\documentclass[letterpaper]{article}
\nonstopmode
\akai
\usepackage{linuxdoc-sgml}
\usepackage{qwertz}
\usepackage{url}
\usepackage[latin1]{inputenc}
\usepackage{t1enc}
\usepackage[english]{babel}
\usepackage{epsfig}
\usepackage{null}
\def\addbibtoc{
\addcontentsline{toc}{section}{\numberline{\mbox{}}\relax\bibname}
}%end-preamble
\setcounter{page}{1}
\title{ÈçºÎÈ¡µÃ£¬°²×°£¬Éè¶¨ shadow ÃÜÂë}
\author{×÷Õß:¡¡Michael H. Jackson, {\ttfamily \onlynameurl{mhjack@tscnet.com}}\\ 
                ÒëÕß:¡¡Sung Min-Ju, {\ttfamily \onlynameurl{songmj@ms1.hinet.net}}
                }
\date{v1.3, 3 April 1996
        ·­ÒëÈÕÆÚ:¡¡15 MAY 2000}
\abstract{Õâ·ÝÎÄ¼þÖ÷ÒªÃèÊöÈçºÎÈ¡µÃ£¬°²×°ºÍÉè¶¨ {\itshape Shadow Suite\/} ÃÜÂë¡£ËüÒ²ÃèÊöÈ¡µÃºÍ°²×°ÐèÒª´æÈ¡Ê¹ÓÃÕßÃÜÂëÖ®ÆäËûÈíÌåºÍÍøÂ·¼à¿Ø³ÌÊ½(network daemons)¡£ÕâÐ©ÆäËûÈíÌå²»ÊÇ Shadow Suit µÄÕæÊµ²¿·Ö£¬µ«ÊÇÕâÐ©³ÌÊ½½«ÐèÒª±»ÖØÐÂ±àÒëÓÃÒÔÖ§Ô®{\itshape Shadow Suite\/} ¡£Õâ·ÝÎÄ¼þÒà°üÀ¨Ò»¸ö³ÌÊ½¡õÀý£º¶Ô³ÌÊ½¼ÓÈë shadow Ö§Ô®¡£±¾ÎÄ½áÎ²²¿·ÖÎª³£ÎÊÎÊÌâ¼°´ð°¸¡£}


\begin{document}
\maketitle
\tableofcontents

\section{¼ò½é}

ÕâÆªÎÄÕÂÎª Linux Shadow-Password-HOWTO¡£  Ö÷ÒªÊÇÔÚÃèÊöÎªºÎ¼°ÈçºÎì¶ Linux ÏµÍ³¼ÓÈë
shadow ÃÜÂëÖ§Ô®¡£ ÆäÒà°üÀ¨ÈçºÎÊ¹ÓÃ {\itshape Shadow Suite's\/} Ä³Ð©¡õÀý¡£

µ±½øÐÐ {\itshape Shadow Suite\/} °²×°¼°Ê¹ÓÃÐí¶àµÄ utility ³ÌÊ½Ê±£®Äã±ØÐëÒÔ {\itshape root\/} 
È¨ÏÞÇ©Èë¡£ ÇÒ½øÐÐ {\itshape Shadow Suite\/} °²×°Ê±£¬ÏµÍ³ÈíÌå½«±»¸Ä±ä£¬Òò´ËÇ¿ÁÒµÄ½¨Òé
ÄúÕÕËµÃ÷µµ±¸·Ö³ÌÊ½¡£ÔÚ´ËÇ¿µ÷ÔÚÄú¿ªÊ¼×÷ÒµÇ°ÐèÏÈÔÄ¶Á¼°ÁË½âËùÓÐµÄËµÃ÷Êé¡£




\subsection{¸ü¸ÄÉÏÒ»°æ±¾²¿·Ö}

\begin{verbatim}
ÐÂÔö£º
        ÐÂÔöÒ»¸ö×Ó½Ú£ºÎªºÎÄú²»Òª°²×° shadow 
        ÐÂÔöÒ»¸ö×Ó½Ú£ºÐÞ¸Ä xdm ³ÌÊ½
        ÐÂÔöÒ»½Ú£ºÎªºÎÄú²»Òª°²×° shadow 
        ÐÂÔöÒ»½Ú£ºÈçºÎì¶Î´À´ÔË×÷ Shadow Suite 
        ÐÂÔöÒ»½Ú£º³£ÎÊÎÊÌâ¼°´ð°¸
        

¸üÕý/ÐÞ¸Ä£º
        ¸üÕýÔÚ Sunsite µÄ html ²Î¿¼×ÊÁÏ
        ¸üÕýÔÚ wu-ftp ½ÚÔÚ Makefile ÐÂÔö -lshadow
        ¸üÕý½Ï²»ÑÏÖØÆ´ÒôºÍ´ë´Ê´íÎó
        ¸ü¸Ä wu-ftp ½ÚÓÃÒÔÖ§Ô® ELF
        ÐÞ¸ÄÔÚ²»Í¬Ç©Èë(login)³ÌÊ½°²È«ÎÊÌâ 
        ÐÞ¸Ä Linux Shadow Suite ½¨ÒéÎª Marek Michalkiewicz
        
\end{verbatim}





\subsection{ÐÂ°æÎÄ¼þ}

Äú¿ÉÀûÓÃÄäÃûµµ½øÈë¸Ã FTP Õ¾ÏÂÔØ×îÐÂ°æÎÄ¼þ£º
{\bfseries sunsite.unc.edu}
\begin{verbatim}
/pub/Linux/docs/HOWTO/Shadow-Password-HOWTO
\end{verbatim}

or:
\begin{verbatim}
/pub/Linux/docs/HOWTO/other-formats/Shadow-Password-HOWTO{-html.tar,ps,dvi}.gz
\end{verbatim}


»òÍ¸¹ýÍøÕ¾£º
\nameurl{http://sunsite.unc.edu/mdw/linux.html}{Linux Documentation Project Web Server}£¬ÍøÒ³£º
\nameurl{http://sunsite.unc.edu/linux/HOWTO/Shadow-Password-HOWTO.html}{Shadow-Password-HOWTO}
»òÓëÎÒÁªÂç£º {\ttfamily $<$mhjack@tscnet.com{$>$}}. Òà¿ÉÍ¸¹ýÐÂÎÅÈº×éÕÅÌù£º
{\ttfamily comp.os.linux.answers}

ÕâÐ©ÎÄ¼þÏÖÔÚÒÑ¾­°üì¶ Shadow-YYDDMM Ì×¼þÖÐ¡£




\subsection{»Ø¸²}

Çë½«ÈÎºÎÆÀÓï¡¢ÐÞ¸Ä»ò½¨Òé¼ÄÖÁ£º
\onlynameurl{Michael H. Jackson $<$mhjack@tscnet.com{$>$}}  ÎÒ»á¾¡¿ì»Ø¸²²¢¸üÕý¸ÃÎÄ¼þ¡£
Èç¹ûÄã·¢ÏÖÈÎºÎÎÊÌâ£¬ÇëÖ±½Ó email ¸øÎÒ£¬ÎÒ»á½«´Ë×îÐÂ¼¼ÊõÕÅÌùì¶ÐÂÎÅÈº×é¡£




\section{ÎªºÎ shadow ÄãµÄ passwd µµ?}

´ó²¿·ÖÄ¿Ç° Linux ·¢ÐÐ°æ±¾Ô¤ÉèÖµ²¢Î´°üº¬{\itshape Shadow Suite\/} °²×°¡£
ÕâÐ©°æ±¾°üÀ¨ Slackware 2.3, Slackware 3.0 ºÍÆäËûÊÜ»¶Ó­µÄ·¢ÐÐ°æ±¾¡£
Ö÷ÒªÔ­ÒòÖ®Ò»ÊÇÔÚÔ­Ê¼{\itshape Shadow Suite\/}°æÈ¨ÉùÃ÷ÖÐ²¢Î´ºÜÇå³þµÄÃèÊö¸ÃÈíÌåÊÇ
·ñÐèÊ¹ÓÃÕß¸¶·Ñ¡£ Linux Ê¹ÓÃ GNU °æÈ¨Í¨³£ÔÊÐøÊ¹ÓÃÕß¿ÉÃâ·ÑÇÒÈÎÒâÊ¹ÓÃÏà¹ØÌ×¼þ¡£



{\itshape Shadow Suite\/}ÏÖÔÚÎ¬»¤ÈËÔ±\onlynameurl{Marek Michalkiewicz $<$marekm@i17linuxb.ists.pwr.wroc.pl{$>$}} 
ÒÑ¾­¿ÉÒÔ´ÓÔÚ BSD ÑùÊ½ÔÊÐèÔÙÊ¹ÓÃ°æÈ¨Ö®Ô­Ê¼×÷ÕßÄÇ½ÓÊÕÔ­Ê¼Âë¡£ Ä¿Ç°°æÈ¨·¢ÐÐÒÑ
½â¾ö£¬Òò´Ë¿ÉÒÔÔ¤ÆÚÔÚÎ´À´°æ±¾Ö®Ô¤ÉèÖµ½«°üÀ¨ password shadowing¡£ ¼´Ê¹Èç´Ë£¬
ÄãÈÔÐèÒª×ÔÐÐ°²×°¡£



Èç¹ûÄãµÄ°æ±¾ÊÇ´Ó CD-ROM °²×°¡£Äã¿ÉÄÜ·¢ÏÖ¼´Ê¹Ä¿Ç°°æ±¾²¢Î´ÓÐ{\itshape Shadow Suite\/} 
°²×°£¬µ«ÄãÈÔÈ»¿ÉÒÔÔÚ¸ÃÆ¬ CD-ROM ÕÒµ½ÄãÐèÒª°²×°µÄ{\itshape Shadow Suite\/}¡£



{\itshape È»¶ø£¬ËùÓÐShadow Suite 3.3.1, 3.3.1-2 °æ±¾ºÍ shadow-mk °éËæÇ©Èë(login)³ÌÊ½ºÍ
ÆäËû{\itshape suid root\/}³ÌÊ½¾ùÓÐ°²È«ÉÏÎÊÌâ£¬Òò´Ë²»Ó¦¸ÃÊ¹ÓÃÌ«¾Ã¡£\/}



ËùÓÐ±ØÒªµµ°¸¾ù¿ÉÒÔÍ¸¹ýÄäÃû FTP Õ¾»òÍøÕ¾ÕÒµ½¡£

ÔÚÃ»ÓÐ°²×°{\itshape Shadow Suite\/}µÄ Linux ÏµÍ³£¬°üÀ¨ÃÜÂëµÄÕÊºÅÊ¹ÓÃÕß×ÊÑ¶Í¨³£´¢´æÔÚ 
{\ttfamily /etc/passwd} µµ¡£
´¢´æµÄÃÜÂëÎª {\itshape ¼ÓÃÜ(encrypted)\/}¸ñÊ½¡£  È»¶ø£¬Èç¹ûÄãÎÊÒ»¸öÃÜÂë×¨¼Ò£¬Ëû/Ëý½«
¸æËßÄãÕæÕýµÄÃÜÂëµµÖ»ÊÇ{\itshape ±àÂë(encoded)\/}¶ø²»ÊÇ{\itshape ¼ÓÃÜ\/}¸ñÊ½£¬ÒòÎªµ±Ê¹ÓÃ 
crypt(3) Ê±£¬ÎÄ×Öµµ±¶ÉèÎª null ÇÒÃÜÂëÊÇ¼üÖµ(key)¡£ Òò´Ë£¬½ÓÏÂÀ´ÎÒ½«ÔÚÕâÆªÎÄ¼þÖÐÊ¹ÓÃ
{\itshape ±àÂë\/}¡£



Ê¹ÓÃÔÚÃÜÂëÀ¸Î»±àÂëµÄÑÝËã·¨ì¶¼¼ÊõÉÏÊÇÊ¹ÓÃ{\itshape one way hash function\/}¡£ÕâÊÇÒ»¸ö
ÔÚµ¥Ò»·½Ïò¼ÆËã¼òµ¥µ«ÄæÏò¼ÆËã·Ç³£À§ÄÑµÄÑÝËã·¨¡£¹Øì¶ÕâÕýÈ·µÄÑÝËã·¨¿ÉÒÔÔÚ 2.4 ½Ú»ò
ì¶ crypt(3) ²Ù×÷ÊÖ²áÕÒµ½¡£



µ±Ê¹ÓÃÕßÌôÑ¡»òÖ¸¶¨Ò»¸öÃÜÂë£¬ÏµÍ³½«Ëæ»ú²úÉúÒ»¸öÖµ£¬½Ð×ö{\itshape salt\/}£¬½«ÃÜÂë½øÐÐ
±àÂë¡£ Õâ±íÊ¾ÈÎºÎÌØ¶¨µÄÃÜÂë¿ÉÒÔ 4096 ÖÐ²»Í¬·½·¨´¢´æ¡£ {\itshape salt\/} Öµ½«´¢´æ±»±à
ÂëµÄÃÜÂë ¡£

µ±Ê¹ÓÃÕßÇ©Èë»òÌá¹©Ò»¸öÃÜÂë£¬ {\itshape salt\/} Ê×ÏÈ½ÓÊÕÓû´¢´æ±àÂëÃÜÂë¡£È»ááÕâÌá¹©ÃÜÂë
»áºÍ {\itshape salt\/} ÖµÒ»Æð{\itshape ±àÂë\/}£¬ÇÒ±È½ÏÒÑ¾­{\itshape ±àÂë\/}ÃÜÂë¡£Èç¹ûÓÐ match
£¬¸ÃÊ¹ÓÃÕßÍ¨¹ýÈ¨ÏÞ¼ì²é¡£ 



Ëæ»ú{\itshape ±àÂë\/}ºÍ¸´Ô­Ô­Ê¼ÃÜÂëÊÇÓÐ¼ÆËã¸´ÔÓ¶ÈµÄ(µ«²»ÊÇ²»¿ÉÄÜµÄ)¡£È»¶ø£¬ÔÚÄ³Ð©ÏµÍ³
ºÜ¶àÊ¹ÓÃÕßµÄÃÜÂë¶¼ÉèÎªÒ»°ãÎÄ×Ö(»òÊÇÒ»°ãÎÄ×ÖµÄ¼òµ¥±ä»¯)



ÏµÍ³º§¿ÍÖªµÀÕâ¼þÊÂ£¬ÇÒ½«¼òµ¥µÄ¼ÓÃÜÎÄ×ÖºÍÒ»°ãÊ¹ÓÃ4096 {\itshape salt\/} ÖµÃÜÂëÖ®Ä¿Â¼¡£È»
ááËûÃÇ½«±È½ÏÔÚ×ÊÁÏ¿âÖ® {\ttfamily /etc/passwd} µµÖ®±àÂëÃÜÂë£¬Ö»ÒªËûÃÇÕÒµ½Ò»¸ö±È¶Ô£¬ËûÃÇ
¿ÉÒÔÕÒµ½Ò»¸öÕÊºÅÖ®ÃÜÂë¡£ÕâºÍ{\itshape dictionary attack\/}ÓÐ¹Ø£¬ÇÒÓÃì¶Î´¾­Ðí¿É´æÈ¡ÏµÍ³È¡
µÃºÍÕ¹¿ª³£ÓÃµÄ·½·¨Ö®Ò»¡£



