password expires to disable account (0=never)
EXPIRE=60        # Days that a passwords lasts
SHELL=/bin/bash  # Default Shell (full path)
##
#  Defaults for the passwd command
##
PASSMIN=0        # Days between password changes
PASSWARN=14      # Days before password expires that a warning is given
##
#  Ensure that root is running the script.
##
WHOAMI=`/usr/bin/whoami`
if [ $WHOAMI != "root" ]; then
        echo "You must be root to add news users!"
        exit 1
fi
##
#  Ask for username and fullname.
##
echo ""
echo -n "Username: "
read USERNAME
echo -n "Full name: "
read FULLNAME
#
echo "Adding user: $USERNAME."
#
# Note that the "" around $FULLNAME is required because this field is
# almost always going to contain at least on space, and without the "'s
# the useradd command would think that you we moving on to the next
# parameter when it reached the SPACE character.
#
/usr/sbin/useradd -c"$FULLNAME" -d$HOME/$USERNAME -e$EXPIRE \
        -f$INACTIVE -g$GROUP -m -k$SKEL -s$SHELL $USERNAME
##
#  Set password defaults
##
/bin/passwd -n $PASSMIN -w $PASSWARN $USERNAME >/dev/null 2>&1
##
#  Let the passwd command actually ask for password (twice)
##
/bin/passwd $USERNAME
##
#  Show what was done.
##
echo ""
echo "Entry from /etc/passwd:"
echo -n "   "
grep "$USERNAME:" /etc/passwd
echo "Entry from /etc/shadow:"
echo -n "   "
grep "$USERNAME:" /etc/shadow
echo "Summary output of the passwd command:"
echo -n "   "
passwd -S $USERNAME
echo ""
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}
 

·s¼W¨Ï¥ÎªÌ¬O¥Î script ¤ñª½±µ½s¿è {\ttfamily /etc/passwd} / {\ttfamily /etc/shadow} ÀÉ©Î¨Ï¥Î
¹³ Slackware ªº {\ttfamily adduser} µ{¦¡ÁÙ­n¦n¡C 

»Ý­n§ó¦h {\ttfamily useradd} ¸ê°T½Ð°Ñ·Ó½u¤W¾Þ§@¤â¥U¡C




\subsubsection{usermod}

{\ttfamily usermod} µ{¦¡¬O¥Î¦b­×§ï¨Ï¥ÎªÌ¸ê°T¡C
¥¦ªº°Ñ¼Æ¨Ï¥Î©M {\ttfamily useradd} µ{¦¡Ãþ¦ü¡C 

¦pªG§A­n§ó·s {\ttfamily fred} ªº shell¡A§A­n§@¤U¦C¨BÆJ¡G
\begin{tscreen}
\begin{verbatim}
usermod -s /bin/tcsh fred
\end{verbatim}
\end{tscreen}


²{¦b {\ttfamily fred} ªº {\ttfamily /etc/passwd} ÀÉ±NÅÜ¦¨¡G
\begin{tscreen}
\begin{verbatim}
fred:*:505:100:Fred Flintstone:/home/fred:/bin/tcsh
\end{verbatim}
\end{tscreen}

¦pªG­n¨Ï {\ttfamily fred} ªº±b¸¹¨ì´Á¤é¬° 09/15/97¡G
\begin{tscreen}
\begin{verbatim}
usermod -e 09/15/97 fred
\end{verbatim}
\end{tscreen}

²{¦b {\ttfamily fred} ¦b {\ttfamily /etc/shadow} ªºÄæ¦ìÅÜ¦¨¡G
\begin{tscreen}
\begin{verbatim}
fred:J0C.WDR1amIt6:9559:0:60:0:0:10119:0
\end{verbatim}
\end{tscreen}


»Ý­n§ó¦h {\ttfamily usermod} ¸ê°T½Ð°Ñ·Ó½u¤W¾Þ§@¤â¥U¡C




\subsubsection{userdel}

{\ttfamily userdel} ¥Î¦b§R°£¨Ï¥ÎªÌ¡A¨Ï¥Î¤èªk¬°¡G
\begin{tscreen}
\begin{verbatim}
userdel -r username
\end{verbatim}
\end{tscreen}

{\ttfamily -r} °Ñ¼Æ¥i¥H±N¸Ó¨Ï¥ÎªÌ®Ú¥Ø¿ý¥þ³¡²¾°£¡C¦ì¦b´Á«Ý¥Ø¿ýªºÀÉ®×«h»Ý¤â°Ê²¾°£¡C

¦pªG§A¥u¬O­nÂ²³æªºÂê¦í±b¸¹¦Ó¨S¦³­n§R°£¥¦¡A«ØÄ³§A¨Ï¥Î {\ttfamily passwd} «ü¥O¡C




\subsection{passwd «ü¥O©M passwd ¦Ñ¤Æ}

{\ttfamily passwd} «ü¥O«Ü©úÅã¨Ï¥Î¦b§ïÅÜ±K½X¡A°£¦¹¤§¥~¡A
¥i¥Ñ {\itshape root\/} ¨Ï¥Î¦b¡G
\begin{itemize}
\item Lock ©M unlock ±b¸¹ ({\ttfamily -l} and {\ttfamily -u})
\item ³]©w±K½X¦Xªkªº³Ì¤j¤Ñ¼Æ
({\ttfamily -x})
\item ³]©w±K½X§ïÅÜ¶¡ªº³Ì¤p¤Ñ¼Æ ({\ttfamily -n})
\item ³]©w±K½X¨ì´ÁªºÄµ§i¤Ñ¼Æ
({\ttfamily -w})
\item ³]©w¦b±b¸¹¥¼³QÂê¦º±K½X¨ì´Á«áªºÄµ§i¤Ñ¼Æ ({\ttfamily -i})
\item ¤¹³\¬d¸ß±b¸¹¸ê°T ({\ttfamily -S})
\end{itemize}


