[Pkg-shadow-devel] Bug#685415: [PATCH]: improve the example login.defs configuration file
Christian PERRIER
bubulle at debian.org
Mon Aug 20 16:44:29 UTC 2012
Package: shadow
Severity: wishlist
Tags: patch
----- Forwarded message from Guido Trentalancia <guido at trentalancia.com> -----
Date: Mon, 20 Aug 2012 12:52:48 +0200
From: Guido Trentalancia <guido at trentalancia.com>
To: nicolas.francois at centraliens.net
Cc: pkg-shadow-devel at lists.alioth.debian.org
Subject: [Pkg-shadow-devel] [PATCH]: improve the example login.defs configuration file
X-Mailer: Webmail Client v1.5
Reply-To: Guido Trentalancia <guido at trentalancia.com>
X-CRM114-Status: Good ( pR: 15.3875 )
Slightly improve the login.defs configuration file by fixing a few typographic errors
and by trying to use a better format.
Signed-off-by: Guido Trentalancia <guido at trentalancia.com>
---
etc/login.defs | 102 ++++++++++++++++++++++++++++-----------------------------
1 file changed, 51 insertions(+), 51 deletions(-)
--- shadow-4.1.5/etc/login.defs 2010-03-26 12:54:25.000000000 +0100
+++ shadow-4.1.5-login_defs_typo/etc/login.defs 2012-08-20 12:58:36.066488267 +0200
@@ -6,18 +6,18 @@
#
# Delay in seconds before being allowed another attempt after a login failure
-# Note: When PAM is used, some modules may enfore a minimal delay (e.g.
-# pam_unix enforces a 2s delay)
+# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
+# pam_unix(8) enforces a 2s delay)
#
FAIL_DELAY 3
#
-# Enable logging and display of /var/log/faillog login failure info.
+# Enable logging and display of /var/log/faillog login(1) failure info.
#
FAILLOG_ENAB yes
#
-# Enable display of unknown usernames when login failures are recorded.
+# Enable display of unknown usernames when login(1) failures are recorded.
#
LOG_UNKFAIL_ENAB no
@@ -27,7 +27,7 @@ LOG_UNKFAIL_ENAB no
LOG_OK_LOGINS no
#
-# Enable logging and display of /var/log/lastlog login time info.
+# Enable logging and display of /var/log/lastlog login(1) time info.
#
LASTLOG_ENAB yes
@@ -50,13 +50,13 @@ OBSCURE_CHECKS_ENAB yes
PORTTIME_CHECKS_ENAB yes
#
-# Enable setting of ulimit, umask, and niceness from passwd gecos field.
+# Enable setting of ulimit, umask, and niceness from passwd(5) gecos field.
#
QUOTAS_ENAB yes
#
-# Enable "syslog" logging of su activity - in addition to sulog file logging.
-# SYSLOG_SG_ENAB does the same for newgrp and sg.
+# Enable "syslog" logging of su(1) activity - in addition to sulog file logging.
+# SYSLOG_SG_ENAB does the same for newgrp(1) and sg(1).
#
SYSLOG_SU_ENAB yes
SYSLOG_SG_ENAB yes
@@ -64,13 +64,13 @@ SYSLOG_SG_ENAB yes
#
# If defined, either full pathname of a file containing device names or
# a ":" delimited list of device names. Root logins will be allowed only
-# upon these devices.
+# from these devices.
#
CONSOLE /etc/securetty
#CONSOLE console:tty01:tty02:tty03:tty04
#
-# If defined, all su activity is logged to this file.
+# If defined, all su(1) activity is logged to this file.
#
#SULOG_FILE /var/log/sulog
@@ -82,33 +82,33 @@ MOTD_FILE /etc/motd
#MOTD_FILE /etc/motd:/usr/lib/news/news-motd
#
-# If defined, this file will be output before each login prompt.
+# If defined, this file will be output before each login(1) prompt.