Èç¹ûÄãÏë¹ýÒ»¸ö 8 ÂëµÄÃÜÂë±àÂë³É 4096 * 13 ÂëµÄ×Ö´®£¬ÄÇ÷áÒ»¸öÓÃÔÚÃèÊö 400,000 Ò»°ãÎÄ×Ö
¡¢Ãû×Ö¡¢ÃÜÂëºÍ¼òµ¥±ä»¯µÄ×Öµä½«ÐèÒª 4GB Ó²µú´æÈ¡¿Õ¼ä¡£  º§¿ÍÐèÒª×öµÄÖ»ÊÇ·ÖÀà×Ö´®¸ú¼ì²é
±È¶Ô½á¹û¡£  ×Ô´Ó 4GB Ó²µú¿ÉÒÔÒÔÃÀ½ð 1000.00 ÒÔÏÂÂòµ½áá£¬¶Ô´ó¶àÊýÏµÍ³º§¿ÍµÄÒâÒå¿ÉÏë¶ø
Öª ¡£

Èç¹ûº§¿ÍÊ×ÏÈ·¢ÏÖÄãµÄ {\ttfamily /etc/passwd} µµ£¬ËûÃÇÖ»ÐèÒª½«ÕæÕý°üº¬ÔÚ 
{\ttfamily /etc/passwd} µµ {\ttfamily salt} ÖµµÄ×Öµä±àÂë£¬Õâ·½·¨¿ÉÓÉÓµÓÐ486¼¶µçÄÔ»ò¼¸¸öÓÐ
¼¸°Ù MB Ó²µú¿Õ¼äµÄÊ®À´ËêµÄÐ¡º¢ÊÊÓÃ¡£



¼´Ê¹Ã»ÓÐºÜ´óµÄ´Åµú¿Õ¼ä£¬Ïñ crack(1) µÄ¹¤¾ß³ÌÊ½Í¨³£¿ÉÒÔÔÚ×ã¹»Ê¹ÓÃÕßÏµÍ³ÖÐÖÁÉÙÆÆ½âÒ»¶Ô
ÃÜÂë£¨¼ÙÉèÏµÍ³Ê¹ÓÃÕß±¶ÔÊÐíÌôÑ¡ËûÃÇÏëÒªµÄÃÜÂë£©¡£



{\ttfamily /etc/passwd} µµÒ²°üÀ¨Ò»Ð©Ïà¹Ø×ÊÑ¶£¬ÏñÊ¹ÓÃÕß ID¡¡ºÍÈº×é IDËùÊ¹ÓÃµÄÏµÍ³³ÌÊ½£»Òò´Ë
{\ttfamily /etc/passwd} µµ {\itshape ±ØÐë\/} ±£³ÖÈ«ÊÀ½ç¿É¶ÁÐÔ.  Èç¹ûÄã¸Ä±ä {\ttfamily /etc/passwd} 
µµÒÔÖÂì¶Ã»ÓÐÈË¿ÉÒÔ¶ÁÈ¡£¬Äã½«·¢ÏÖµÄµÚÒ»¼þÊÂÊÇ {\ttfamily ls -l} ÃüÁî½«È¡´úÃû³Æ¶øÏÔÊ¾Ê¹ÓÃÕß ID
¡£

{\itshape Shadow Suite\/} Í¸¹ý½«ÃÜÂë´æÖÁÁíÒ»¸öµµ£¨Í¨³£ÊÇ {\ttfamily /etc/shadow} µµ£©À´½â¾ö¸Ã
ÎÊÌâ¡£ {\ttfamily /etc/shadow} µµ¶ÔÈÎºÎÈËÉè¶¨¿É¶Áµµ£¬Ö»ÓÐ {\itshape root\/} È¨ÏÞ¿ÉÒÔ¶ÁÐ´
{\ttfamily /etc/shadow} µµ¡£Ä³Ð©³ÌÊ½£¨Ïñ xlock£©²»ÐèÒª¸Ä±äÃÜÂë£¬Ö»ÐèÒªÈ·ÈÏÃÜÂë¼´¿É¡£ÕâÐ©³ÌÊ½
¿ÉÒÔÒÔ {\itshape suid root\/} Ö´ÐÐ»òÕßÄã¿ÉÒÔÉè¶¨Ò»¸öÈº×é {\itshape shadow\/} ÓÃÀ´Î¨¶Á 
{\ttfamily /etc/shadow} µµ£¬È»ááÕâÐ©³ÌÊ½¿ÉÒÔÖ´ÐÐ {\itshape sgid¡¡shadow\/}¡£

Í¸¹ýÒÆ¶¯ÃÜÂëÖÁ {\ttfamily /etc/shadow} µµ£¬ÎÒÃÇ¿ÉÒÔÓÐÁ¦µÄ±¸ÓÐº§¿Í´Ó´æÈ¡±àÂëÃÜÂëµ½Ö´ÐÐ
{\itshape dictionary attack\/} µÄÖ¤¾Ý¡£

³ý´ËÖ®Íâ£¬ {\itshape Shadow Suite\/} ÐÂÔöÐí¶àÌØÉ«£º
\begin{itemize}
\item Éè¶¨µµì¶Éè¶¨ÎªÇ©ÈëÊ±Ô¤Éè({\ttfamily /etc/login.defs})
\item ÐÂÔö¡¢ÐÞ¸ÄºÍÉ¾³ýÊ¹ÓÃÕßÕÊºÅÈº×éÖ®¹¤¾ß³ÌÊ½
\item ÃÜÂëÊÙÃü¼ÆËã¼°µ½ÆÚÈÕ
\item ÕÊºÅµ½ÆÚÈÕ¸úËøËÀ
\item Òþ²ØÈº×éÃÜÂë (¿ÉÑ¡ÔñµÄ)
\item Á½±¶³¤¶ÈÃÜÂë (16 ×ÖÔªÃÜÂë) {[}²»½¨ÒéÊ¹ÓÃ{]}
\item Õë¶ÔÊ¹ÓÃÕßÃÜÂëÑ¡ÔñÓÐ½ÏºÃµÄ¿ØÖÆ
\item ¿É²¦½ÓÃÜÂë
\item ±¸ÓÃÓÐÐ§È¨ÏÞ³ÌÊ½ {[}²»½¨ÒéÊ¹ÓÃ{]}
\end{itemize}


°²×° {\itshape Shadow Suite\/} ¹±Ï×ÎªÓÐ¸ü°²È«ÏµÍ³£¬µ«ÊÇ»¹ÓÐÆäËû·½·¨¿ÉÒÔ¸ÄÉÆ Linux ÏµÍ³µÄ°²È«
£¬ÇÒ×îÖÕ½«ÓÐÒ»ÏµÁÐµÄ Linux °²È« HOWTO's ½«ÌÖÂÛÆäËû°²È«»ù×¼ºÍÏà¹ØÎÄ¼þ°æ±¾£®



Õë¶ÔÄ¿Ç°ÆäËû Linux °²È«ÎÄ¼þ×ÊÑ¶£¬Çë²ÎÕÕÍøÖ·£º\nameurl{http://bach.cis.temple.edu/linux/linux-security/}{Linux Security home page.}






\subsection{ÎªºÎÄú²»Òª shadow ÄãµÄ passwd µµ}

ÓÐÒ»Ð©×´¿ö¸úÉè¶¨ÔËÓÃÔÚ°²×° {\itshape Shadow Suite\/} ½« {\itshape ²»ÊÇ\/} ºÃÖ÷Òâ£º¡¡ 
There are a few circumstances and configurations in which installing the
{\itshape Shadow Suite\/} would {\itshape NOT\/} be a good idea:
\begin{itemize}
\item Ö÷»úÃ»ÓÐ°üº¬Ê¹ÓÃÕßÕÊºÅ¡£
\item Ö÷»úÊÇÔÚ LAN ÉÏÅÜÇÒÊ¹ÓÃÍøÂ·×ÊÑ¶·þÎñ(Network Information
Services, NIS)µÃµ½»ò¹©Ó¦Ê¹ÓÃÕßÃû³ÆºÍÃÜ¸øÍøÂ·ÉÏµÄÆäËû»úÆ÷Ê¹ÓÃ(ÊÂÊµÉÏÕâ»¹ÊÇ
¿ÉÒÔÖ´ÐÐ£¬µ«ÊÇÊµ¼ÊÉÏ²¢²»ÄÜÔö¼ÓÈÎºÎ°²È«)¡£
\item »úÆ÷ÊÇÊ¹ÓÃÖÕ¶ËÖ÷»úÀ´ÑéÖ¤Ê¹ÓÃÕß¾­ÓÉ NFS(Network File System), NIS »ò
Ä³Ð©ÆäËû·½·¨¡£
\item »úÆ÷ÅÜÆäËûÈíÌåÑéÖ¤Ê¹ÓÃÕßÇÒÃ»ÓÐÈÎºÎ shadow °æ±¾»òÔ­Ê¼Âë¿É»ñµÃ¡£
\end{itemize}







\subsection{¸ñÊ½»¯ /etc/passwd µµ}

Ò»¸ö non-shadowed {\ttfamily /etc/passwd} µµ¸ñÊ½ÈçÏÂËùÊ¾£º
\begin{tscreen}
\begin{verbatim}
username:passwd:UID:GID:full_name:directory:shell
\end{verbatim}
\end{tscreen}

ÆäÖÐ
\begin{description}
\item[{\ttfamily username}] \mbox{}

Ê¹ÓÃÕß(Ç©Èë)Ãû³Æ

\item[{\ttfamily passwd}] \mbox{}

±àÂëÃÜÂë

\item[{\ttfamily UID}] \mbox{}

Ê¹ÓÃÕß±àºÅ

\item[{\ttfamily GID}] \mbox{}

Ô¤Éè´æ×é±àºÅ

\item[{\ttfamily full\_name}] \mbox{}

Ê¹ÓÃÕßÈ«Ãû - ÊÂÊµÉÏÕâ¸öÀ¸Î»³Æ×÷ GECOS (General 
Electric Comprehensive Operating System) À¸Î»ÇÒ¿ÉÒÔ´¢´æÈ«ÃûÍâµÄ×ÊÑ¶¡£Shadow
commands and manual pages refer to this field as the comment field.

\item[{\ttfamily directory}] \mbox{}

Ê¹ÓÃÕß¸ùÄ¿Â¼ (¾ø¶ÔÂ·¾¶)

\item[{\ttfamily shell}] \mbox{}

Ê¹ÓÃÕßÇ©ÈëµÄ»·¾³ (¾ø¶ÔÂ·¾¶)

\end{description}

¾ÙÀýËµÃ÷£º
\begin{tscreen}
\begin{verbatim}
username:Npge08pfz4wuk:503:100:Full Name:/home/username:/bin/sh
\end{verbatim}
\end{tscreen}
¡¡ÖÐ£¬{\ttfamily Np} ÊÇ salt ÇÒ {\ttfamily ge08pfz4wuk} ÊÇ{\itshape ±àÂë\/}ÃÜÂë¡£  
ÒÑ±àÂëµÄ salt/password ¾ÍÏñ {\ttfamily kbeMVnZM0oL7I} ÇÒÕâÁ½¸ö×Ö´®ÊÇÒ»ÑùµÄÃÜÂë¡£¶ÔÏàÍ¬
ÃÜÂë¿ÉÄÜÓÐ 4096 ÖÖ¿ÉÄÜµÄ±àÂë¡£(±¾¡õÀýµÄÃÜÂëÊÇ "passwaor"£¬ÕâÊÇ±È½Ï {\itshape ²»ºÃ\/} µÄÃÜÂë)¡£



Ö»Òª shadow suite ÒÑ¾­°²×°£¬ {\ttfamily /etc/passwd} µµ½«±»Ìæ´ú³É£º
\begin{tscreen}
\begin{verbatim}
username:x:503:100:Full Name:/home/username:/bin/sh
\end{verbatim}
\end{tscreen}

±¾¡õÀýÖ®µÚ¶þÀ¸Î» {\ttfamily x} ÏÖÔÚÖ»ÊÇÒ»¸ö¡¡place holder¡£¡¡{\ttfamily /etc/passwd}µµµÄ¸ñÊ½
²¢Î´ÕæµÄ¸Ä±ä£¬Ö»ÊÇ²»ÔÙ°üº¬ {\itshape ±àÂë\/}ÃÜÂë¡£Õâ±íÊ¾ÈÎºÎ³ÌÊ½¿ÉÒÔ¶ÁÈ¡ {\ttfamily /etc/passwd}
µµ£¬µ«²¢²»ÕæµÄÐèÒªÈ·ÈÏÃÜÂëÊÇ²»ÊÇÕýÈ·µØÔË×÷¡£



ÕâÐ©ÃÜÂëÏÖÔÚ±»ÖØÐÂ·ÅÔÚ shadow µµ(Í¨³£ÊÇÔÚ {\ttfamily /etc/shadow} µµ)¡£




\subsection{¸ñÊ½»¯ shadow µµ}

{\ttfamily /etc/shadow} µµ°üÀ¨ÏÂÁÐ×ÊÑ¶£º
\begin{tscreen}
\begin{verbatim}
username:passwd:last:may:must:warn:expire:disable:reserved
\end{verbatim}
\end{tscreen}

ÆäÖÐ
\begin{description}
\item[{\ttfamily username}] \mbox{}

Ê¹ÓÃÕßÃû³Æ

\item[{\ttfamily passwd}] \mbox{}

±àÂëÃÜÂë

\item[{\ttfamily last}] \mbox{}

ÃÜÂëÉÏ´Î¸ü¶¯ÈÕÆÚ£¬ÒÔ´Ó1970Äê1ÔÂ1ÈÕËãÆðµÄÌìÊý´ú±í

\item[{\ttfamily may}] \mbox{}

ÃÜÂë¸Ä±äÇ°ÌìÊý

\item[{\ttfamily must}] \mbox{}

ÃÜÂë×î³£Ê¹ÓÃÌìÊý

\item[{\ttfamily warn}] \mbox{}

´ú±íÆÚÏÞÇ°¼¸Ìì¾ÍÊÂÏÈ¾¯¸æÊ¹ÓÃÕß

\item[{\ttfamily expire}] \mbox{}

³¬¹ýÃÜÂë¹ýÆÚÌìÊýáá£¬¾Í¹Ø±Õ¸ÃÕÊºÅ

\item[{\ttfamily disable}] \mbox{}

ÕÊºÅ¹Ø±Õ£¬ÒÔ´Ó1970Äê1ÔÂ1ÈÕËãÆðµÄÌìÊý´ú±í

\item[{\ttfamily reserved}] \mbox{}

Ô¤±¸À¸Î»

\end{description}

ÒÀÕÕÖ®Ç°¡õÀý½«±ä³É£º
\begin{tscreen}
\begin{verbatim}
username:Npge08pfz4wuk:9479:0:10000::::
\end{verbatim}
\end{tscreen}





\subsection{»Ø¹Ë crypt(3).}

´Ó crypt(3) Ê¹ÓÃÕßÎÄ¼þµÃµ½£º

{\tt\char`\"}{\itshape crypt\/} ÊÇÃÜÂë¼ÓÃÜ·½³ÌÊ½¡£
It is based on the {\itshape Data Encryption Standard\/} algorithm with variations
intended (among other things) to discourage use of hardware implementations of
a key search.