Á|¨Ò»¡©ú¡A¦pªG­nÂê¦º {\ttfamily fred} ±b¸¹¡G
\begin{tscreen}
\begin{verbatim}
passwd -S fred
fred P 03/04/96 0 60 0 0
\end{verbatim}
\end{tscreen}

³oªí¥Ü {\ttfamily fred} ªº±K½X¬O¦³®Äªº¡A¥¦¦b 03/04/96 ³Q­×§ï¥B¥ô¦ó®É¶¡³£¥i³Q­×§ï
¡A fred ±N¤£·|¦¬¨ìÄµ§i¥B±b¸¹±N¤£·|¦]±K½X¨ì´Á¦ÓÃö³¬¡C



³oªí¥Ü¦pªG {\ttfamily fred} ¦b±K½X¨ì´Á«áÃ±¤J¡A¥¦±N³Q­n¨D¥Î¤@­Ó·s±K½XÃ±¤J¡C



¦pªG§Ú­Ì¨M©w­nÄµ§i {\ttfamily fred} ¦b±K½X¹L´Á«e 14 ¤Ñ¡A¥BÅý¥¦ªº±b¸¹¦b¨ì´Á«á14¤ÑÄµ§i¡A
§Ú­Ì»Ý­n§@¤U¦C¨BÆJ¡G

\begin{tscreen}
\begin{verbatim}
passwd -w14 -i14 fred
\end{verbatim}
\end{tscreen}

²{¦b {\ttfamily fred} §ïÅÜ¬°¡G
\begin{tscreen}
\begin{verbatim}
fred P 03/04/96 0 60 14 14
\end{verbatim}
\end{tscreen}

»Ý­n§ó¦h {\ttfamily passwd} ¸ê°T½Ð°Ñ·Ó½u¤W¾Þ§@¤â¥U¡C




\subsection{login.defs ÀÉ}

{\ttfamily /etc/login} ÀÉ¬O¹ï {\ttfamily login} µ{¦¡ªº configuration file ¥B ¹ï
{\itshape Shadow Suite\/}¡C

{\ttfamily /etc/login} ¥]§t±q¹w³]­È±K½X§ïÅÜªºÅX°Ê³]©w¡C

{\ttfamily /etc/login.defs} ÀÉ¬O¤@­Ó«Ü¦nªº¤å¥óÀÉ¡AµM¦Ó¤´¦³¨Ç¨Æ±¡­nª`·N¡G

\begin{itemize}
\item It contains flags that can be turned on or off that determine the
amount of logging that takes place.
\item It contains pointers to other configuration files.
\item It contains defaults assignments for things like password aging.
\end{itemize}


¸ò¥h¤W­z§A¥i¥Hµo²{³o¬O¤@­Ó­«­nÀÉ¡A¥B§AÀ³¸Ó½T»{¥Ø«e³]©w¤Î§A±N¹ï§A¨t²Îªº³]©w¤º®e¡C




\subsection{¸s²Õ±K½X}

{\ttfamily /etc/groups} ÀÉ¥]¬A¤¹³\¬O¥ÎªÌ¦s¨ú¸s²Õ¤§±K½X¡C ¦pªG§A©w¸q
{\ttfamily SHADOWGRP} ¦b {\ttfamily /usr/src/shadow-YYMMDD/config.h} ÀÉ±N¶}±Ò¸Ó¥\¯à¡C

¦pªG§A©w¸q¸Ó±`¼Æ¥B½sÄ¶¥¦¡A§A»Ý«Ø¥ß¤@­Ó {\ttfamily /etc/gshadow} ÀÉ¨Ó«O¦s¸s²Õ±K½X
©M¸s²ÕºÞ²zªÌ¸ê°T¡C



·í§A«Ø¥ß {\ttfamily /etc/shadow}¡C§A¨Ï¥Î¤@­Ó©I¥sµ{¦¡¥s°µ {\ttfamily pwconv}¡A
¸Óµ{¦¡¤£·|«Ø¥ß {\ttfamily /etc/gshadow} ÀÉ¡A¦ý¬O³o¨SÃö«Y¡A¥u­n§A¦Û¦æ«Ø¥ß§Y¥i¡C



¬°¤F«Ø¥ß°_©l {\ttfamily /etc/gshadow} ÀÉ­n°õ¦æ¤U¦C¨BÆJ¡G
\begin{tscreen}
\begin{verbatim}
touch /etc/gshadow
chown root.root /etc/gshadow
chmod 700 /etc/gshadow
\end{verbatim}
\end{tscreen}


