99 lines
3.0 KiB
Plaintext
99 lines
3.0 KiB
Plaintext
#
|
|
# Please note that the parameters in this configuration file control the
|
|
# behavior of the tools from the shadow-utils component. None of these
|
|
# tools uses the PAM mechanism, and the utilities that use PAM (such as the
|
|
# passwd command) should therefore be configured elsewhere. Refer to
|
|
# /etc/pam.d/system-auth for more information.
|
|
#
|
|
|
|
# *REQUIRED*
|
|
# Directory where mailboxes reside, _or_ name of file, relative to the
|
|
# home directory. If you _do_ define both, MAIL_DIR takes precedence.
|
|
# QMAIL_DIR is for Qmail
|
|
#
|
|
#QMAIL_DIR Maildir
|
|
MAIL_DIR /var/spool/mail
|
|
#MAIL_FILE .mail
|
|
|
|
# Default initial "umask" value used by login(1) on non-PAM enabled systems.
|
|
# Default "umask" value for pam_umask(8) on PAM enabled systems.
|
|
# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
|
|
# home directories if HOME_MODE is not set.
|
|
# 022 is the default value, but 027, or even 077, could be considered
|
|
# for increased privacy. There is no One True Answer here: each sysadmin
|
|
# must make up their mind.
|
|
UMASK 022
|
|
|
|
# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
|
|
# home directories.
|
|
# If HOME_MODE is not set, the value of UMASK is used to create the mode.
|
|
HOME_MODE 0700
|
|
|
|
# Password aging controls:
|
|
#
|
|
# PASS_MAX_DAYS Maximum number of days a password may be used.
|
|
# PASS_MIN_DAYS Minimum number of days allowed between password changes.
|
|
# PASS_MIN_LEN Minimum acceptable password length.
|
|
# PASS_WARN_AGE Number of days warning given before a password expires.
|
|
#
|
|
PASS_MAX_DAYS 99999
|
|
PASS_MIN_DAYS 0
|
|
PASS_MIN_LEN 5
|
|
PASS_WARN_AGE 7
|
|
|
|
#
|
|
# Min/max values for automatic uid selection in useradd
|
|
#
|
|
UID_MIN 1000
|
|
UID_MAX 60000
|
|
# System accounts
|
|
SYS_UID_MIN 201
|
|
SYS_UID_MAX 999
|
|
|
|
#
|
|
# Min/max values for automatic gid selection in groupadd
|
|
#
|
|
GID_MIN 1000
|
|
GID_MAX 60000
|
|
# System accounts
|
|
SYS_GID_MIN 201
|
|
SYS_GID_MAX 999
|
|
|
|
#
|
|
# If defined, this command is run when removing a user.
|
|
# It should remove any at/cron/print jobs etc. owned by
|
|
# the user to be removed (passed as the first argument).
|
|
#
|
|
#USERDEL_CMD /usr/sbin/userdel_local
|
|
|
|
#
|
|
# If useradd should create home directories for users by default
|
|
# On RH systems, we do. This option is overridden with the -m flag on
|
|
# useradd command line.
|
|
#
|
|
CREATE_HOME yes
|
|
|
|
# This enables userdel to remove user groups if no members exist.
|
|
#
|
|
USERGROUPS_ENAB yes
|
|
|
|
#
|
|
# If set to SHA256, SHA256-based algorithm will be used for encrypting password
|
|
# If set to SHA512, SHA512-based algorithm will be used for encrypting password
|
|
# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
|
|
#
|
|
ENCRYPT_METHOD SHA512
|
|
|
|
#
|
|
# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
|
|
#
|
|
# Define the number of SHA rounds.
|
|
# With a lot of rounds, it is more difficult to brute-force the password.
|
|
# However, more CPU resources will be needed to authenticate users if
|
|
# this value is increased.
|
|
#
|
|
# The values must be within the 1000-999999999 range.
|
|
#
|
|
SHA_CRYPT_MAX_ROUNDS 5000
|
|
|