{[}The] key ÊÇÊ¹ÓÃÕßÊäÈëµÄÃÜÂë¡£  {[}±àÂë×Ö´®È«ÊÇ NULLs]

{[}The] {\itshape salt\/} ÊÇ´Ó {[}a-zA-Z0-9./] ¼¯ºÏÖÐÑ¡³öµÄÁ½¸öÎ»Ôª×Ö´®¡£
¸Ã×Ö´®ÊÇÓÃì¶ÈÅÂÒÔÚ 4096 ÖÖ²»Í¬·½·¨Ö®Ò»¸öÑÝËã·¨¡£

Í¸¹ýµÃµ½ key µÄÃ¿¸öÎ»ÔªµÄ×îµÍ 7 bit{[}s]£¬¿ÉÒÔ½¨Á¢ 56-bit key ¡£ Õâ56-bit key
ÊÇÓÃÔÚÖØ¸´¼ÓÃÜÒ»¸ö³£Êý×Ö´®(Í¨³£ÊÇ°üº¬ËùÓÐÁéµÄ×Ö´®)¡£ ´«»ØÖµÖ¸µ½¼ÓÃÜÃÜÂëÊÇÒ»Á¬´®
¿ÉÓ¡³öÖ®13¸ö ASCII ×ÖÔª(×îÇ°ÃæµÄÒ»Á½¸ö×ÖÔª±íÊ¾ salt ±¾Éí)¡£ Í¸¹ýÃ¿´ÎµÄºô½Ð¿É½«
´«»ØÖ±Ö¸µ½¾²Ì¬×ÊÁÏ¡£



 
{\bfseries ¾¯¸æÑ¶Ï¢£º} Key space °üÀ¨ 2**56 ¼´µÈì¶ 7.2e16 ¿ÉÄÜµÄÖµ¡£ÓëÓÃÖØ´óµÄÆ½ÐÐµçÄÔ
½« Key space ¼«¾¡µÄËÑÑ°{\bfseries ÊÇ¿ÉÄÜ}¡£Ïñ {\ttfamily crack(1)} ÈíÌåÓÃÀ´ËÑÑ°²¿·ÖµÄÓÉÈË
²úÉúÖ®ÃÜÂëµÄ key space ÊÇ¿É»ñµÃµÄ¡£Òò´Ë£¬ÃÜÂëµÄÑ¡ÔñÖÁÉÙÓ¦¸Ã±ÜÃâÊ¹ÓÃÒ»°ã×Ö¼°Ãû×Ö¡£
Ò»¸öÓÃÀ´¼ì²é½â¿ªÃÜÂëÑ¡ÔñµÄ {\ttfamily passwd(1)} ³ÌÊ½Ê¹ÓÃÊÇÖµµÃÍÆ¼öµÄ¡£



DES ÑÝËã·¨±¾ÉíÓÐÒ»Ð©Ê¹ {\ttfamily crypt(3)} ÔÚÈÎºÎÆäËûÃÜÂëÈ¨ÏÞÇø¸ô½éÃæºÜ²îÑ¡ÔñµÄÊ¹ÓÃ
·½Ãæ¾ç±ä¡£Èç¹ûÄã¼Æ»­Ê¹ÓÃ {\ttfamily crypt(3)} ½éÃæÀ´¼ÓÃÜ¼Æ»­£¬ÒÔÏÂÃèÊöÇ§Íò±ðÕâ÷á×÷£º
µÃÒªÒ»±¾¼ÓÃÜºÃÊéºÍ¹ã·º»ñµÃ DES ³ÌÊ½¿â .{\tt\char`\"} Ò»ÆðÊ¹ÓÃ¡£

´ó¶à {\itshape Shadow Suites\/} °üÀ¨ 16 Î»ÔªµÄÃÜÂë³¤¶ÈÁ½±¶Ö®Ô­Ê¼Âë¡£ ÔÚ {\ttfamily des} ×¨
¼Ò½¨Òé±ÜÃâÊ¹ÓÃµ±¿ªÊ¼¶Ô½Ï³£ÃÜÂëÏÈ¼òµ¥µÄ±àÂë×ó°ëÈ»ááÓÒ°ë¡£ÓÉì¶ {\ttfamily crypt} ÔË×÷·½·¨
£¬Õâ½«Ôì³É {\itshape ½Ï²îµÄ\/} °²È«±àÂëÃÜÂë¡£³ý´ËÖ®Íâ£¬Ê¹ÓÃÕßÓÐ¿ÉÄÜ¼Ç×¡ 16 Î»ÔªÃÜÂëÊÇ
Ò»¼þ±È½Ï²îµÄÊÂÇé¡£



Ä¿Ç°ÓÐÔÊÐíÈ¨ÏÞÀíÂÛÓÃÒÔÈ¡´úÄ³Ð©¸ü°²È«ºÍÖ§Ô®½Ï³¤ÃÜÂë(ÀýÈç MD5 ÑÝËã·¨)ÇÒ±£ÓÐºÍ
{\ttfamily crypt} ·½·¨ÏàÈÝµÄ·¢Õ¹¹¤×÷ÕýÔÚ½øÐÐ¡£



Èç¹ûÄãÕýÔÚÑ°ÕÒÒ»±¾¼ÓÃÜµÄºÃÊé£¬½¨ÒéÈçÏÂ£º
\begin{verbatim}
        "Applied Cryptography: Protocols, Algorithms, and Source Code in C"
        by Bruce Schneier <schneier@chinet.com>
        ISBN: 0-471-59756-2
\end{verbatim}







\section{È¡µÃ Shadow Suite.}


\subsection{Shadow Suite for Linux µÄÀúÊ·(ÔÝ²»·­Òë)}


\subsection{History of the Shadow Suite for Linux}

{\itshape DO NOT USE THE PACKAGES IN THIS SECTION, THEY HAVE SECURITY PROBLEMS\/}

The original {\itshape Shadow Suite\/} was written by {\ttfamily John F. Haugh II}.

There are several versions that have been used on Linux systems:
\begin{itemize}
\item {\ttfamily shadow-3.3.1} is the original.
\item {\ttfamily shadow-3.3.1-2} is Linux specific patch made by
\onlynameurl{Florian La Roche $<$flla@stud.uni-sb.de{$>$}} and contains some further
enhancements.
\item {\ttfamily shadow-mk} was specifically packaged for Linux.
\end{itemize}


The {\ttfamily shadow-mk} package contains the {\ttfamily shadow-3.3.1} package
distributed by {\ttfamily John F. Haugh II} with the {\ttfamily shadow-3.3.1-2 patch} 
installed, a few fixes made by \onlynameurl{Mohan Kokal $<$magnus@texas.net{$>$}}
that make installation a lot easier, a patch by {\ttfamily Joseph R.M. Zbiciak}
for {\ttfamily login1.c} (login.secure) that eliminates the -f, -h security
holes in /bin/login, and some other miscellaneous patches.

The {\ttfamily shadow.mk} package was the {\itshape previously\/} recommended
package, but should be replaced due to a {\itshape security problem\/} with the
{\ttfamily login} program.

There are {\itshape security problems\/} with Shadow versions 3.3.1, 3.3.1-2, 
and shadow-mk involving the {\ttfamily login} program.  This {\ttfamily login} bug 
involves not checking the length of a login name.  This causes the buffer to
overflow causing crashes or worse.  It has been rumored that this buffer
overflow can allow someone with an account on the system to use this bug and
the shared libraries to gain {\itshape root\/} access.  I won't discuss exactly 
how this is possible because there are a lot of Linux systems that are 
affected, but systems with these {\itshape Shadow Suites\/} installed, and 
most pre-ELF distributions {\itshape without\/} the {\itshape Shadow Suite\/} 
are vulnerable!

For more information on this and other Linux security issues, see the \nameurl{http://bach.cis.temple.edu/linux/linux-security/Linux-Security-FAQ/Linux-telnetd.html}{Linux Security home page (Shared Libraries and login Program Vulnerability)}






\subsection{ÈçºÎÈ¡µÃ Shadow Suite£¿}

Ä¿Ç°½¨Òé {\itshape Shadow Suite\/} °æ±¾Ä¿Ç°»¹ÊÇ BETA ²âÊÔ°æ£¬È»áá£¬×î½ü°æ±¾ÔÚÉú²ú»·¾³
ÊÇ°²È«µÄÇÒÃ»ÓÐ°üº¬Ò×ÊÜ¹¥»÷µÄ {\ttfamily Ç©Èë(login)} ³ÌÊ½¡£

¸ÃÌ×¼þ(package)Ê¹ÓÃ¹ßÀýÃüÃûÎª£º
\begin{tscreen}
\begin{verbatim}
shadow-YYMMDD.tar.gz
\end{verbatim}
\end{tscreen}

ÆäÖÐ {\ttfamily YYMMDD} ÊÇSuite µÄ·¢ÐÐÈÕÆÚ¡£

Ä¿Ç° BETA ²âÊÔ°æ±¾ÊÇ {\itshape Version 3.3.3\/} £¬ÇÒÓÉ\onlynameurl{Marek Michalkiewicz  $<$marekm@i17linuxb.ists.pwr.wroc.pl{$>$}} Î¬»¤¡£

»¹¿ÉÒÔ´Ó¸Ã´¦µÃµ½£º
\nameurl{ftp://i17linuxb.ists.pwr.wroc.pl/pub/linux/shadow/shadow-current.tar.gz}{shadow-current.tar.gz}.

ÏÂÁÐÍøÕ¾Ò²¿ÉÒÔÕÒµ½Ïà¹Ø×ÊÑ¶£º
\begin{itemize}
\item \onlynameurl{ftp://ftp.icm.edu.pl/pub/Linux/shadow/shadow-current.tar.gz}
\item \onlynameurl{ftp://iguana.hut.fi/pub/linux/shadow/shadow-current.tar.gz}
\item \onlynameurl{ftp://ftp.cin.net/usr/ggallag/shadow/shadow-current.tar.gz}
\item \onlynameurl{ftp://ftp.netural.com/pub/linux/shadow/shadow-current.tar.gz}
\end{itemize}


ÄãÓ¦¸Ã¿ÉÒÔ»ñµÃÄ¿Ç°×îÐÂµÄ°æ±¾¡£

ÄãÓ¦¸Ã²»ÒªÊÇÓÃ±È {\ttfamily shadow-960129} {\itshape ¸ü¾É\/}°æ±¾£¬ÒòÎªËüÃÇÓÐ {\ttfamily Ç©Èë} 
µÄ°²È«ÎÊÌâ¡£





ì¶²Î¿¼×ÊÁÏ·½Ãæ£¬ÎÒÓÃ {\ttfamily shadow-960129} µµ½øÐÐ°²×°½éÉÜ¡£

Èç¹ûÄãÖ®Ç°Ê¹ÓÃ {\ttfamily shadow-mk} £¬ÄãÓ¦¸Ã¸üÐÅÕâ¸ö°æ±¾ÇÒÖØ½¨±àÒë¡£




\subsection{Shadow Suite°üº¬Ê²÷á£¿}

{\itshape Shadow Suite\/} °üÀ¨¶ÔÏÂÁÐ¹¦ÄÜÖ®Ìæ´ú³ÌÊ½£º

{\ttfamily su, login, passwd, newgrp, chfn, chsh, and id}

¸ÃÌ×¼þ»¹°üÀ¨ÐÂ³ÌÊ½£º

{\ttfamily chage, newusers, dpasswd, gpasswd, useradd, userdel, usermod, groupadd,
groupdel, groupmod, groups, pwck, grpck, lastlog, pwconv, and pwunconv}

³ý´ËÖ®Íâ£¬º¯Ê½¿â£º {\ttfamily libshadow.a} Ò²°üÀ¨ÐèÒª´æÈ¡Ê¹ÓÃÕßÃÜÂëÖ®Ð´ºÍ±àÒë³ÌÊ½¡£

³ÌÊ½Ö®²Ù×÷ÊÖ²áÒ²°üº¬ÔÚÆäÖÐ¡£



Ò²ÓÐ¶ÔÇ©Èë³ÌÊ½µÄ configuration file £¬Ëü½«±»°²×°ÔÚ {\ttfamily /etc/login.defs} µµ¡£




\section{±àÒë³ÌÊ½}


\subsection{½âÑ¹Ëõ}

ÔÚ½ÓÊÕÌ×¼þááµÚÒ»¸ö²½Öè¾ÍÊÇ unpacking¡£¸ÃÌ×¼þÊÇ tar µµ°¸¸ñÊ½Ê¹ÓÃ gzip Ñ¹Ëõ
£¬ËùÒÔÊ×ÏÈ½«¸Ãµµ°¸ÒÆµ½ {\ttfamily /usr/src} £¬È»ááÊäÈë£º
\begin{tscreen}
\begin{verbatim}
tar -xzvf shadow-current.tar.gz
\end{verbatim}
\end{tscreen}


Õâ½«»á unpack µ½Ò»¸öÄ¿Â¼£º{\ttfamily /usr/src/shadow-YYMMDD}




\subsection{Éè¶¨ config.h µµ}

µÚÒ»¼þÊÂÊÇÄãÐèÒª¸´ÖÆ {\ttfamily Makefile} ºÍ {\ttfamily config.h} µµ£º

\begin{tscreen}
\begin{verbatim}
cd /usr/src/shadow-YYMMDD
cp Makefile.linux Makefile
cp config.h.linux config.h
\end{verbatim}
\end{tscreen}




È»ááÄãÓ¦¸ÃÁôÒâ {\ttfamily config.h} µµ¡£ ¸Ãµµ°¸°üÀ¨Ä³Ð©Éè¶¨Ñ¡ÏîµÄ¶¨Òå¡£Èç¹ûÄãÊ¹ÓÃ
{\itshape ½¨Òé\/} Ì×¼þ£¬ÎÒ½¨ÒéÄãÔÚµÚÒ»´ÎÉè¶¨¹Øµô group shadow support¡£ 

shadowed group passwords Ô¤ÉèÖµÊÇ¿ªÆôµÄ¡£ ÔÚ {\ttfamily config.h} µµ¹Øµ½Õâ¸öÉè¶¨£¬
ÇÒ¸Ä±ä {\ttfamily \#define SHADOWGRP} ±ä³É {\ttfamily \#undef SHADOWGRP}¡£ÎÒ½¨ÒéÄúÒ»¿ªÊ¼
¹ØµôËüÃÇ£¬È»ááÈç¹ûÄãÕæµÄÐèÒª group passwords ºÍ group administrators Ê±ÄãÔÚ
¿ªÆôËüÃÇºÍÖØÐÂ±àÒë¡£ Èç¹ûÄã¿ªÆôËü£¬ Äã {\itshape ±ØÐë\/} ½¨Á¢  {\ttfamily /etc/gshadow} µµ¡£