¨C¦¸§A«Ø¥ß¤@­Ó·s¸s²Õ¡A¥¦­Ì·|³Q¥[¨ì {\ttfamily /etc/group} ©M {\ttfamily /etc/gshadow} ÀÉ¡C
¦pªG§A³z¹L·s¼W©Î²¾°£¨Ï¥ÎªÌ¨Ó­×§ï¸s²Õ©Î§ïÅÜ¸s²Õ±K½X¡A{\ttfamily /etc/gshadow} ÀÉ³£±N³Q§ïÅÜ¡C



{\ttfamily groups}, {\ttfamily groupadd}, {\ttfamily groupmod}, ©M 
{\ttfamily groupdel} µ{¦¡¬O¥Î¨Ó¨ÑÀ³  {\itshape Shadow Suite\/} ³¡¤À¥i¥HÅÜ§ó¸s²Õ¡C

{\ttfamily /etc/group} ÀÉ®æ¦¡¦p¤U¡G
\begin{tscreen}
\begin{verbatim}
groupname:!:GID:member,member,...
\end{verbatim}
\end{tscreen}

¨ä¤¤¡G
\begin{description}
\item[{\ttfamily groupname}] \mbox{}

The name of the group

\item[{\ttfamily !}] \mbox{}

The field that normally holds the password, but that
is now relocated to the {\ttfamily /etc/gshadow} file.

\item[{\ttfamily GID}] \mbox{}

The numerical group ID number

\item[{\ttfamily member}] \mbox{}

List of group members

\end{description}


{\ttfamily /etc/gshadow} ÀÉ®æ¦¡¦p¤U¡G
\begin{tscreen}
\begin{verbatim}
groupname:password:admin,admin,...:member,member,...
\end{verbatim}
\end{tscreen}

¨ä¤¤¡G
\begin{description}
\item[{\ttfamily groupname}] \mbox{}

The name of the group

\item[{\ttfamily password}] \mbox{}

The encoded group password.

\item[{\ttfamily admin}] \mbox{}

List of group administrators 

\item[{\ttfamily member}] \mbox{}

List of group members

\end{description}


{\ttfamily gpasswd} «ü¥O¬O¥Î¦b·s¼W©Î²¾°£ºÞ²zªÌ©M¸s²Õ¦¨­û¡C {\ttfamily root} ©Î¨ä¥L¦b
¸s²ÕºÞ²zªÌ¤H­û¥i·s¼W©Î²¾°£¸s²Õ¦¨­û¡C

¸s²Õ±K½X¥i¥H³z¹L {\ttfamily passwd} «ü¥O§ïÅÜ¡A»Ý³z¹L 
{\itshape root\/} ©Î¦b¸Ó¸s²ÕºÞ²zªÌ¦³Åv­­ªº±b¸¹¤è¥i­×§ï¡C

Despite the fact that there is not currently a manual page for
{\ttfamily gpasswd}, typing {\ttfamily gpasswd} without any parameters gives a
listing of options.  It's fairly easy to grasp how it all works once you
understand the file formats and the concepts.






\subsection{ÀË¬dµ{¦¡¤@­P©Ê}






\subsubsection{pwck}

{\ttfamily pwck} µ{¦¡´£¨Ñ¦b {\ttfamily /etc/passwd} ©M {\ttfamily /etc/shadow} ÀÉªº¤@­P©ÊÀË¬d¡C
¥¦±NÀË¬d¨C­Ó¨Ï¥ÎªÌ¦WºÙ¥B¨Ì·Ó¤U¦C¨BÆJ½T»{¡G

\begin{itemize}
\item the correct number of fields
\item unique user name
\item valid user and group identifier
\item valid primary group
\item valid home directory
\item valid login shell
\end{itemize}


¥¦¤]·|Äµ§i¨S¦³±K½Xªº±b¸¹¡C

¦b¦w¸Ë {\itshape Shadow Suite\/} «á°õ¦æ {\ttfamily pwck} ¬O¤@­Ó«Ü¦nªºÂI¤l¡C
¥¦¤]¥i¥H¨C¶g©Î¨C¤ë¶g´Á©Êªº°õ¦æ¡C ¦pªG§A¨Ï¥Î {\ttfamily -r} °Ñ¼Æ¡A§A¥i¥H¥Î {\ttfamily cron} 
¨Ó°õ¦æ¥B¦¬¨ì¹q¤l¶l¥ó³ø§i




\subsubsection{grpck}

{\ttfamily grpck} ÀË¬d {\ttfamily /etc/group} ©M {\ttfamily /etc/gshadow} ÀÉ¤@­P©Êªºµ{¦¡¡C
¥¦§@¤U¦CÀË¬d¡G
\begin{itemize}
\item the correct number of fields
\item unique group name
\item valid list of members and administrators
\end{itemize}


¥¦¤]¦³ {\ttfamily -r} °Ñ¼Æ¦Û°Ê²£¥Í³øªí¡C




\subsection{Dial-up ±K½X}

Dial-up ±K½X¬O¥t¤@­Ó¹ï¨t²Î¨¾¿mªº¿ï¶µ¦C¡A¸Ó¨t²Î¤¹³\¼·±µ¦s¨ú¡C 
¦pªG§A¦³¤@­Ó¨t²Î¤¹³\³\¦h¤H°Ï°ìºô¸ô³sµ²¡A¦ý¬O§A·Q­­¨î¼·±µªºÅv­­¡A¨º§A»Ý¨Ï¥Î dial-up
±K½X¡C ¬°¤F­n¶}±Ò dial-up ±K½X¡A§A¥²¶·½s¿è {\ttfamily /etc/login.defs} ÀÉ¥B½T©w±N 
{\ttfamily DIALUPS\_CHECK\_ENAB} ³]©w¬° {\ttfamily yes}.