#
#ISSUE_FILE /etc/issue
#
# If defined, file which maps tty line to TERM environment parameter.
-# Each line of the file is in a format something like "vt100 tty01".
+# Each line of the file is in a format similar to "vt100 tty01".
#
#TTYTYPE_FILE /etc/ttytype
#
-# If defined, login failures will be logged here in a utmp format.
-# last, when invoked as lastb, will read /var/log/btmp, so...
+# If defined, login(1) failures will be logged here in a utmp format.
+# last(1), when invoked as lastb(1), will read /var/log/btmp, so...
#
FTMP_FILE /var/log/btmp
#
-# If defined, name of file whose presence which will inhibit non-root
-# logins. The contents of this file should be a message indicating
+# If defined, name of file whose presence will inhibit non-root
+# logins. The content of this file should be a message indicating
# why logins are inhibited.
#
NOLOGINS_FILE /etc/nologin
#
# If defined, the command name to display when running "su -". For
-# example, if this is defined as "su" then a "ps" will display the
-# command is "-su". If not defined, then "ps" would display the
+# example, if this is defined as "su" then ps(1) will display the
+# command as "-su". If not defined, then ps(1) will display the
# name of the shell actually being run, e.g. something like "-sh".
#
SU_NAME su
@@ -158,10 +158,10 @@ ENV_PATH PATH=/bin:/usr/bin
# TTYGROUP Login tty will be assigned this group ownership.
# TTYPERM Login tty will be set to this permission.
#
-# If you have a "write" program which is "setgid" to a special group
-# which owns the terminals, define TTYGROUP to the group number and
-# TTYPERM to 0620. Otherwise leave TTYGROUP commented out and assign
-# TTYPERM to either 622 or 600.
+# If you have a write(1) program which is "setgid" to a special group
+# which owns the terminals, define TTYGROUP as the number of such group
+# and TTYPERM as 0620. Otherwise leave TTYGROUP commented out and
+# set TTYPERM to either 622 or 600.
#
TTYGROUP tty
TTYPERM 0600
@@ -183,13 +183,13 @@ ERASECHAR 0177
KILLCHAR 025
#ULIMIT 2097152
-# Default initial "umask" value used by login on non-PAM enabled systems.
-# Default "umask" value for pam_umask on PAM enabled systems.
-# UMASK is also used by useradd and newusers to set the mode of new home
-# directories.
+# Default initial "umask" value used by login(1) on non-PAM enabled systems.
+# Default "umask" value for pam_umask(8) on PAM enabled systems.
+# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
+# home directories.
# 022 is the default value, but 027, or even 077, could be considered
-# better for privacy. There is no One True Answer here: each sysadmin
-# must make up her mind.
+# for increased privacy. There is no One True Answer here: each sysadmin
+# must make up his/her mind.
UMASK 022
#
@@ -214,12 +214,12 @@ PASS_WARN_AGE 7
SU_WHEEL_ONLY no
#
-# If compiled with cracklib support, where are the dictionaries
+# If compiled with cracklib support, sets the path to the dictionaries
#
CRACKLIB_DICTPATH /var/cache/cracklib/cracklib_dict
#
-# Min/max values for automatic uid selection in useradd
+# Min/max values for automatic uid selection in useradd(8)
#
UID_MIN 1000
UID_MAX 60000
@@ -228,7 +228,7 @@ SYS_UID_MIN 101
SYS_UID_MAX 999
#
-# Min/max values for automatic gid selection in groupadd
+# Min/max values for automatic gid selection in groupadd(8)
#
GID_MIN 1000
GID_MAX 60000
@@ -237,12 +237,12 @@ SYS_GID_MIN 101
SYS_GID_MAX 999
#
-# Max number of login retries if password is bad
+# Max number of login(1) retries if password is bad
#
LOGIN_RETRIES 5
#
-# Max time in seconds for login
+# Max time in seconds for login(1)
#
LOGIN_TIMEOUT 60
@@ -264,12 +264,12 @@ PASS_ALWAYS_WARN yes
#PASS_MAX_LEN 8
#
-# Require password before chfn/chsh can make any changes.