¿ªÆô³¤ÃÜÂëµÄÑ¡ÏîÒ²²»½¨ÒéÊ¹ÓÃ¡£

{\itshape ²»Òª\/} ¸Ä±ä {\ttfamily \#undef AUTOSHADOW} µÄÉè¶¨¡£

{\ttfamily AUTOSHADOW} Ñ¡Ïî³õÊ¼Éè¼ÆÊÇÓÃÒÔÈÃ shadow  ¿ÉÒÔÏñ function Ò»ÑùÖ´ÐÐ¡£ÀíÂÛÉÏ
ÌýÆðÀ´²»´í£¬µ«ÊÇÃ»°ì·¨ÕýÈ·µÄÔË×÷¡£ Èç¹ûÄã¿ªÆôÕâ¸öÑ¡Ïî£¬ÇÒÕâ¸ö³ÌÊ½ÒÔ root È¨ÏÞÔÚÖ´
ÐÐ£¬ Ëü»áÏñ root È¨ÏÞÖ´ÐÐÒ»Ïîºô½Ð {\ttfamily getpwnam()} £¬È»áá±ä¸ü
{\ttfamily /etc/passwd} µµ (ÓÐ{\itshape no-longer-shadowed ÃÜÂë\/})¡£ ÕâÀà³ÌÊ½°üÀ¨ chfn 
ºÍ chsh¡£(Èç¹û root ÔÚºô½Ð {\ttfamily getpwnam()} Ö®Ç°Ê¹ÓÃ chfn ºÍ chsh£¬Ê¹ÓÃÕßÕÊºÅ½«
Ã»ÓÐ°ì·¨ÕæÊµÇÒÓÐÐ§½»Ò×¡£)



Èç¹ûÄãÒª½¨Á¢ libc£¬Í¬ÑùµÄ¾¯¸æÒ²ÓÐÐ§£¬ËüÓÐ¸ö {\ttfamily SHADOW\_COMPAT} ×÷ÏàÍ¬µÄÊÂ¡£ Ëü
{\itshape ²»Ó¦¸Ã\/}±»Ê¹ÓÃ£¡Èç¹ûÄã¿ªÊ¼´ÓÄãµÄ {\ttfamily /etc/passwd} µµß¢È¡±àÂëÃÜÂë£¬
Õâ»áÊÇ¸öÎÊÌâ¡£

Èç¹ûÄãÕýÊ¹ÓÃ±È 4.6.27 »¹¸ßµÄ {\ttfamily libc} °æ±¾£¬Äã½«ÐèÒªÔÚ {\ttfamily config.h} ºÍ
{\ttfamily Makefile}Á½¸öµµ×öºÜ¶à¸Ä±ä¡£
ÔÚ {\ttfamily config.h} µµµÄ±à¼­ºÍ¸Ä±ä£º
´Ó£º
\begin{tscreen}
\begin{verbatim}
#define HAVE_BASENAME
\end{verbatim}
\end{tscreen}

µ½£º
\begin{tscreen}
\begin{verbatim}
#undef HAVE_BASENAME
\end{verbatim}
\end{tscreen}

È»ááÔÚ {\ttfamily Makefile} µµµÄ¸Ä±ä£º

\begin{tscreen}
\begin{verbatim}
SOBJS = smain.o env.o entry.o susetup.o shell.o \
        sub.o mail.o motd.o sulog.o age.o tz.o hushed.o

SSRCS = smain.c env.c entry.c setup.c shell.c \
        pwent.c sub.c mail.c motd.c sulog.c shadow.c age.c pwpack.c rad64.c \
        tz.c hushed.c
\end{verbatim}
\end{tscreen}

\begin{tscreen}
\begin{verbatim}
SOBJS = smain.o env.o entry.o susetup.o shell.o \
        sub.o mail.o motd.o sulog.o age.o tz.o hushed.o basename.o

SSRCS = smain.c env.c entry.c setup.c shell.c \
        pwent.c sub.c mail.c motd.c sulog.c shadow.c age.c pwpack.c rad64.c \
        tz.c hushed.c basename.c
\end{verbatim}
\end{tscreen}

ÕâÐ©°üº¬ÔÚ {\ttfamily basename.c} ³ÌÊ½ÂëµÄ¸Ä±ä¾ùÐè±¶°üÀ¨ÔÚ {\ttfamily libc 4.6.27} ÄÚ¡£






\subsection{±¸·ÝÔ­Ê¼³ÌÊ½}

ÔÚ shadow suite Òª¸üÐÂÊ±£¬ÖÆ×÷³ÌÊ½±¸·Ý½«ÊÇÒ»¸öºÜºÃµÄµã×Ó¡£ÔÚ Slackware 3.0 ÏµÍ³ÖÐ£¬
ÕâÐ©µµ°¸ÊÇ£º

\begin{itemize}
\item /bin/su
\item /bin/login
\item /usr/bin/passwd
\item /usr/bin/newgrp
\item /usr/bin/chfn
\item /usr/bin/chsh
\item /usr/bin/id
\end{itemize}


Õâ BETA Ì×¼þÒÑ¾­ÓÐ¸ö {\itshape ´¢´æ\/} ÔÚ Makefile µÄÄ¿µÄµµ£¬µ«ÊÇ
ÒòÎª²»Í¬µÄ°æ±¾Í¨³£½«³ÌÊ½·ÅÔÚ²»Í¬µÄµØ·½£¬Òò´Ë³£±»ÈËÆÀÂÛ¡£

ÄãÓ¦¸Ã±¸·ÝÄãµÄ {\ttfamily /etc/passwd} µµ£¬µ«ÊÇÄãÒªºÜÐ¡ÐÄµØÃüÃû£¬²»È»ÈçÎÒÄã½«Ëü·ÅÔÚ
ÏàÍ¬Ä¿Â¼£¬Äã½«ÎÞ·¨ÖØÐ´ {\ttfamily passwd} ÃüÁî¡£




\subsection{Ö´ÐÐ make}

{\itshape ÄãÐèÒªÒÔ root È¨ÏÞÇ©ÈëÒÔÖ´ÐÐ°²×°³ÌÐò\/}.

Ö´ÐÐ make À´±àÒëÌ×¼þÖÐµÄÖ´ÐÐµµ£º

\begin{tscreen}
\begin{verbatim}
make all
\end{verbatim}
\end{tscreen}


Äã¿ÉÄÜ»á¿´µ½¾¯¸æÓï£º {\ttfamily rcsid defined but not used}.  ÕâÃ»¹ØÏµ£¬
ÒòÎª×÷ÕßÊ¹ÓÃ°æ±¾¿ØÖÆÌ×¼þ²Å»á·¢Éú¡£






\section{°²×°}


\subsection{ÊÖ±ß×¼±¸Ò»¸ö¿ª»úÆ¬}

Èç¹ûÕæµÄ·¢ÉúÑÏÖØ´íÎó£¬ÓÐ¸ö¿ª»ú´ÅÆ¬Ö®ÓÐÓÃµÄ¡£Èç¹ûÄãÒª boot/root ºÏ²¢µÄ°²×°£¬Äã¿ÉÒÔ
²Î¿¼\nameurl{http://sunsite.unc.edu/mdw/HOWTO/Bootdisk-HOWTO.html}{Bootdisk-HOWTO} ÒÔÖÆ×÷ root ¿ª»úÖ®¿ª»úÆ¬¡£






\subsection{ÒÆ³ý¸´ÖÆµÄ man pages}

ÄãÒ²Ó¦¸Ã½«²Ù×÷ÊÖ²á¸üÐÂ£¬¼´Ê¹ÄãºÜÀ÷º¦µ½×ãÒÔ²»ÓÃ±¸·Ý°²×° Shadow Suite£¬ÄãÈÔÈ»Òª½«
½«¾ÉµÄ²Ù×÷ÊÖ²áÒÆ³ý£¬ÒòÎªÐÂ°æµÄ²Ù×÷ÊÖ²áÎÞ·¨Õý³£µÄ¸²¸Ç¾É°æ±¾¡£

Äã¿ÉÒÔÊ¹ÓÃÒ»¸ö×éºÏ£º {\ttfamily man -aW ÃüÁî} ºÍ {\ttfamily locate ÃüÁî} Ñ°ÕÒÐè±¸ÒÆ³ý
µÄ²Ù×÷ÊÖ²á¡£ÔÚÄãÖ´ÐÐ {\ttfamily make install} Ç°ÕÒ³ö½Ï¾É°æ±¾±È½ÏÈÝÒ×¡£

Èç¹ûÄãÊ¹ÓÃ Slackware 3.0 °æ±¾£¬È»ááÄãÒªÒÆ³ýµÄ²Ù×÷ÊÖ²áÊÇ£º
\begin{itemize}
\item /usr/man/man1/chfn.1.gz
\item /usr/man/man1/chsh.1.gz
\item /usr/man/man1/id.1.gz
\item /usr/man/man1/login.1.gz
\item /usr/man/man1/passwd.1.gz
\item /usr/man/man1/su.1.gz
\item /usr/man/man5/passwd.5.gz
\end{itemize}


ÔÚ {\ttfamily /var/man/cat[1-9]} ´ÎÄ¿Â¼Ò²ÓÐÏàÍ¬µÄÃû×ÖÐèÒª±»É¾³ý¡£




\subsection{Ö´ÐÐ make install}

ÏÖÔÚÄãÒÑ¾­×¼±¸ÒªÊäÈë£º (ÒÔ root È¨ÏÞÖ´ÐÐ)
\begin{tscreen}
\begin{verbatim}
make install
\end{verbatim}
\end{tscreen}


Õâ½«°²×°×îÐÂºÍ¸üÐÂ³ÌÊ½ÇÒÐÞ¸´µµ°¸Ðí¿ÉÈ¨¡£ËüÒ²»á°²×°²Ù×÷ÊÖ²á¡£

ÕâÒ²½«ÔÚ°²×°Ê±¿¼ÂÇ½« Shadow Suite °üº¬µµ°¸·ÅÔÚÕýÈ·µÄÎ»ÖÃ {\ttfamily /usr/include/shadow} ¡£



Ê¹ÓÃ BETA Ì×¼þ£¬ÄãÐèÒªÊÖ¶¯¸´ÖÆ {\ttfamily login.defs} Õâ¸öµµµ½ {\ttfamily /etc} Õâ¸öÄ¿Â¼ÏÂ£¬
¶øÇÒÒªÈ·ÈÏÖ»ÓÐ {\itshape root\/} È¨ÏÞ¿ÉÒÔ¸Ä±äËü¡£

\begin{tscreen}
\begin{verbatim}
cp login.defs /etc
chmod 700 /etc/login.defs
\end{verbatim}
\end{tscreen}


Õâ¸öµµ°¸ÊÇ {\itshape Ç©Èë\/} ³ÌÊ½µÄ configuration file¡£ ÄãÓ¦¸Ã¼ì²é¸úÈ·¶¨Õâ¸öµµµÄ¸Ä±ä×´¿ö¡£
ÕâÊÇÄã¾ö¶¨ÄÄ¸ö  tty µÄ root ¿ÉÒÔ´ÓÄÄÀïÇ©ÈëºÍÉè¶¨ÆäËû°²È«·½ÕëµÄµØ·½(ÏñÔ¤ÉèÃÜÂëµÄµ½ÆÚÈÕ)¡£




\subsection{Ö´ÐÐ pwconv}

½ÓÏÂÀ´µÄ²½ÖèÊÇÖ´ÐÐ {\ttfamily pwconv}¡£  ÕâÒ²ÐèÒÔ {\itshape root\/}Ö´ÐÐÇÒ×îºÃÔÚ {\ttfamily /etc} 
Ä¿Â¼ÏÂÖ´ÐÐ£º
\begin{tscreen}
\begin{verbatim}
cd /etc
/usr/sbin/pwconv
\end{verbatim}
\end{tscreen}


{\ttfamily pwconv} ß¢È¡ÄãµÄ {\ttfamily /etc/passwd} µµÇÒÉ¾³ýÄ³Ð©À¸Î»ÎªÁË½¨Á¢Á½¸öµµ°¸£º
{\ttfamily /etc/npasswd} ºÍ {\ttfamily /etc/nshadow}.

Ò»¸ö {\ttfamily pwunconv} Ò²Ìá¹©Äã½¨Á¢Ò»¸ö {\ttfamily /etc/passwd} ºÍ {\ttfamily /etc/shadow} 
×éºÏµÄÕý³£ {\ttfamily /etc/passwd} µµ°¸¡£




\subsection{ÖØÐÂÃüÃû npasswd ºÍ nshadow}

ÏÖÔÚÄãÒÑ¾­Ö´ÐÐ {\ttfamily pwconv} £¬¶øÇÒÄãÒÑ¾­½¨Á¢ {\ttfamily /etc/npasswd} ºÍ
{\ttfamily /etc/nshadow} µµ°¸¡£ÕâÐèÒª¸´ÖÆµ½ {\ttfamily /etc/passwd} ºÍ {\ttfamily /etc/shadow}
µµ¡£ ÎÒÃÇÒ²ÐèÒª¸´ÖÆÔ­Ê¼ {\ttfamily /etc/passwd} µµ£¬¶øÇÒÈ·¶¨Ö»ÓÐ root ¿ÉÒÔ¶ÁËü¡£
ÎÒÃÇ½«¸Ãµµ°¸·ÅÔÚ root µÃ¸ùÄ¿Â¼£º

\begin{tscreen}
\begin{verbatim}
cd /etc
cp passwd ~passwd
chmod 600 ~passwd
mv npasswd passwd
mv nshadow shadow
\end{verbatim}
\end{tscreen}


ÄãÒ²Ó¦¸ÃÈ·¶¨µµ°¸µÄÓµÓÐÕß¸ú´æÈ¡È¨ÏÞÊÇÕýÈ·µÄ¡£ Èç¹ûÄã½«ÒªÊ¹ÓÃ {\itshape X-Windows\/} £¬
{\ttfamily xlock} ºÍ {\ttfamily xdm} ¿ÉÄÜÐèÒª¶ÁÈ¡ {\ttfamily shadow} µµ(µ«Ðè²»ÒªÐ´Èë¸Ãµµ)¡£

ÓÐÁ½¸ö·½·¨¿ÉÒÔ×ö¡£ Äã¿ÉÒÔÉè¶¨ {\ttfamily xlock} µÄ suid ÊÇ root ({\ttfamily xdm}  Í¨³£ÒÔ
root È¨ÏÞÖ´ÐÐ)¡£ »òÕßÄã¿ÉÒÔÊ¹ root ³ÉÎª {\ttfamily shadow} µÄÈº×é¿ÉÒÔÓµÓÐ {\ttfamily shadow} µµ
£¬µ«ÊÇÔÚ×÷ÕâÖ®Ç°£¬ÒªÈ·¶¨ÄãÒÑ¾­ÓÐ¸ö shadow group (¿ÉÒÔÔÚ {\ttfamily /etc/group} µµ¿´µ½)¡£
²»Ó¦¸ÄÓÐÈÎºÎÊ¹ÓÃÕßÕæµÄÔÚ  shadow group ¡£

\begin{tscreen}
\begin{verbatim}
chown root.root passwd
chown root.shadow shadow
chmod 0644 passwd
chmod 0640 shadow
\end{verbatim}
\end{tscreen}


ÄãµÄÏµÍ³ÏÖÔÚÓÐ shadow µÄÃÜÂëµµÂÞ¡£ ÄãÏÖÔÚ {\itshape Ó¦¸Ã\/} ÖØ¿ªÒ»¸öÖÕ¶Ë»úÊÓ´°ºÍÈ·ÈÏÄã
¿ÉÒÔÇ©Èë(login)¡£