¦³¨â­ÓÀÉ®×¥]¬A dial-up ¸ê°T¡A {\ttfamily /etc/dialups} ¥]¬A ttys 
(one per line, with the leading "/dev/" removed)¡C
¦pªG tty ¦³³Q¦C¥X¡A dial-up ªí¥Ü¤w¸g³QÀË¬d¡C

²Ä¤G­ÓÀÉ¬O {\ttfamily /etc/d\_passwd} ¡C  ³o­ÓÀÉ¥]¬A shell ¥þ³¡¦Xªk¸ô®|¦WºÙ¡C

¦pªG¥H­Ó¨Ï¥ÎªÌÃ±¤J¤@±ø¦C¦b {\ttfamily /etc/dialups} ªº½u(line)¡A¥B¥Lªº shell ³Q¦C¦b
{\ttfamily /etc/d\_passwd} ÀÉ¡A¥L±N³Q¤¹³\¦s¨ú³z¹L´£¨Ñ¥¿½Tªº±K½X¡C

¥t¤@­Ó¨Ï¥Î dial-up ±K½Xªº¥Øªº¬O³]©w«ü¤¹³\¬Y¨Ç§Î¦¡³sµ²ªº½u(¥i¯à¬OPPP ©Î UUCP ³sµ²)¡C
¦pªG¤@­Ó¨Ï¥ÎªÌ¸ÕµÛ±o¨ì¥t¤@ºØ§Î¦¡³sµ² (i.e. a list of shells)¡A¥L¥²¶·ª¾¹D¨Ï¥Î³o±ø½uªº±K½X¡C

¦b§A¥i¥H¦b¥¼¨Ó¨Ï¥Î dial-up «e¡A§A±K»Ý«Ø¥ß¤@¨ÇÀÉ®×¡C

{\ttfamily dpasswd} «ü¥O´£¨Ñ¹ï¦b {\ttfamily /etc/d\_passwd} ÀÉªº shells «ü¬£±K½X¡C
¥i¥H¬Ý¾Þ§@¤â¥Uªº¨ì§ó¦h¸ê°T¡C








\section{¥[¤J shadow ¤ä´© C »y¨¥\label{sec-adding}}

·s¼W¤ä´© shadow µ{¦¡¨Æ¹ê¤W¬O«Üª½±µªº¡C °ß¤@ªº°ÝÃD¬Oµ{¦¡»Ý­n¥H root (©Î SUID root)
Åv­­°õ¦æ¡A³o¼Ë¤~¥i¥H¦s¨ú {\ttfamily /etc/shadow} ÀÉ¡C

³oÅã¥Ü¤@­Ó¤j°ÝÃD¡G ·í«Ø¥ß SUID µ{¦¡®É»Ý­n«Ü¤p¤ß¨Ì·Óµ{¦¡¹B§@¡CÁ|¨Ò»¡©ú¡G ¦pªG¥H­Ó
µ{¦¡¦³ shell escape¡A¦pªGµ{¦¡¥»¨­¬O SUID root ±N¤£»Ý­n¥H root ¤è¦¡§e²{¡C

¹ïµ{¦¡·s¼W¤ä´© shadow ¦Ó¨¥¡A¥¦¥i¥HÀË¬d±K½X¡A¦ý¤£»Ý¥H root Åv­­°õ¦æ¡A¦Ó¬O¥H SUID 
shadow ¨ú¥N°õ¦æ¤ñ¸û¦w¥þ¡C {\ttfamily xlock} µ{¦¡´N¬O¤@­Ó¨Ò¤l¡C

±µ¤U¨Ó½d¨Ò¤¶²Ð¡A {\ttfamily pppd-1.2.1d} ¤w¸g¥H SUID as root ¤è¦¡°õ¦æ¡A©Ò¥H·s¼W shadow
¤ä´©À³¸Ó¤£·|¨Ïµ{¦¡²£¥Í¥ô¦ó¼vÅT¡C 






\subsection{¼ÐÀYÀÉ(Header files)}

¼ÐÀYÀÉÀ³¦s¦b {\ttfamily /usr/include/shadow}¡C À³¸Ó¦³¤@­Ó {\ttfamily /usr/include/shadow.h}ÀÉ¡A
¦ý¬O¥¦±N symbolic link ¨ì {\ttfamily /usr/include/shadow/shadow.h}¡C

¬°¤F·s¼W¤ä´© shadow µ{¦¡¡A§A»Ý­n include ¼ÐÀYÀÉ¡G

\begin{verbatim}
#include <shadow/shadow.h>
#include <shadow/pwauth.h>
\end{verbatim}







\subsection{libshadow.a ¨ç¦¡®w(library)}

·í§A¦w¸Ë {\itshape Shadow Suite\/}¡A {\ttfamily libshadow.a} ÀÉ³Q«Ø¥ß©M¦w¸Ë¦b
{\ttfamily /usr/lib} ¥Ø¿ý¡C

·í½sÄ¶¤@­Ó shadow support µ{¦¡¡Alinker »Ý­n¥]¬A {\ttfamily libshadow.a} ¨ç¦¡®w¶i¤JÃìµ²¡C