+# Require password before chfn(1)/chsh(1) can make any changes.
#
CHFN_AUTH yes
#
-# Which fields may be changed by regular users using chfn - use
+# Which fields may be changed by regular users using chfn(1) - use
# any combination of letters "frwh" (full name, room number, work
# phone, home phone). If not defined, no changes are allowed.
# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
@@ -294,13 +294,13 @@ CHFN_RESTRICT rwh
# Note: If you use PAM, it is recommended to use a value consistent with
# the PAM modules configuration.
#
-# This variable is deprecated. You should use ENCRYPT_METHOD.
+# This variable is deprecated. You should use ENCRYPT_METHOD instead.
#
#MD5_CRYPT_ENAB no
#
# Only works if compiled with ENCRYPTMETHOD_SELECT defined:
-# If set to MD5 , MD5-based algorithm will be used for encrypting password
+# If set to MD5, MD5-based algorithm will be used for encrypting password
# If set to SHA256, SHA256-based algorithm will be used for encrypting password
# If set to SHA512, SHA512-based algorithm will be used for encrypting password
# If set to DES, DES-based algorithm will be used for encrypting password (default)
@@ -315,12 +315,12 @@ CHFN_RESTRICT rwh
# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
#
# Define the number of SHA rounds.
-# With a lot of rounds, it is more difficult to brute forcing the password.
-# But note also that it more CPU resources will be needed to authenticate
-# users.
+# With a lot of rounds, it is more difficult to brute-force the password.
+# However, more CPU resources will be needed to authenticate users if
+# this value is increased.
#
# If not specified, the libc will choose the default number of rounds (5000).
-# The values must be inside the 1000-999999999 range.
+# The values must be within the 1000-999999999 range.
# If only one of the MIN or MAX values is set, then this value will be used.
# If MIN > MAX, the highest value will be used.
#
@@ -329,18 +329,18 @@ CHFN_RESTRICT rwh
#
# List of groups to add to the user's supplementary group set
-# when logging in on the console (as determined by the CONSOLE
+# when logging in from the console (as determined by the CONSOLE
# setting). Default is none.
#
# Use with caution - it is possible for users to gain permanent
-# access to these groups, even when not logged in on the console.
+# access to these groups, even when not logged in from the console.
# How to do it is left as an exercise for the reader...
#
#CONSOLE_GROUPS floppy:audio:cdrom
#
# Should login be allowed if we can't cd to the home directory?
-# Default in no.
+# Default is no.
#
DEFAULT_HOME yes
@@ -362,14 +362,14 @@ ENVIRON_FILE /etc/environment
# (examples: 022 -> 002, 077 -> 007) for non-root users, if the uid is
# the same as gid, and username is the same as the primary group name.
#
-# This also enables userdel to remove user groups if no members exist.
+# This also enables userdel(8) to remove user groups if no members exist.
#
USERGROUPS_ENAB yes
#
-# If set to a non-nul number, the shadow utilities will make sure that
+# If set to a non-zero number, the shadow utilities will make sure that
# groups never have more than this number of users on one line.
-# This permit to support split groups (groups split into multiple lines,
+# This permits to support split groups (groups split into multiple lines,
# with the same group ID, to avoid limitation of the line length in the
# group file).
#
@@ -378,10 +378,10 @@ USERGROUPS_ENAB yes
#MAX_MEMBERS_PER_GROUP 0
#
-# If useradd should create home directories for users by default (non
-# system users only)
-# This option is overridden with the -M or -m flags on the useradd command
-# line.
+# If useradd(8) should create home directories for users by default (non
+# system users only).
+# This option is overridden with the -M or -m flags on the useradd(8)
+# command-line.
#
#CREATE_HOME yes
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-shadow-devel/attachments/20120820/753895e5/attachment.pgp>
More information about the Pkg-shadow-devel
mailing list