{\itshape ÇëÂíÉÏÈ·ÊµµÄ×÷Õâ¼þÊÂ£¡\/}

Èç¹ýÄã²»ÄÜ£¬¿ÉÄÜÄ³Ð©ÊÂÇéÓÐ´íÎóÂÞ£¡ ÎªÁËÒª»Øµ½ to a non-shadowed ×´Ì¬£¬Çë×÷ÏÂÁÐ²½Öè£º

\begin{tscreen}
\begin{verbatim}
cd /etc
cp ~passwd passwd
chmod 644 passwd
\end{verbatim}
\end{tscreen}


Äã½«ÖØÐÂ´¢´æÕâÐ©µµ°¸µ½ÏÈÇ°Äã´¢´æËüÃÇµÄÕýÈ·Î»ÖÃ¡£






\section{ÆäËûÄãÐèÒªÉý¼¶(upgrade)»ò²¹Ç¿(patch)³ÌÊ½}

¼´Ê¹ shadow suite ¶Ô´ó²¿·ÖÐèÒª´æÈ¡ÃÜÂëµµµÄ³ÌÊ½¿ÉÒÔ°üº¬¸üÐÂ³ÌÊ½£¬µ«ÊÇÈÔÓÐÒ»Ð©ÐèÒª
´æÈ¡ÃÜÂëµµµÄ¶îÍâ³ÌÊ½ÔÚÏµÍ³ÖÐ¡£

Èç¹ûÄãÕýÖ´ÐÐ {\itshape Debian °æ±¾\/}  (»òÕß¼´Ê¹Äã²»ÊÇ)£¬Äã¿ÉÒÔÕÒµ½ Debian ÐèÒª rebuild 
µÄÔ­Ê¼Âë£º
ftp://ftp.debian.org/debian/stable/source/

Õâ½ÚÊ£âÅµÄ²¿·ÖÔÚÌÖÂÛ¸üÐÂ {\ttfamily adduser}, {\ttfamily wu\_ftpd}, {\ttfamily ftpd},
{\ttfamily pop3d}, {\ttfamily xlock},{\ttfamily xdm} ºÍ {\ttfamily sudo} ³ÌÊ½ÒÔ±ãì¶ÈÃÕâÐ©³ÌÊ½Ö§Ô®
shadow suite¡£

Çë¿´ \ref{sec-adding} {(Adding Shadow Support to a C program)} Õâ½Ú£¬Ö÷ÒªÊÇÔÚ
ÌÖÂÛÈçºÎ½« shadow Ö§Ô®·Åµ½ÆäËûÐèÒª³ÌÊ½(ËäÈ»ÕâÐ©³ÌÊ½ÐèÒªÒÔ SUID root Ö´ÐÐ»ò SGID shadow
ÐèÕýÈ·´æÈ¡ shadow µµ)¡£




\subsection{Slackware adduser ³ÌÊ½}

Slackware °æ±¾°üº¬Ò»¸öÐÂÔöÊ¹ÓÃÕßµÄ½»»¥³ÌÊ½½Ð×ö {\ttfamily /sbin/adduser}¡£¸Ã³ÌÊ½µÄ shadow
°æ±¾¿ÉÒÔÔÚ \onlynameurl{ftp://sunsite.unc.edu/pub/Linux/system/ Admin/accounts/adduser.shadow-1.4.tar.gz}ÕÒµ½¡£

ÎÒºÜ¹ÄÀøÄãÊ¹ÓÃ {\itshape Shadow Suite\/} ¹©Ó¦µÄ³ÌÊ½(ÀýÈç{\ttfamily useradd}, {\ttfamily usermod}, 
ºÍ {\ttfamily userdel}) À´È¡´ú slackware µÄ{\ttfamily adduser} ³ÌÊ½¡£ ËüÃÇÖ»Ðè»¨Ò»µãÊ±¼äÑ§Ï°
£¬µ«ÊÇËü½«ÖµµÃµÄ£¬ÒòÎªÄã¿ÉÒÔ¿´µ½¸ü¶à¿ØÖÆºÍÔÚÕýÈ·Õ¹ÏÖËø×¡ {\ttfamily /etc/passwd} ºÍ 
{\ttfamily /etc/shadow} µÄµµ°¸({\ttfamily adduser} ¾ÍÃ»ÓÐ°ì·¨ÂÞ)¡£



²Î¿¼\ref{sec-work} {(Putting the Shadow Suite to use)} ¸Ã½ÚµÃµ½¸ü¶àÏà¹Ø×ÊÑ¶¡£



µ«ÊÇÈç¹ûÄãÒÑ¾­ÓµÓÐÂÞ£¬½ÓÏÂÀ´ÊÇÄãÒª×öµÄ²¿·Ö£º

\begin{tscreen}
\begin{verbatim}
tar -xzvf adduser.shadow-1.4.tar.gz
cd adduser
make clean
make adduser
chmod 700 adduser
cp adduser /sbin
\end{verbatim}
\end{tscreen}





\subsection{wu\_ftpd Server}

´ó²¿·ÖµÄ Linux ÏµÍ³¶¼ÓÐ {\ttfamily wu\_ftpd} server¡£ Èç¹ûÄãµÄ°æ±¾Ã»ÓÐ¸½´ø shadow °²×°£¬
ÄÇ÷áÄãµÄ {\ttfamily wu\_ftpd} ¾ÍÃ»ÓÐ°ì·¨¶Ô shadow ±àÒë¡£ {\ttfamily wu\_ftpd} ÊÇ´Ó 
{\ttfamily inetd/tcpd} ¿ªÊ¼ÇÒÒÔ {\itshape root\/} È¨ÏÞÖ´ÐÐµÄ³ÌÊ½¡£ Èç¹ûÄãÕýÔÚÅÜÒ»¸ö¾É°æµÄ
{\ttfamily wu\_ftpd} daemon£¬ ÎÞÂÛÈçºÎÄã½«Òª¸üÐÂËüÒòÎª½Ï¾É°æ±¾ÓÐ bug ½«Î£¼° {\itshape root\/} 
È¨ÏÞ¡£(²Î¿¼ \nameurl{http://bach.cis.temple.edu/linux/linux-security/Linux-Security-FAQ/Linux-wu.ftpd-2.4-Update.html}{Linux security home page}
µÃµ½¸ü¶àÏà¹Ø×ÊÑ¶)¡£



ÐÒÔËµÄÊÇÄãÖ»ÐèÒªÈ¡µÄÓÐÇ¶Èë shaow µÄÔ­Ê¼ÂëºÍÖØÐÂ±àÒë¾Í¿ÉÒÔÂÞ£¡

Èç¹ûÄã²»ÊÇÕýÔÚÖ´ÐÐ ELF ÏµÍ³£¬ {\ttfamily wu\_ftp} server ¿ÉÒÔ´Ó Sunsite ÍøÖ·
\nameurl{ftp://sunsite.unc.edu/pub/Linux/system/Network/file-transfer/wu-ftpd-2.4-fixed.tar.gz}{wu-ftp-2.4-fixed.tar.gz} ÕÒµ½¡£

µ±Äã»ñµÃÕâ¸ö server£¬°ÑËü·ÅÔÚ {\ttfamily /usr/src}Ä¿Â¼£¬È»ááÊäÈë£º

\begin{tscreen}
\begin{verbatim}
cd /usr/src
tar -xzvf wu-ftpd-2.4-fixed.tar.gz
cd wu-ftpd-2.4-fixed
cp ./src/config/config.lnx.shadow ./src/config/config.lnx
\end{verbatim}
\end{tscreen}


È»áá±à¼­ {\ttfamily ./src/makefiles/Makefile.lnx}£¬ºÍ¸Ä±ä
\begin{tscreen}
\begin{verbatim}
LIBES    = -lbsd -support
\end{verbatim}
\end{tscreen}
 
ÕâÒ»ÐÐµ½£º
\begin{tscreen}
\begin{verbatim}
LIBES    = -lbsd -support -lshadow
\end{verbatim}
\end{tscreen}


ÏÖÔÚÄãÒÑ¾­×¼±¸ºÃÖ´ÐÐ script ½¨Á¢¸ú°²×°£º

\begin{tscreen}
\begin{verbatim}
cd /usr/src/wu-ftpd-2.4-fixed
/usr/src/wu-ftp-2.4.fixed/build lnx
cp /usr/sbin/wu.ftpd /usr/sbin/wu.ftpd.old
cp ./bin/ftpd /usr/sbin/wu.ftpd
\end{verbatim}
\end{tscreen}
 

ÕâÊÇÓÃÔÚ Linux shadow configuration file¡¢±àÒëºÍ°²×° server¡£

ÔÚÎÒµÄ Slackware 2.3 ÏµÍ³£¬ÎÒÒ²ÐèÒªÔÚÖ´ÐÐÇ°×÷ÏÂÁÐ²½Öè£º

{\ttfamily build}:
\begin{tscreen}
\begin{verbatim}
cd /usr/include/netinet
ln -s in_systm.h in_system.h
cd -
\end{verbatim}
\end{tscreen}


ÔÚ ELF ÏµÍ³ÏÂ»áÓÐ±àÒëÎÊÌâµÄ±¨¸æ£¬µ«ÊÇÏÂÒ»°æµÄ Beta °æÔò¿ÉÒÔÕýÈ·µÄÖ´ÐÐ¡£
¿ÉÒÔ´Ó \nameurl{ftp://tscnet.com/pub/linux/network/ftp/wu-ftpd-2.4.2-beta-10.tar.gz}{wu-ftp-2.4.2-beta-10.tar.gz} ÕÒµ½¡£

µ±Äã»ñµÃÕâ¸ö server£¬°ÑËü·ÅÔÚ {\ttfamily /usr/src}Ä¿Â¼£¬È»ááÊäÈë£º
\begin{tscreen}
\begin{verbatim}
cd /usr/src
tar -xzvf wu-ftpd-2.4.2-beta-9.tar.gz
cd wu-ftpd-beta-9
cd ./src/config
\end{verbatim}
\end{tscreen}


È»áá±à¼­ {\ttfamily config.lnx}£¬ºÍ¸Ä±ä£º
\begin{tscreen}
\begin{verbatim}
#undef SHADOW.PASSWORD
\end{verbatim}
\end{tscreen}

ÕâÒ»ÐÐµ½£º
\begin{tscreen}
\begin{verbatim}
#define SHADOW.PASSWORD
\end{verbatim}
\end{tscreen}

È»áá£¬
\begin{tscreen}
\begin{verbatim}
cd ../Makefiles
\end{verbatim}
\end{tscreen}

ÇÒ±à¼­ {\ttfamily Makefile.lnx} µµºÍ¸Ä±ä

\begin{tscreen}
\begin{verbatim}
LIBES = -lsupport -lbsd # -lshadow
\end{verbatim}
\end{tscreen}

ÕâÒ»ÐÐµ½£º
\begin{tscreen}
\begin{verbatim}
LIBES = -lsupport -lbsd -lshadow
\end{verbatim}
\end{tscreen}

È»áá½¨Á¢(build)ºÍ°²×°(install)£º
\begin{tscreen}
\begin{verbatim}
cd ..
build lnx
cp /usr/sbin/wu.ftpd /usr/sbin/wu.ftpd.old
cp ./bin/ftpd /usr/sbin/wu.ftpd
\end{verbatim}
\end{tscreen}
 

×¢£ºÄãÓ¦¸Ã¼ì²éÄãµÄ {\ttfamily /etc/inetd.conf} µµÀ´È·ÈÏÄãµÄ wu.ftpd server ÊÇ²»ÊÇÕæµÄ»îÖø¡£
ÓÐÐ©°æ±¾¿ÉÄÜ½«  server daemons ·ÅÔÚ²»Í¬µÄµØ·½»òÓÃ²»Í¬µÄÃû×Ö±íÊ¾¡£




\subsection{±ê×¼ ftpd}

Èç¹ûÄãÕýÔÚÖ´ÐÐ±ê×¼µÄ {\ttfamily ftpd} server£¬ÎÒ½«½¨ÒéÄã¸üÐÂ {\ttfamily wu\_ftpd} server¡£
Àë¿ªÉÏÊöµÄ bug £¬ÏµÍ³»á±È½Ï°²È«¡£

Èç¹ûÄã¼á³ÖÔÚ±ê×¼Ä£Ê½£¬»òÕßÄãÐèÒª {\itshape NIS\/} Ö§Ô®£¬ÔÚ Sunsite  
\nameurl{ftp://sunsite.unc.edu/pub/Linux/system/Network/file-transfer/ftpd-shadow-nis.tgz}{ftpd-shadow-nis.tgz} ÓÐ²Î¿¼×ÊÁÏ¡£




\subsection{pop3d (Post Office Protocol 3)}

Èç¹ûÄãÐèÒªÖ§Ô®µÚÈý°æ {\itshape Post Office Protocol (POP3)\/}£¬Äã½«ÐèÒªÖØÐÂ±àÒë {\ttfamily pop3d}
³ÌÊ½¡£ {\ttfamily pop3d} ¿ÉÒÔÍ¸¹ý {\ttfamily inetd/tcpd} ÒÔ {\ttfamily root} È¨ÏÞÕý³£µÄÖ´ÐÐ¡£

´Ó Sunsite ÓÐÁ½¸ö°æ±¾¿ÉÒÔ»ñµÃ£º 
\nameurl{ftp://sunsite.unc.edu/pub/Linux/system/Mail/pop/pop3d-1.00.4.linux.shadow.tar.gz}{pop3d-1.00.4.linux.shadow.tar.gz}
ºÍ
\nameurl{ftp://sunsite.unc.edu/pub/Linux/system/Mail/pop/pop3d+shadow+elf.tar.gz}{pop3d+shadow+elf.tar.gz}

ÕâÁ½¸ö¶¼ºÜ¼òµ¥¿ÉÒÔ°²×°¡£




\subsection{xlock}



Èç¹ûÄã°²×° shadow suite£¬È»ááÖ´ÐÐ {\itshape X Windows System\/} ºÍ  
lock Ó©Ä»Ã»ÒÔ¸üÐÂÄãµÄ {\ttfamily xlock} µµ£¬ Äã½«±ØÐëÊ¹ÓÃ {\ttfamily CNTL-ALT-Fx} È¥ÇÐ»»
ÁíÒ»¸ö {\itshape tty\/}£¬Ç©Èë(login)ºÍÉ±µô(kill) {\ttfamily xlock} process 
(»òÊ¹ÓÃ {\ttfamily CNTL-ALT-BS} É±µô X server)¡£
ºÜÐÒÔËµÄÕâÒ²ºÜÈÝÒ×¿ÉÒÔ¸üÐÂÄãµÄ {\ttfamily xlock} ³ÌÊ½¡£

Èç¹ûÄãÕýÖ´ÐÐ XFree86 Versions 3.x.x£¬ÇÒÕýÕýÈ·Ê¹ÓÃ
{\ttfamily xlockmore} (ÊÇÒ»¸öºÜ°ôµÄÓ©Ä»±£»¤³ÌÊ½).
Õâ¸öÌ×¼þÖ§Ô® {\itshape shadow\/}£¬Ö»ÒªÖØÐÂ±àÒë¼´¿É¡£Èç¹ûÄãÓÐÈÎºÎ½ÏÀÏµÄ {\ttfamily xlock}
°æ±¾£¬ÎÒ½¨ÒéÄã¸üÐÂÏÂÁÐ°æ±¾£º