°õ¦æ¦p¤U¡G
\begin{tscreen}
\begin{verbatim}
gcc program.c -o program -lshadow
\end{verbatim}
\end{tscreen}


µM¦Ó¡A´N¹³§Ú­Ì±µ¤U¨Ó­n¬Ýªº¨Ò¤l¡A¤j³¡¤À¤jµ{¦¡¨Ï¥Î {\ttfamily Makefile} ¥B
³q±`¦³ÅÜ¼Æ©I¥s {\ttfamily LIBS=...} »Ý­n³Q­×§ï¡C




\subsection{Shadow µ²ºc(Structure)}

{\ttfamily libshadow.a} ¨ç¦¡®w¹ï¥¦±q {\ttfamily /etc/shadow} ÀÉ±µ¦¬¸ê°T¨Ï¥Îµ²ºc¤Æ©I¥s¡C
³o¬O±q {\ttfamily /usr/include/shadow/shadow.h} ¼ÐÀYÀÉªº {\ttfamily spwd} µ²ºc©w¸q¡G

\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
struct spwd
{
  char *sp_namp;                /* login name */
  char *sp_pwdp;                /* encrypted password */
  sptime sp_lstchg;             /* date of last change */
  sptime sp_min;                /* minimum number of days between changes */
  sptime sp_max;                /* maximum number of days between changes */
  sptime sp_warn;               /* number of days of warning before password
                                   expires */
  sptime sp_inact;              /* number of days after password expires
                                   until the account becomes unusable. */
  sptime sp_expire;             /* days since 1/1/70 until account expires
*/
  unsigned long sp_flag;        /* reserved for future use */
};
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}


{\itshape Shadow Suite\/} ¥i¥H©ñ°£¤F½s½X±K½X¤§¥~ªº¸ê®Æ¨ì {\ttfamily sp\_pwdp} Äæ¦ì¡C
±K½XÄæ¦ì¥i¥]¬A¡G
\begin{tscreen}
\begin{verbatim}
username:Npge08pfz4wuk;@/sbin/extra:9479:0:10000::::
\end{verbatim}
\end{tscreen}


³oªí¥Ü¤@­ÓÃB¥~ªº±K½X¡A {\ttfamily /sbin/extra} µ{¦¡À³¸Ó³Q§ó¦hªºÅv­­©I¥s¡C 
µ{¦¡ªº©I¥s»Ý¨ú±o¨Ï¥ÎªÌ¦WºÙ©M«ü¥X¬°¦ó»Ý³Q©I¥sªº switch¤~¥i³q¹L¡C ¬d¬Ý
{\ttfamily /usr/include/shadow/pwauth.h} ©M­ì©l½X {\ttfamily pwauth.c} Àò±o§ó¦h¸ê°T¡C

¬°¦ó§Ú­ÌÀ³¨Ï¥Î {\ttfamily pwauth} ¥hªí¥Ü¯u¥¿ªºÅv­­¡A³o¬O¤°»ò·N«ä¡A¥¦±N¨Ï²Ä¤G²ÕÅv­­¤]
¶]±o«Ü¦n¡C

{\itshape Shadow Suite\/} §@ªÌ«ü¥X¦]¬°¤j³¡¤À¦s¦bªºµ{¦¡³£¤£³o»ò§@Åo¡A©Ò¥H
{\itshape Shadow Suite\/}¥¼¨Óªºª©¥»±N²¾°£¡C




\subsection{Shadow ¨ç¦¡(Functions)}

{\ttfamily shadow.h} ¥]§t {\ttfamily libshadow.a} ¨ç¦¡®w¡G
\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
extern void setspent __P ((void));
extern void endspent __P ((void));
extern struct spwd *sgetspent __P ((__const char *__string));
extern struct spwd *fgetspent __P ((FILE *__fp));
extern struct spwd *getspent __P ((void));
extern struct spwd *getspnam __P ((__const char *__name));
extern int putspent __P ((__const struct spwd *__sp, FILE *__fp));
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}


§Ú­Ì±N¨Ï¥Îªº½d¨Òµ{¦¡¬O¡G {\ttfamily getspnam} ±N¹ï¨ÑÀ³¦WºÙ«ì´_¹ï§Ú­Ì {\ttfamily spwd} µ²ºc¡C




\subsection{½d¨Ò}

³o¬O¤@­Ó½d¨Ò´y­z·s¼W shadow ¤ä´©µ{¦¡¡A¦ý¹w³]­È¨Ã¨S¦³¡C



¥»½d¨Ò¨Ï¥Î {\itshape Point-to-Point Protocol Server\/} (pppd-1.2.1d)¡A¥¦¦³­Ó¼Ò¦¡¬Oªí¥Ü 
±q {\ttfamily /etc/passwd} ÀÉ¨ú¥N {\itshape PAP\/} ©Î {\itshape CHAP\/} ÀÉ¨Ï¥Î±b¸¹±K½Xªº {\itshape PAP\/} 
Åv­­¡A§A±N¤£»Ý­n¦b {\ttfamily pppd-2.2.0} ¥[³o¨Çµ{¦¡½X¡A¦]¬°¥¦¤w¸g¦s¦bÅo¡C





pppd ªº¥¼¨Ó¤j­P¤W¤£·|³Q¨Ï¥Î«Ü¦h¡A¦ý¬O¦pªG§A¦w¸Ë {\itshape Shadow Suite\/}¡AÀx¦s¦b
{\ttfamily /etc/passwd} ÀÉªº±K½X±NµLªk¹B§@¡C

¦b {\ttfamily pppd-1.2.1d} Åv­­¨Ï¥Îªºµ{¦¡½X¬O¦ì¦b {\ttfamily /usr/src/pppd-1.2.1d/pppd/auth.c} ÀÉ¡C

±µ¤U¨Óµ{¦¡½X»Ý­n³Q¥[¦b©Ò¦³¨ä¥L {\ttfamily \#include} «ü¥OÀÉ®×ªº³Ì¤WÀY¡A§Ú­Ì±Nª`·N¦³Àô¹Ò«ü¥Oªº
{\ttfamily \#includes}¡C

\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
#ifdef HAS_SHADOW
#include <shadow.h>
#include <shadow/pwauth.h>
#endif
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}
 

±µ¤U¨Ó­n°µªº¨Æ±¡¬OÅÜ§ó¹ê»Ú½X¡A §Ú­Ì±NÅÜ§ó {\ttfamily auth.c} ÀÉ¡C

ÅÜ§ó«e {\ttfamily auth.c} ÀÉ function ¬°¡G
\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
/*
 * login - Check the user name and password against the system
 * password database, and login the user if OK.
 *
 * returns:
 *      UPAP_AUTHNAK: Login failed.
 *      UPAP_AUTHACK: Login succeeded.
 * In either case, msg points to an appropriate message.
 */
static int
login(user, passwd, msg, msglen)
    char *user;
    char *passwd;
    char **msg;
    int *msglen;
{
    struct passwd *pw;
    char *epasswd;
    char *tty;

    if ((pw = getpwnam(user)) == NULL) {
        return (UPAP_AUTHNAK);
    }
     /*
     * XXX If no passwd, let them login without one.
     */
    if (pw->pw_passwd == '\0') {
        return (UPAP_AUTHACK);
    }

    epasswd = crypt(passwd, pw->pw_passwd);
    if (strcmp(epasswd, pw->pw_passwd)) {
        return (UPAP_AUTHNAK);
    }

    syslog(LOG_INFO, "user %s logged in", user);

    /*
     * Write a wtmp entry for this user.
     */
    tty = strrchr(devname, '/');
    if (tty == NULL)
        tty = devname;
    else
        tty++;
    logwtmp(tty, user, "");             /* Add wtmp login entry */
    logged_in = TRUE;

    return (UPAP_AUTHACK);
}
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}


¨Ï¥ÎªÌªº±K½X³Q©ñ¦b {\ttfamily pw-{$>$}pw\_passwd}¡A©Ò¥H§Ú­Ì»Ý·s¼W {\ttfamily getspnam}
function¡A³o±N·|§â±K½X©ñ¨ì {\ttfamily spwd-{$>$}sp\_pwdp}¡C

§Ú­Ì±N·s¼W {\ttfamily pwauth} function ¨Óªí¥Ü¯u¥¿ªºÅv­­¡C ³o±N¦b shadow ÀÉ³]©w®É
¦Û°Ê²£¥Í²Ä¤G­ÓÅv­­¡C

ÅÜ§ó¬°¥i¥H¤ä´© shadow «áªº {\ttfamily auth.c} function¡G

\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
/*
 * login - Check the user name and password against the system
 * password database, and login the user if OK.
 *
 * This function has been modified to support the Linux Shadow Password
 * Suite if USE_SHADOW is defined.
 *
 * returns:
 *      UPAP_AUTHNAK: Login failed.
 *      UPAP_AUTHACK: Login succeeded.
 * In either case, msg points to an appropriate message.
 */
static int
login(user, passwd, msg, msglen)
    char *user;
    char *passwd;
    char **msg;
    int *msglen;
{
    struct passwd *pw;
    char *epasswd;
    char *tty;

#ifdef USE_SHADOW
    struct spwd *spwd;
    struct spwd *getspnam();
#endif

    if ((pw = getpwnam(user)) == NULL) {
        return (UPAP_AUTHNAK);
    }

#ifdef USE_SHADOW
        spwd = getspnam(user);
        if (spwd)
                pw->pw_passwd = spwd->sp-pwdp;
#endif
 
     /*
     * XXX If no passwd, let NOT them login without one.
     */
    if (pw->pw_passwd == '\0') {
        return (UPAP_AUTHNAK);
    }
#ifdef HAS_SHADOW
    if ((pw->pw_passwd && pw->pw_passwd[0] == '@'
         && pw_auth (pw->pw_passwd+1, pw->pw_name, PW_LOGIN, NULL))
        || !valid (passwd, pw)) {
        return (UPAP_AUTHNAK);
    }
#else
    epasswd = crypt(passwd, pw->pw_passwd);
    if (strcmp(epasswd, pw->pw_passwd)) {
        return (UPAP_AUTHNAK);
    }
#endif

    syslog(LOG_INFO, "user %s logged in", user);