{\ttfamily xlockmore-3.5.tgz} ¿ÉÒÔ´Ó
\nameurl{ftp://sunsite.unc.edu/pub/Linux/X11/xutils/screensavers/xlockmore-3.7.tgz}{}
ÍøÕ¾»ñµÃ¡£

»ù±¾ÉÏÕâÊÇÄãËùÒªµÄ¡£

ß¢È¡ {\ttfamily xlockmore-3.7.tgz} £¬²¢½«Ëü·ÅÔÚ {\ttfamily /usr/src} Ä¿Â¼²¢½âÑ¹Ëõ£º
\begin{tscreen}
\begin{verbatim}
tar -xzvf xlockmore-3.7.tgz
\end{verbatim}
\end{tscreen}


±à¼­Õâ¸öµµ£º {\ttfamily /usr/X11R6/lib/X11/config/linux.cf}, ºÍ¸Ä±ä
\begin{tscreen}
\begin{verbatim}
#define HasShadowPasswd    NO

ÕâÒ»ÐÐµ½£º

#define HasShadowPasswd    YES
\end{verbatim}
\end{tscreen}


È»áá½¨Á¢¿ÉÖ´ÐÐµµ£º
\begin{tscreen}
\begin{verbatim}
cd /usr/src/xlockmore
xmkmf
make depend
make
\end{verbatim}
\end{tscreen}


È»áá°áÒÆËùÒÔµµ°¸µ½ÕýÈ·Ä¿Â¼ÇÒ¸üÐÂµµ°¸ÓµÓÐÕß¼°Ö´ÐÐÈ¨ÏÞ£º

\begin{tscreen}
\begin{verbatim}
cp xlock /usr/X11R6/bin/
cp XLock /var/X11R6/lib/app-defaults/
chown root.shadow /usr/X11R6/bin/xlock
chmod 2755 /usr/X11R6/bin/xlock
chown root.shadow /etc/shadow
chmod 640 /etc/shadow
\end{verbatim}
\end{tscreen}




ÄãµÄ xlock ½«¿ÉÒÔÕýÈ·µÄÔË×÷ÂÞ£¡




\subsection{xdm}

{\ttfamily xdm} ÊÇÒ»¸ö¿ÉÒÔ±íÊ¾ÔÚ X-Windows Ç©Èë»­ÃæµÄ³ÌÊ½¡£Ä³Ð©ÏµÍ³¿ªÊ¼ {\ttfamily xdm} 
µ±ÏµÍ³±»¸æÖªµÀÒ»¸öÌØ¶¨µÄÖ´ÐÐË®×¼(²Î¿¼ {\ttfamily /etc/inittab})¡£



°éËæÖø {\itshape Shadow Suite\/} °²×°£¬ {\ttfamily xdm} ÐèÒª±»¸üÐÂ¡£
ºÜÐÒÔËµÄÕâÒ²ºÜÈÝÒ×¿ÉÒÔ¸üÐÂÄãµÄ {\ttfamily xdm} ³ÌÊ½¡£





{\ttfamily xdm.tar.gz} ¿ÉÒÔ´ÓÏÂÁÐÍøÖ·»ñµÃ£º
\nameurl{ftp://sunsite.unc.edu/pub/Linux/X11/xutils/xdm.tar.gz}{}

ß¢È¡ {\ttfamily xdm.tar.gz} µµ²¢½«Ëü·ÅÔÚ {\ttfamily /usr/src}Ä¿Â¼È»áá½âÑ¹Ëõ£º
\begin{tscreen}
\begin{verbatim}
tar -xzvf xdm.tar.gz
\end{verbatim}
\end{tscreen}


±à¼­Õâ¸öµµ£º {\ttfamily /usr/X11R6/lib/X11/config/linux.cf}£¬ÇÒ¸Ä±ä
\begin{tscreen}
\begin{verbatim}
#define HasShadowPasswd    NO

ÕâÒ»ÐÐµ½£º

#define HasShadowPasswd    YES
\end{verbatim}
\end{tscreen}


È»áá½¨Á¢¿ÉÖ´ÐÐµµ£º
\begin{tscreen}
\begin{verbatim}
cd /usr/src/xdm
xmkmf
make depend
make
\end{verbatim}
\end{tscreen}


È»áá°áÒÆËùÓÐµµ°¸ÕýÈ·Ä¿Â¼£º
\begin{tscreen}
\begin{verbatim}
cp xdm /usr/X11R6/bin/
\end{verbatim}
\end{tscreen}


{\ttfamily xdm} ÒÔ {\itshape root\/} È¨ÏÞÔÚÖ´ÐÐ£¬ËùÒÔÄã²»ÐèÒª¸Ä±äµµ°¸´æÈ¡È¨ÏÞ¡£






\subsection{sudo}

{\ttfamily sudo} ³ÌÊ½ÔÊÐíÏµÍ³¹ÜÀíÔ±ÈÃÊ¹ÓÃÕß¿ÉÒÔÒÔ root È¨ÏÞÕý³£µÄÖ´ÐÐ³ÌÊ½¡£
ÕâÊÇ·Ç³£·½±ãµÄÒòÎªËü¿ÉÒÔÏÞÖÆ¹ÜÀíÕßÖ´ÐÐ root ÕÊºÅ±¾ÉíÈ¨ÏÞ£¬»¹¿ÉÒÔÔÊÐíÊ¹ÓÃÕß×÷
Ïñ mounte drives µÄÊÂÇé¡£

{\ttfamily sudo} ÐèÒª¶ÁÈ¡ÃÜÂëÒòÎªÔÚÖ´ÐÐÊ±ÐèÈ·ÈÏÊ¹ÓÃÕßÃÜÂë¡£ {\ttfamily sudo} ÒÑ¾­Ö´ÐÐ SUID root£¬
ËùÒÔ´æÈ¡ {\ttfamily /etc/shadow} µ³²»ÊÇÎÊÌâ¡£

{\ttfamily sudo} Ö§Ô® shadow suite ¿ÉÔÚÏÂÁÐÍøÖ·È¡µÃ£º
\nameurl{ftp://sunsite.unc.edu/pub/Linux/system/Admin/sudo-1.2-shadow.tgz}{}

{\itshape ¾¯¸æ\/}£ºµ±Äã°²×° {\ttfamily sudo} ÄãµÄ {\ttfamily /etc/sudoers} µµ½«È¡´úÔ¤ÉèÖµ£¬ËùÒÔÄã
ÐèÒª±¸·ÝÔ­Ê¼³ÌÊ½¡£Èç¹ûÄãÓÐ¼ÒÈÎºÎÉè¶¨ÔÚÔ¤Éè³ÌÊ½£¬Äã¿ÉÄÜÒª±à¼­ Makefile ÇÒÒÆ³ý¸´ÖÆ¸Ãµµµ½
{\ttfamily /etc} µÄÕâÐÐ¡£



¸ÃÌ×¼þÒÑ¾­¶Ô shadow ½øÐÐÉè¶¨£¬ËùÒÔÖ»ÒªÖØÐÂ±àÒë¸ÃÌ×¼þ¼´¿É (°ÑËü·ÅÔÚ {\ttfamily /usr/src} Ä¿Â¼)£º
\begin{tscreen}
\begin{verbatim}
cd /usr/src
tar -xzvf sudo-1.2-shadow.tgz
cd sudo-1.2-shadow
make all
make install
\end{verbatim}
\end{tscreen}





\subsection{imapd (E-Mail {[}pine package{]})}

{\ttfamily imapd} ÊÇÒ»¸öÏñ {\ttfamily pop3d} µÄ email server¡£ 
{\ttfamily imapd} ËæÖø {\itshape Pine E-mail\/} Ì×¼þ·¢Éú¡£ Æä²Ù×÷ÊÖ²áÔÚ½éÉÜ¸ÃÌ×¼þÊ±¼´°üº¬
shadow Ö§Ô®¡£È»¶ø£¬ÎÒ·¢ÏÖÕâ²»È«È»ÕýÈ·¡£ ÔÙ¼ÓÉÏÔÚ±àÒëÊ±¼ÓÉÏ  {\ttfamily libshadow.a} º¯Ê½¿â
ºÍ¸ÃÌ×¼þ½áºÏ build script / Makefile ÊÇ·Ç³£²»ÈÝÒ×µÄ¡£ËùÒÔ¶Ô {\ttfamily imapd} ¼ÓÈë shadow
Ö§Ô®ÊÇ²»Ì«¿ÉÄÜµÄ¡£



Èç¹ûÓÐÈÎºÎ´ð°¸£¬¿ÉÒÔ Email ¸øÎÒ£¬ÎÒ»á½«¸Ã½â´ð·Åµ½ÕâÀï¡£




\subsection{pppd (Point-to-Point Protocol Server)}

pppd server ¿ÉÒÔÊ¹ÓÃ¼¸ÖÖÈ¨ÏÞÉè¶¨£º
{\itshape Password Authentication Protocol\/} (PAP) ºÍ {\itshape Cryptographic
Handshake Authentication Protocol\/} (CHAP)¡£   pppd server ´Ó
{\ttfamily /etc/ppp/chap-secrets} ºÍ/»ò {\ttfamily /etc/ppp/pap-secrets} µµ¶ÁÈ¡ÃÜÂë×Ö´®¡£
Èç¹ûÄãÕýÊ¹ÓÃÔ¤Éè pppd µÄÖ´ÐÐ£¬¾ÍÃ»ÓÐ±ØÒªÔÙÖØÐÂ°²×° pppd ¡£

pppd ÒÔÔÊÐíÄãÊ¹ÓÃ {\itshape login\/} ²ÎÊý¡£ Èç¹û {\itshape login\/} Ñ¡Ïî±»Ñ¡È¡£¬
pppd ½«Ê¹ÓÃ {\ttfamily /etc/passwd} µµµÄÕÊºÅÃÜÂë¸ø {\itshape PAP\/}. µ±È»ÔÚ²»¾ÃÃÜÂëµµ»áÊÇ 
shadowedm¡£pppd-1.2.1d µµÒÑ¾­¼ÓÈë¶Ô shadow µÄÖ§Ô®¡£



ÏÂÒ»½Ú¼ÓÈëÖ§Ô® shadow µÄ¡õÀýÊÇÕë¶Ô
{\ttfamily pppd-1.2.1d} (Ò»¸ö½ÏÀÏ°æ±¾µÄ pppd).

{\ttfamily pppd-2.2.0} °æ¾ÍÒÑ¾­°üÀ¨ shadow Ö§Ô®ÂÞ¡£




\section{½« Shadow Suite ·Å½øÀ´Ê¹ÓÃ¡£\label{sec-work}}

Õâ½ÚÃèÊöÄãÐèÒªÖªµÀÓÐÐ©³ÌÊ½ÔÚ°²×°Ê±¾ÍÒÑ¾­ÓÐ {\itshape Shadow Suite\/}¡£
´ó²¿·ÖµÄ×ÊÑ¶ÔÚ²Ù×÷ÊÖ²á¿ÉÒÔÕÒµ½¡£




\subsection{ÐÂÔö¡¢ÐÞ¸ÄºÍÉ¾³ýÊ¹ÓÃÕß}

{\itshape Shadow Suite\/} ÐÂÔöÏÂÁÐÖ¸ÁîÓÃÀ´ÐÂÔö¡¢ÐÞ¸ÄºÍÉ¾³ýÊ¹ÓÃÕß¡£ ÕâÒ²ÊÇ¿ÉÒÔ°²×°
{\ttfamily adduser} ³ÌÊ½¡£




\subsubsection{useradd}

{\ttfamily useradd} Ê¹Áî¿ÉÓÃÔÚÏµÍ³ÖÐÐÂÔöÊ¹ÓÃÕß¡£ ÄãÒ²¿ÉÒÔ²ÉÓÃ´ËÖ¸ÁîÀ´¸Ä±äÔ¤Éè×Ö´®¡£

ÄãÓ¦¸Ã×öµÄµÚÒ»¼þÊÂÊÇ¼ì²éÔ¤ÉèÖµÉè¶¨ºÍÕë¶ÔÄãµÄÏµÍ³½øÐÐ¸Ä±ä£º
\begin{tscreen}
\begin{verbatim}
useradd -D
\end{verbatim}
\end{tscreen}
\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
GROUP=1
HOME=/home
INACTIVE=0
EXPIRE=0
SHELL=
SKEL=/etc/skel
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}


Ô¤ÉèÖµ²»È«ÊÇÄãÒªµÄ£¬ËùÒÔÈç¹ûÄã¿ªÊ¼ÐÂÔöÊ¹ÓÃÕß£¬Äã±ØÐëÏêÔÄÃ¿¸öÊ¹ÓÃÕß×ÊÑ¶¡£
¶øÇÒ£¬ÎÒÃÇ¿ÉÄÜºÍÓ¦¸Ã¸Ä±äÉè¶¨Öµ¡£

ÔÚÎÒµÄÏµÍ³ÉÏ£º
\begin{itemize}
\item ÎÒÒªÔ¤ÉèÈº×éÊÇ 100
\item ÎÒÒªÃÜÂëÃ¿µ½ 60 Ìì¾Íµ½ÆÚ
\item ÎÒ²»ÒªËø×¡ÕÊºÅÒòÎªÃÜÂë»áµ½ÆÚ
\item ÎÒÒªÔ¤Éè shell ÊÇ {\ttfamily /bin/bash}
\end{itemize}

ÎªÁËÕâÐ©¸Ä±ä£¬ÎÒÒªÊ¹ÓÃ£º
\begin{tscreen}
\begin{verbatim}
useradd -D -g100 -e60 -f0 -s/bin/bash
\end{verbatim}
\end{tscreen}
 

ÏÖÔÚÖ´ÐÐ {\ttfamily useradd -D} ½«µÃµ½£º
\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
GROUP=100
HOME=/home
INACTIVE=0
EXPIRE=60
SHELL=/bin/bash
SKEL=/etc/skel
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}




¾¡¹ÜÒÀÕÕÄãÐèÒªÐÞ¸Ä£¬Ô¤ÉèÖµ½«´æÔÚ {\ttfamily /etc/default/useradd}.