    /*
     * Write a wtmp entry for this user.
     */
    tty = strrchr(devname, '/');
    if (tty == NULL)
        tty = devname;
    else
        tty++;
    logwtmp(tty, user, "");             /* Add wtmp login entry */
    logged_in = TRUE;

    return (UPAP_AUTHACK);
}
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}


ÄYÂÔªº½d¨Ò±N±Òµo§Ú­Ì¦b§@¨ä¥L§ïÅÜªºÀ°§U¡C ­ì©lªºª©¥»¦pªG¦b {\ttfamily /etc/passwd} ÀÉ
¨S¦³¥ô¦ó±K½X¡A¥i¤¹³\¦s¨ú¶Ç¦^ªº {\ttfamily UPAP\_AUTHACK} ¡C³o¬O{\itshape ¤£\/}¦nªº¡A¦]¬°
Ã±¤Jªº¨Ï¥Î¬O¨Ï¥Î¤@­Ó¤¹³\¦s¨ú PPP processªº±b¸¹¡AµM«áÀË¬d±b¸¹±K½X¡A¸Ó±b¸¹±K½X¬O¥Ñ
RAP ¡B¦b {\ttfamily /etc/passwd} ÀÉªº±b¸¹©M {\ttfamily /etc/shadow} ÀÉªº±K½X¨ÑÀ³¡C



©Ò¥H¦pªG§Ú­Ì³]©w­ì¥»ª©¥»¹ï¨C­Ó¨Ï¥ÎªÌ¡A¦p {\ttfamily ppp} ¥i¥H¦b shell °õ¦æ¡AµM«á¥ô¦ó¤H¥i¥H
Àò±o ppp Ãìµ²³z¹L³]©w¥L­Ì¹ï¨Ï¥ÎªÌ {\ttfamily ppp} ªº PAP ©M null ªº±K½X¡C



§Ú­Ì­×¥¿ {\ttfamily UPAP\_AUTHNAK} ¨ú¥N
{\ttfamily UPAP\_AUTHACK} ¦pªG±K½XÄæ¦ì¬OªÅªº¡C

¦³½ìªº¬O {\ttfamily pppd-2.2.0} ¦³¬Û¦Pªº°ÝÃD¡C

±µ¤U¨Ó§Ú­Ì»Ý­nÅÜ§ó Makefile ¥H«KÅý¨â¥ó¨Æµo¥Í¡G

{\ttfamily USE\_SHADOW} ¥²¶·³Q­«·s©w¸q¥B{\ttfamily libshadow.a} »Ý­n³Q·s¼W¨ìÃìµ² process¡C



½s¿è Makefile ¥B·s¼W¡G
\begin{tscreen}
\begin{verbatim}
LIBS = -lshadow
\end{verbatim}
\end{tscreen}


µM«á§Ú­Ì§ä¨ì³o¤@¦æ¡G
\begin{tscreen}
\begin{verbatim}
COMPILE_FLAGS = -I.. -D_linux_=1 -DGIDSET_TYPE=gid_t
\end{verbatim}
\end{tscreen}


µM«á§ïÅÜ¥¦ÅÜ¦¨¡G
\begin{tscreen}
\begin{verbatim}
COMPILE_FLAGS = -I.. -D_linux_=1 -DGIDSET_TYPE=gid_t -DUSE_SHADOW
\end{verbatim}
\end{tscreen}


²{¦b°õ¦æ make ¸ò install.




\section{±`°Ý°ÝÃD¤Îµª®×}

{\itshape Q:\/} §Ú¥Î tty's ¥Î{\itshape root\/} Åv­­¨Ï¥Î {\ttfamily /etc/securettys} ÀÉ¡A¦ý¬O³£¨S¦³
¥ô¦ó¹B§@¡A¸Ó¦p¦ó¸Ñ¨M¡H

{\itshape A:\/} {\ttfamily /etc/securettys} ÀÉ¦b {\itshape Shadow Suite\/} ¦w¸Ë«á´N¤£¨ã¥ô¦ó·N¸qÅo¡C

tty's ¥Î {\itshape root\/} Åv­­¥i¥H¨Ï¥Î¤@­Ó©ñ¦b {\ttfamily /etc/login.defs} Ã±¤J³]©wÀÉ¶i¦æ­×§ï¡C
¸Ó³]©wÀÉ¤]¥i¯à«ü¨ì¥t¤@­ÓÀÉ¡C





{\itshape Q:\/} §Ú¹ï {\itshape Shadow Suite\/} ¶i¦æ¦w¸Ë«á¡A²{¦b§Ú¨S¿ìªkÃ±¤J(login)¨t²Î¡A
§Ú¦³©¿²¤¤°»ò¨BÆJ¶Ü¡H

{\itshape A:\/} §A¬O¯uªº¦w¸Ë Shadow µ{¦¡Åo¡A¦ý¬O¨Ã¥¼°õ¦æ {\ttfamily pwconv} ©Î§A§Ñ°O½Æ»s
{\ttfamily /etc/npasswd} ¨ì {\ttfamily /etc/passwd} ¥B½Æ»s {\ttfamily /etc/nshadow} ¨ì 
{\ttfamily /etc/shadow}Åo¡C §A¤]»Ý­n½Æ»s {\ttfamily login.defs} ¨ì {\ttfamily /etc}¡C



{\itshape Q:\/} ¦b xlock ¨º¤@³¹¸`¦³´£¨ì§ïÅÜ {\ttfamily /etc/shadow} ÀÉªº¸s²Õ¾Ö¦³ªÌ¨ì
{\ttfamily shadow}¡C§Ú¨S¦³ {\ttfamily shadow} ¸s²Õ¡A¸Ó¦p¦ó³B²z¡H

{\itshape A:\/} §A¥i¥H·s¼W¤@­Ó¡C Â²³æªº½s¿è {\ttfamily /etc/group} ÀÉ¡AµM«á·s¼W¤@¦æµ¹
shadow ¸s²Õ¡A§A»Ý­n½T»{¸s²Õ½s¸¹¨Ã¥¼³Q¨ä¥L¸s²Õ¨Ï¥Î¡A¥B§A»Ý­n¦b {\ttfamily nogroup} 
¬ö¿ý¤§«e´¡¤J¸Ó³]©w¡C ©Î³o§A¥i¥HÂ²¤Æ¹ï rootÅv­­³]©w suid {\ttfamily xlock}¡C   



{\itshape Q:\/} ¦³¥ô¦ó¹ï Linux Shadow Password Suite ªº¹q¤l¶l¥ó¦Cªí¶Ü¡H

{\itshape A:\/} ¦³¡A¦ý¬O¥¦ªº¥Øªº¬O°w¹ï Linux ¤U¤@­Ó Shadow Suiteª©¥»µo®i¸ò´ú¸Õ¡A§A¥i¥H
¨ì{\ttfamily shadow-list-request@neptune.cin.net} ¹q¤l¶l¥óºK­n¿é¤J¡G 
{\ttfamily subscribe}¡C  ³o¬O¦b°Q½× Linux {\ttfamily shadow-YYMMSS}¨t¦Cª©¥»¡C§AÀ³¸Ó°Ñ¥[¦pªG§A
·Q°Ñ¤©¥¼¨Óµo®i©Î§A¦w¸Ë Suite ¦b§Aªº¹q¸£¥B·Q­n±o¨ì·sª©¥»ªº¸ê°T¡C



{\itshape Q:\/} §Ú¦w¸Ë {\itshape Shadow Suite\/}¡A¦ý¬O·í§Ú¨Ï¥Î {\ttfamily userdel} ©R¥O«á¡A
§Ú±o¨ì "userdel: cannot open shadow group file" °T®§¡A§Ú¦³­þ¸Ì§@¿ù¤F¶Ü¡H



{\itshape A:\/} §A½sÄ¶ {\itshape Shadow Suite\/} ®É¦³¶}±Ò {\ttfamily SHADOWGRP} ¿ï¶µ¡A¦ý¬O
§A¨S¦³¤@­Ó {\ttfamily /etc/gshadow} ÀÉ®×¡A§A»Ý­n½s¿è {\ttfamily config.h} ÀÉ©M­«·s½s
Ä¶©Î«Ø¥ß¤@­Ó {\ttfamily /etc/group} ÀÉ¡A½Ð¬Ý shadow groups ¨º¤@¸`¡C



{\itshape Q:\/} §Ú¦w¸Ë {\itshape Shadow Suite\/} ¦ý¬O§ÚµLªk§ä¨ì½s½X±K½X¦b§Úªº
{\ttfamily /etc/passwd} ÀÉ¡Aµo¥Í¤°»ò°ÝÃD¡H

{\itshape A:\/} §A¥i¯à¦b Shadow {\ttfamily config.h} ÀÉ¶}±Ò {\ttfamily AUTOSHADOW} ¿ï¶µ©ÎªÌ
§Aªº {\ttfamily libc} ³Q {\ttfamily SAHDOW\_COMPAT} ¿ï¶µ½sÄ¶¡A§A»Ý­n¨M©w¬O­þ­Ó°ÝÃD¡AµM«á
¦A­«·s½sÄ¶¡C




\section{ª©ÅvÁn©ú(¼È¤£Â½Ä¶)}

The Linux Shadow Password HOWTO is Copyright (c) 1996 Michael H. Jackson.

Permission is granted to make and distribute verbatim copies of
this document provided the copyright notice and this permission notice
are preserved on all copies.

Permission is granted to copy and distribute modified versions of this
document under the conditions for verbatim copies above, provided a notice
clearly stating that the document is a modified version is also included in
the modified document.

Permission is granted to copy and distribute translations of this document
into another language, under the conditions specified above for modified
versions.

Permission is granted to convert this document into another media under
the conditions specified above for modified versions provided the requirement
to acknowledge the source document is fulfilled by inclusion of an obvious
reference to the source document in the new media. Where there is any
doubt as to what defines 'obvious' the copyright owner reserves the right
to decide.




\section{Miscellaneous and Acknowledgments.}

The code examples for {\ttfamily auth.c} are taken from pppd-1.2.1d and
ppp-2.1.0e, Copyright (c) 1993 and The Australian National University and
Copyright (c) 1989 Carnegie Mellon University.

Thanks to Marek Michalkiewicz $<$marekm@i17linuxb.ists.pwr.wroc.pl{$>$} for
writing and maintaining the {\itshape Shadow Suite\/} for Linux, and for his
review and comments on this document.

Thanks to Ron Tidd $<$rtidd@tscnet.com{$>$} for his helpful review and testing.

Thanks to everyone who has sent me feedback to help improve this document.

Please, if you have any comments or suggestions then mail them to me.

regards

\onlynameurl{Michael H. Jackson $<$mhjack@tscnet.com{$>$}}



\end{document}