ÏÈÔÚÄã¿ÉÒÔÊ¹ÓÃ {\ttfamily useradd} À´ÐÂÔöÏµÍ³Ê¹ÓÃÕß¡£¾ÙÀýËµÃ÷£¬ÐÂÔöÒ»Ê¹ÓÃÕß {\ttfamily fred}
Ê¹ÓÃÔ¤ÉèÖµ·½Ê½ÈçÏÂ£º
\begin{tscreen}
\begin{verbatim}
useradd -m -c "Fred Flintstone" fred
\end{verbatim}
\end{tscreen}


Õâ½«ÔÚ {\ttfamily /etc/passwd} µµÖÐµÄÒ»ÐÐ½¨Á¢ÈçÏÂ£º
\begin{tscreen}
\begin{verbatim}
fred:*:505:100:Fred Flintstone:/home/fred:/bin/bash
\end{verbatim}
\end{tscreen}

ÇÒÔÚ {\ttfamily /etc/shadow} µµÖÐµÄÒ»ÐÐ½¨Á¢ÈçÏÂ£»
\begin{tscreen}
\begin{verbatim}
fred:!:0:0:60:0:0:0:0
\end{verbatim}
\end{tscreen}

{\ttfamily fred}µÄ¸ùÄ¿Â¼½«±»½¨Á¢ÇÒ {\ttfamily /etc/skel} µÄÄÚÈÝ½«±»¸´ÖÆÒòÎªÖ¸Áî¾äÖÐÓÐ
{\ttfamily -m} Éè¶¨¡£

ÒòÎªÎÒÃÇ²¢Î´ÏêÊö UID£¬ÏµÍ³»áÖ±½ÓÑ°ÕÒÏÂÒ»¸ö¿É»ñµÃµÄ±àºÅ¡£

{\ttfamily fred}µÄÕÊºÅ±»½¨Á¢ÂÞ£¬µ«ÊÇ {\ttfamily fred} ÈÔÈ»²»ÄÜÇ©ÈëÖ±µ½ÎÒÃÇ²»ÔÙËø×¡(unlock)Õâ¸öÕÊºÅ¡£
Í¸¹ý¸ü¸ÄÃÜÂëÍê³É unlock ÕÊºÅ£¬·½·¨ÈçÏÂ£º

\begin{tscreen}
\begin{verbatim}
passwd fred
\end{verbatim}
\end{tscreen}

\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
Changing password for fred¡õEnter the new password (minimum of 5 characters)
Please use a combination of upper and lower case letters and numbers.
New Password: *******
Re-enter new password: *******
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}

ÏÖÔÚ {\ttfamily /etc/shadow} µµ½«°üº¬£º
\begin{tscreen}
\begin{verbatim}
fred:J0C.WDR1amIt6:9559:0:60:0:0:0:0
\end{verbatim}
\end{tscreen}

ÇÒ {\ttfamily fred} ½«¿ÉÒÔÇ©ÈëºÍÊ¹ÓÃ¸ÃÏµÍ³¡£ 
{\ttfamily useradd} ºÍÆäËû¸½´ø {\itshape Shadow Suite\/} ±È½ÏºÃµÄµØ·½ÊÇ¿ÉÒÔ×Ô¶¯¸Ä±ä
{\ttfamily /etc/passwd} ºÍ {\ttfamily /etc/shadow} ¡£ ËùÒÔÈç¹ûÄãÕýÔÚÐÂÔöÒ»¸öÊ¹ÓÃÕß£¬
ÇÒÁíÒ»¸öÊ¹ÓÃÕßÕýÔÚ¸ü¸ÄÃÜÂë£¬ÕâÁ½¸ö²Ù×÷¶¼¿ÉÒÔÕýÈ·µÄÖ´ÐÐ¡£

ÄãÊ¹ÓÃÌá¹©µÄÖ¸Áî±ÈÖ±½Ó´æÈ¡ {\ttfamily /etc/passwd} ºÍ {\ttfamily /etc/shadow} µµ»¹ºÃ¡£  
Èç¹ûÄãÕý±à¼­ {\ttfamily /etc/shadow} µµ£¬ÇÒÓÐ¸öÊ¹ÓÃÕßÔÚÄã±à¼­Ê±Òª¸Ä±äËûµÄÃÜÂë£¬
È»ááÄã´¢´æ±à¼­½á¹û£¬Õâ¸öÊ¹ÓÃÕßµÄÃÜÂë½«»áÒÅÊ§µô¡£

ÕâÀïÊÇÊ¹ÓÃ {\ttfamily useradd} ºÍ {\ttfamily passwd} ÐÂÔöÊ¹ÓÃÕßµÄÒ»Ð© interactive script £º
\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
#!/bin/bash
#
# /sbin/newuser - A script to add users to the system using the Shadow
#                 Suite's useradd and passwd commands.
#
# Written my Mike Jackson <mhjack@tscnet.com> as an example for the Linux
# Shadow Password Howto.  Permission to use and modify is expressly granted.
#
# This could be modified to show the defaults and allow modification similar
# to the Slackware Adduser program.  It could also be modified to disallow
# stupid entries.  (i.e. better error checking).
#
##
#  Defaults for the useradd command
##
GROUP=100        # Default Group
HOME=/home       # Home directory location (/home/username)
SKEL=/etc/skel   # Skeleton Directory
INACTIVE=0       # Days after password expires to disable account (0=never)
EXPIRE=60        # Days that a passwords lasts
SHELL=/bin/bash  # Default Shell (full path)
##
#  Defaults for the passwd command
##
PASSMIN=0        # Days between password changes
PASSWARN=14      # Days before password expires that a warning is given
##
#  Ensure that root is running the script.
##
WHOAMI=`/usr/bin/whoami`
if [ $WHOAMI != "root" ]; then
        echo "You must be root to add news users!"
        exit 1
fi
##
#  Ask for username and fullname.
##
echo ""
echo -n "Username: "
read USERNAME
echo -n "Full name: "
read FULLNAME
#
echo "Adding user: $USERNAME."
#
# Note that the "" around $FULLNAME is required because this field is
# almost always going to contain at least on space, and without the "'s
# the useradd command would think that you we moving on to the next
# parameter when it reached the SPACE character.
#
/usr/sbin/useradd -c"$FULLNAME" -d$HOME/$USERNAME -e$EXPIRE \
        -f$INACTIVE -g$GROUP -m -k$SKEL -s$SHELL $USERNAME
##
#  Set password defaults
##
/bin/passwd -n $PASSMIN -w $PASSWARN $USERNAME >/dev/null 2>&1
##
#  Let the passwd command actually ask for password (twice)
##
/bin/passwd $USERNAME
##
#  Show what was done.
##
echo ""
echo "Entry from /etc/passwd:"
echo -n "   "
grep "$USERNAME:" /etc/passwd
echo "Entry from /etc/shadow:"
echo -n "   "
grep "$USERNAME:" /etc/shadow
echo "Summary output of the passwd command:"
echo -n "   "
passwd -S $USERNAME
echo ""
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}
 

ÐÂÔöÊ¹ÓÃÕßÊÇÓÃ script ±ÈÖ±½Ó±à¼­ {\ttfamily /etc/passwd} / {\ttfamily /etc/shadow} µµ»òÊ¹ÓÃ
Ïñ Slackware µÄ {\ttfamily adduser} ³ÌÊ½»¹ÒªºÃ¡£ 

ÐèÒª¸ü¶à {\ttfamily useradd} ×ÊÑ¶Çë²ÎÕÕÏßÉÏ²Ù×÷ÊÖ²á¡£




\subsubsection{usermod}

{\ttfamily usermod} ³ÌÊ½ÊÇÓÃÔÚÐÞ¸ÄÊ¹ÓÃÕß×ÊÑ¶¡£
ËüµÄ²ÎÊýÊ¹ÓÃºÍ {\ttfamily useradd} ³ÌÊ½ÀàËÆ¡£ 

Èç¹ûÄãÒª¸üÐÂ {\ttfamily fred} µÄ shell£¬ÄãÒª×÷ÏÂÁÐ²½Öè£º
\begin{tscreen}
\begin{verbatim}
usermod -s /bin/tcsh fred
\end{verbatim}
\end{tscreen}


ÏÖÔÚ {\ttfamily fred} µÄ {\ttfamily /etc/passwd} µµ½«±ä³É£º
\begin{tscreen}
\begin{verbatim}
fred:*:505:100:Fred Flintstone:/home/fred:/bin/tcsh
\end{verbatim}
\end{tscreen}

Èç¹ûÒªÊ¹ {\ttfamily fred} µÄÕÊºÅµ½ÆÚÈÕÎª 09/15/97£º
\begin{tscreen}
\begin{verbatim}
usermod -e 09/15/97 fred
\end{verbatim}
\end{tscreen}

ÏÖÔÚ {\ttfamily fred} ÔÚ {\ttfamily /etc/shadow} µÄÀ¸Î»±ä³É£º
\begin{tscreen}
\begin{verbatim}
fred:J0C.WDR1amIt6:9559:0:60:0:0:10119:0
\end{verbatim}
\end{tscreen}


ÐèÒª¸ü¶à {\ttfamily usermod} ×ÊÑ¶Çë²ÎÕÕÏßÉÏ²Ù×÷ÊÖ²á¡£




\subsubsection{userdel}

{\ttfamily userdel} ÓÃÔÚÉ¾³ýÊ¹ÓÃÕß£¬Ê¹ÓÃ·½·¨Îª£º
\begin{tscreen}
\begin{verbatim}
userdel -r username
\end{verbatim}
\end{tscreen}

{\ttfamily -r} ²ÎÊý¿ÉÒÔ½«¸ÃÊ¹ÓÃÕß¸ùÄ¿Â¼È«²¿ÒÆ³ý¡£Î»ÔÚÆÚ´ýÄ¿Â¼µÄµµ°¸ÔòÐèÊÖ¶¯ÒÆ³ý¡£

Èç¹ûÄãÖ»ÊÇÒª¼òµ¥µÄËø×¡ÕÊºÅ¶øÃ»ÓÐÒªÉ¾³ýËü£¬½¨ÒéÄãÊ¹ÓÃ {\ttfamily passwd} Ö¸Áî¡£




\subsection{passwd Ö¸ÁîºÍ passwd ÀÏ»¯}

{\ttfamily passwd} Ö¸ÁîºÜÃ÷ÏÔÊ¹ÓÃÔÚ¸Ä±äÃÜÂë£¬³ý´ËÖ®Íâ£¬
¿ÉÓÉ {\itshape root\/} Ê¹ÓÃÔÚ£º
\begin{itemize}
\item Lock ºÍ unlock ÕÊºÅ ({\ttfamily -l} and {\ttfamily -u})
\item Éè¶¨ÃÜÂëºÏ·¨µÄ×î´óÌìÊý
({\ttfamily -x})
\item Éè¶¨ÃÜÂë¸Ä±ä¼äµÄ×îÐ¡ÌìÊý ({\ttfamily -n})
\item Éè¶¨ÃÜÂëµ½ÆÚµÄ¾¯¸æÌìÊý
({\ttfamily -w})
\item Éè¶¨ÔÚÕÊºÅÎ´±»ËøËÀÃÜÂëµ½ÆÚááµÄ¾¯¸æÌìÊý ({\ttfamily -i})
\item ÔÊÐí²éÑ¯ÕÊºÅ×ÊÑ¶ ({\ttfamily -S})
\end{itemize}


¾ÙÀýËµÃ÷£¬Èç¹ûÒªËøËÀ {\ttfamily fred} ÕÊºÅ£º
\begin{tscreen}
\begin{verbatim}
passwd -S fred
fred P 03/04/96 0 60 0 0
\end{verbatim}
\end{tscreen}

Õâ±íÊ¾ {\ttfamily fred} µÄÃÜÂëÊÇÓÐÐ§µÄ£¬ËüÔÚ 03/04/96 ±»ÐÞ¸ÄÇÒÈÎºÎÊ±¼ä¶¼¿É±»ÐÞ¸Ä
£¬ fred ½«²»»áÊÕµ½¾¯¸æÇÒÕÊºÅ½«²»»áÒòÃÜÂëµ½ÆÚ¶ø¹Ø±Õ¡£



Õâ±íÊ¾Èç¹û {\ttfamily fred} ÔÚÃÜÂëµ½ÆÚááÇ©Èë£¬Ëü½«±»ÒªÇóÓÃÒ»¸öÐÂÃÜÂëÇ©Èë¡£



Èç¹ûÎÒÃÇ¾ö¶¨Òª¾¯¸æ {\ttfamily fred} ÔÚÃÜÂë¹ýÆÚÇ° 14 Ìì£¬ÇÒÈÃËüµÄÕÊºÅÔÚµ½ÆÚáá14Ìì¾¯¸æ£¬
ÎÒÃÇÐèÒª×÷ÏÂÁÐ²½Öè£º

\begin{tscreen}
\begin{verbatim}
passwd -w14 -i14 fred
\end{verbatim}
\end{tscreen}

ÏÖÔÚ {\ttfamily fred} ¸Ä±äÎª£º
\begin{tscreen}
\begin{verbatim}
fred P 03/04/96 0 60 14 14
\end{verbatim}
\end{tscreen}

ÐèÒª¸ü¶à {\ttfamily passwd} ×ÊÑ¶Çë²ÎÕÕÏßÉÏ²Ù×÷ÊÖ²á¡£




\subsection{login.defs µµ}

{\ttfamily /etc/login} µµÊÇ¶Ô {\ttfamily login} ³ÌÊ½µÄ configuration file ÇÒ ¶Ô
{\itshape Shadow Suite\/}¡£

{\ttfamily /etc/login} °üº¬´ÓÔ¤ÉèÖµÃÜÂë¸Ä±äµÄÇý¶¯Éè¶¨¡£

{\ttfamily /etc/login.defs} µµÊÇÒ»¸öºÜºÃµÄÎÄ¼þµµ£¬È»¶øÈÔÓÐÐ©ÊÂÇéÒª×¢Òâ£º

\begin{itemize}
\item It contains flags that can be turned on or off that determine the
amount of logging that takes place.
\item It contains pointers to other configuration files.
\item It contains defaults assignments for things like password aging.
\end{itemize}


¸úÈ¥ÉÏÊöÄã¿ÉÒÔ·¢ÏÖÕâÊÇÒ»¸öÖØÒªµµ£¬ÇÒÄãÓ¦¸ÃÈ·ÈÏÄ¿Ç°Éè¶¨¼°Äã½«¶ÔÄãÏµÍ³µÄÉè¶¨ÄÚÈÝ¡£




\subsection{Èº×éÃÜÂë}

{\ttfamily /etc/groups} µµ°üÀ¨ÔÊÐíÊÇÓÃÕß´æÈ¡Èº×éÖ®ÃÜÂë¡£ Èç¹ûÄã¶¨Òå
{\ttfamily SHADOWGRP} ÔÚ {\ttfamily /usr/src/shadow-YYMMDD/config.h} µµ½«¿ªÆô¸Ã¹¦ÄÜ¡£

Èç¹ûÄã¶¨Òå¸Ã³£ÊýÇÒ±àÒëËü£¬ÄãÐè½¨Á¢Ò»¸ö {\ttfamily /etc/gshadow} µµÀ´±£´æÈº×éÃÜÂë
ºÍÈº×é¹ÜÀíÕß×ÊÑ¶¡£



µ±Äã½¨Á¢ {\ttfamily /etc/shadow}¡£ÄãÊ¹ÓÃÒ»¸öºô½Ð³ÌÊ½½Ð×ö {\ttfamily pwconv}£¬
¸Ã³ÌÊ½²»»á½¨Á¢ {\ttfamily /etc/gshadow} µµ£¬µ«ÊÇÕâÃ»¹ØÏµ£¬Ö»ÒªÄã×ÔÐÐ½¨Á¢¼´¿É¡£



ÎªÁË½¨Á¢ÆðÊ¼ {\ttfamily /etc/gshadow} µµÒªÖ´ÐÐÏÂÁÐ²½Öè£º
\begin{tscreen}
\begin{verbatim}
touch /etc/gshadow
chown root.root /etc/gshadow
chmod 700 /etc/gshadow
\end{verbatim}
\end{tscreen}


Ã¿´ÎÄã½¨Á¢Ò»¸öÐÂÈº×é£¬ËüÃÇ»á±»¼Óµ½ {\ttfamily /etc/group} ºÍ {\ttfamily /etc/gshadow} µµ¡£
Èç¹ûÄãÍ¸¹ýÐÂÔö»òÒÆ³ýÊ¹ÓÃÕßÀ´ÐÞ¸ÄÈº×é»ò¸Ä±äÈº×éÃÜÂë£¬{\ttfamily /etc/gshadow} µµ¶¼½«±»¸Ä±ä¡£



{\ttfamily groups}, {\ttfamily groupadd}, {\ttfamily groupmod}, ºÍ 
{\ttfamily groupdel} ³ÌÊ½ÊÇÓÃÀ´¹©Ó¦  {\itshape Shadow Suite\/} ²¿·Ö¿ÉÒÔ±ä¸üÈº×é¡£

{\ttfamily /etc/group} µµ¸ñÊ½ÈçÏÂ£º
\begin{tscreen}
\begin{verbatim}
groupname:!:GID:member,member,...
\end{verbatim}
\end{tscreen}

ÆäÖÐ£º
\begin{description}
\item[{\ttfamily groupname}] \mbox{}

The name of the group

\item[{\ttfamily !}] \mbox{}

The field that normally holds the password, but that
is now relocated to the {\ttfamily /etc/gshadow} file.

\item[{\ttfamily GID}] \mbox{}

The numerical group ID number

\item[{\ttfamily member}] \mbox{}

List of group members

\end{description}


{\ttfamily /etc/gshadow} µµ¸ñÊ½ÈçÏÂ£º
\begin{tscreen}
\begin{verbatim}
groupname:password:admin,admin,...:member,member,...
\end{verbatim}
\end{tscreen}

ÆäÖÐ£º
\begin{description}
\item[{\ttfamily groupname}] \mbox{}

The name of the group

\item[{\ttfamily password}] \mbox{}

The encoded group password.

\item[{\ttfamily admin}] \mbox{}

List of group administrators 

\item[{\ttfamily member}] \mbox{}

List of group members

\end{description}


{\ttfamily gpasswd} Ö¸ÁîÊÇÓÃÔÚÐÂÔö»òÒÆ³ý¹ÜÀíÕßºÍÈº×é³ÉÔ±¡£ {\ttfamily root} »òÆäËûÔÚ
Èº×é¹ÜÀíÕßÈËÔ±¿ÉÐÂÔö»òÒÆ³ýÈº×é³ÉÔ±¡£

Èº×éÃÜÂë¿ÉÒÔÍ¸¹ý {\ttfamily passwd} Ö¸Áî¸Ä±ä£¬ÐèÍ¸¹ý 
{\itshape root\/} »òÔÚ¸ÃÈº×é¹ÜÀíÕßÓÐÈ¨ÏÞµÄÕÊºÅ·½¿ÉÐÞ¸Ä¡£

Despite the fact that there is not currently a manual page for
{\ttfamily gpasswd}, typing {\ttfamily gpasswd} without any parameters gives a
listing of options.  It's fairly easy to grasp how it all works once you
understand the file formats and the concepts.






\subsection{¼ì²é³ÌÊ½Ò»ÖÂÐÔ}






\subsubsection{pwck}

{\ttfamily pwck} ³ÌÊ½Ìá¹©ÔÚ {\ttfamily /etc/passwd} ºÍ {\ttfamily /etc/shadow} µµµÄÒ»ÖÂÐÔ¼ì²é¡£
Ëü½«¼ì²éÃ¿¸öÊ¹ÓÃÕßÃû³ÆÇÒÒÀÕÕÏÂÁÐ²½ÖèÈ·ÈÏ£º

\begin{itemize}
\item the correct number of fields
\item unique user name
\item valid user and group identifier
\item valid primary group
\item valid home directory
\item valid login shell
\end{itemize}


ËüÒ²»á¾¯¸æÃ»ÓÐÃÜÂëµÄÕÊºÅ¡£

ÔÚ°²×° {\itshape Shadow Suite\/} ááÖ´ÐÐ {\ttfamily pwck} ÊÇÒ»¸öºÜºÃµÄµã×Ó¡£
ËüÒ²¿ÉÒÔÃ¿ÖÜ»òÃ¿ÔÂÖÜÆÚÐÔµÄÖ´ÐÐ¡£ Èç¹ûÄãÊ¹ÓÃ {\ttfamily -r} ²ÎÊý£¬Äã¿ÉÒÔÓÃ {\ttfamily cron} 
À´Ö´ÐÐÇÒÊÕµ½µç×ÓÓÊ¼þ±¨¸æ




\subsubsection{grpck}

{\ttfamily grpck} ¼ì²é {\ttfamily /etc/group} ºÍ {\ttfamily /etc/gshadow} µµÒ»ÖÂÐÔµÄ³ÌÊ½¡£
Ëü×÷ÏÂÁÐ¼ì²é£º
\begin{itemize}
\item the correct number of fields
\item unique group name
\item valid list of members and administrators
\end{itemize}


ËüÒ²ÓÐ {\ttfamily -r} ²ÎÊý×Ô¶¯²úÉú±¨±í¡£




\subsection{Dial-up ÃÜÂë}

Dial-up ÃÜÂëÊÇÁíÒ»¸ö¶ÔÏµÍ³·ÀÓùµÄÑ¡ÏîÁÐ£¬¸ÃÏµÍ³ÔÊÐí²¦½Ó´æÈ¡¡£ 
Èç¹ûÄãÓÐÒ»¸öÏµÍ³ÔÊÐíÐí¶àÈËÇøÓòÍøÂ·Á¬½á£¬µ«ÊÇÄãÏëÏÞÖÆ²¦½ÓµÄÈ¨ÏÞ£¬ÄÇÄãÐèÊ¹ÓÃ dial-up
ÃÜÂë¡£ ÎªÁËÒª¿ªÆô dial-up ÃÜÂë£¬Äã±ØÐë±à¼­ {\ttfamily /etc/login.defs} µµÇÒÈ·¶¨½« 
{\ttfamily DIALUPS\_CHECK\_ENAB} Éè¶¨Îª {\ttfamily yes}.

ÓÐÁ½¸öµµ°¸°üÀ¨ dial-up ×ÊÑ¶£¬ {\ttfamily /etc/dialups} °üÀ¨ ttys 
(one per line, with the leading "/dev/" removed)¡£
Èç¹û tty ÓÐ±»ÁÐ³ö£¬ dial-up ±íÊ¾ÒÑ¾­±»¼ì²é¡£

µÚ¶þ¸öµµÊÇ {\ttfamily /etc/d\_passwd} ¡£  Õâ¸öµµ°üÀ¨ shell È«²¿ºÏ·¨Â·¾¶Ãû³Æ¡£

Èç¹ûÒÔ¸öÊ¹ÓÃÕßÇ©ÈëÒ»ÌõÁÐÔÚ {\ttfamily /etc/dialups} µÄÏß(line)£¬ÇÒËûµÄ shell ±»ÁÐÔÚ
{\ttfamily /etc/d\_passwd} µµ£¬Ëû½«±»ÔÊÐí´æÈ¡Í¸¹ýÌá¹©ÕýÈ·µÄÃÜÂë¡£

ÁíÒ»¸öÊ¹ÓÃ dial-up ÃÜÂëµÄÄ¿µÄÊÇÉè¶¨Ö¸ÔÊÐíÄ³Ð©ÐÎÊ½Á¬½áµÄÏß(¿ÉÄÜÊÇPPP »ò UUCP Á¬½á)¡£
Èç¹ûÒ»¸öÊ¹ÓÃÕßÊÔÖøµÃµ½ÁíÒ»ÖÖÐÎÊ½Á¬½á (i.e. a list of shells)£¬Ëû±ØÐëÖªµÀÊ¹ÓÃÕâÌõÏßµÄÃÜÂë¡£

ÔÚÄã¿ÉÒÔÔÚÎ´À´Ê¹ÓÃ dial-up Ç°£¬ÄãÃÜÐè½¨Á¢Ò»Ð©µµ°¸¡£

{\ttfamily dpasswd} Ö¸ÁîÌá¹©¶ÔÔÚ {\ttfamily /etc/d\_passwd} µµµÄ shells Ö¸ÅÉÃÜÂë¡£
¿ÉÒÔ¿´²Ù×÷ÊÖ²áµÄµ½¸ü¶à×ÊÑ¶¡£








\section{¼ÓÈë shadow Ö§Ô® C ÓïÑÔ\label{sec-adding}}

ÐÂÔöÖ§Ô® shadow ³ÌÊ½ÊÂÊµÉÏÊÇºÜÖ±½ÓµÄ¡£ Î¨Ò»µÄÎÊÌâÊÇ³ÌÊ½ÐèÒªÒÔ root (»ò SUID root)
È¨ÏÞÖ´ÐÐ£¬ÕâÑù²Å¿ÉÒÔ´æÈ¡ {\ttfamily /etc/shadow} µµ¡£

ÕâÏÔÊ¾Ò»¸ö´óÎÊÌâ£º µ±½¨Á¢ SUID ³ÌÊ½Ê±ÐèÒªºÜÐ¡ÐÄÒÀÕÕ³ÌÊ½ÔË×÷¡£¾ÙÀýËµÃ÷£º Èç¹ûÒÔ¸ö
³ÌÊ½ÓÐ shell escape£¬Èç¹û³ÌÊ½±¾ÉíÊÇ SUID root ½«²»ÐèÒªÒÔ root ·½Ê½³ÊÏÖ¡£

¶Ô³ÌÊ½ÐÂÔöÖ§Ô® shadow ¶øÑÔ£¬Ëü¿ÉÒÔ¼ì²éÃÜÂë£¬µ«²»ÐèÒÔ root È¨ÏÞÖ´ÐÐ£¬¶øÊÇÒÔ SUID 
shadow È¡´úÖ´ÐÐ±È½Ï°²È«¡£ {\ttfamily xlock} ³ÌÊ½¾ÍÊÇÒ»¸öÀý×Ó¡£

½ÓÏÂÀ´¡õÀý½éÉÜ£¬ {\ttfamily pppd-1.2.1d} ÒÑ¾­ÒÔ SUID as root ·½Ê½Ö´ÐÐ£¬ËùÒÔÐÂÔö shadow
Ö§Ô®Ó¦¸Ã²»»áÊ¹³ÌÊ½²úÉúÈÎºÎÓ°Ïì¡£ 






\subsection{±êÍ·µµ(Header files)}

±êÍ·µµÓ¦´æÔÚ {\ttfamily /usr/include/shadow}¡£ Ó¦¸ÃÓÐÒ»¸ö {\ttfamily /usr/include/shadow.h}µµ£¬
µ«ÊÇËü½« symbolic link µ½ {\ttfamily /usr/include/shadow/shadow.h}¡£

ÎªÁËÐÂÔöÖ§Ô® shadow ³ÌÊ½£¬ÄãÐèÒª include ±êÍ·µµ£º

\begin{verbatim}
#include <shadow/shadow.h>
#include <shadow/pwauth.h>
\end{verbatim}







\subsection{libshadow.a º¯Ê½¿â(library)}

µ±Äã°²×° {\itshape Shadow Suite\/}£¬ {\ttfamily libshadow.a} µµ±»½¨Á¢ºÍ°²×°ÔÚ
{\ttfamily /usr/lib} Ä¿Â¼¡£

µ±±àÒëÒ»¸ö shadow support ³ÌÊ½£¬linker ÐèÒª°üÀ¨ {\ttfamily libshadow.a} º¯Ê½¿â½øÈëÁ´½á¡£



Ö´ÐÐÈçÏÂ£º
\begin{tscreen}
\begin{verbatim}
gcc program.c -o program -lshadow
\end{verbatim}
\end{tscreen}


È»¶ø£¬¾ÍÏñÎÒÃÇ½ÓÏÂÀ´Òª¿´µÄÀý×Ó£¬´ó²¿·Ö´ó³ÌÊ½Ê¹ÓÃ {\ttfamily Makefile} ÇÒ
Í¨³£ÓÐ±äÊýºô½Ð {\ttfamily LIBS=...} ÐèÒª±»ÐÞ¸Ä¡£




\subsection{Shadow ½á¹¹(Structure)}

{\ttfamily libshadow.a} º¯Ê½¿â¶ÔËü´Ó {\ttfamily /etc/shadow} µµ½ÓÊÕ×ÊÑ¶Ê¹ÓÃ½á¹¹»¯ºô½Ð¡£
ÕâÊÇ´Ó {\ttfamily /usr/include/shadow/shadow.h} ±êÍ·µµµÄ {\ttfamily spwd} ½á¹¹¶¨Òå£º

\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
struct spwd
{
  char *sp_namp;                /* login name */
  char *sp_pwdp;                /* encrypted password */
  sptime sp_lstchg;             /* date of last change */
  sptime sp_min;                /* minimum number of days between changes */
  sptime sp_max;                /* maximum number of days between changes */
  sptime sp_warn;               /* number of days of warning before password
                                   expires */
  sptime sp_inact;              /* number of days after password expires
                                   until the account becomes unusable. */
  sptime sp_expire;             /* days since 1/1/70 until account expires
*/
  unsigned long sp_flag;        /* reserved for future use */
};
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}


{\itshape Shadow Suite\/} ¿ÉÒÔ·Å³ýÁË±àÂëÃÜÂëÖ®ÍâµÄ×ÊÁÏµ½ {\ttfamily sp\_pwdp} À¸Î»¡£
ÃÜÂëÀ¸Î»¿É°üÀ¨£º
\begin{tscreen}
\begin{verbatim}
username:Npge08pfz4wuk;@/sbin/extra:9479:0:10000::::
\end{verbatim}
\end{tscreen}


Õâ±íÊ¾Ò»¸ö¶îÍâµÄÃÜÂë£¬ {\ttfamily /sbin/extra} ³ÌÊ½Ó¦¸Ã±»¸ü¶àµÄÈ¨ÏÞºô½Ð¡£ 
³ÌÊ½µÄºô½ÐÐèÈ¡µÃÊ¹ÓÃÕßÃû³ÆºÍÖ¸³öÎªºÎÐè±»ºô½ÐµÄ switch²Å¿ÉÍ¨¹ý¡£ ²é¿´
{\ttfamily /usr/include/shadow/pwauth.h} ºÍÔ­Ê¼Âë {\ttfamily pwauth.c} »ñµÃ¸ü¶à×ÊÑ¶¡£

ÎªºÎÎÒÃÇÓ¦Ê¹ÓÃ {\ttfamily pwauth} È¥±íÊ¾ÕæÕýµÄÈ¨ÏÞ£¬ÕâÊÇÊ²÷áÒâË¼£¬Ëü½«Ê¹µÚ¶þ×éÈ¨ÏÞÒ²
ÅÜµÃºÜºÃ¡£

{\itshape Shadow Suite\/} ×÷ÕßÖ¸³öÒòÎª´ó²¿·Ö´æÔÚµÄ³ÌÊ½¶¼²»Õâ÷á×÷ÂÞ£¬ËùÒÔ
{\itshape Shadow Suite\/}Î´À´µÄ°æ±¾½«ÒÆ³ý¡£




\subsection{Shadow º¯Ê½(Functions)}

{\ttfamily shadow.h} °üº¬ {\ttfamily libshadow.a} º¯Ê½¿â£º
\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
extern void setspent __P ((void));
extern void endspent __P ((void));
extern struct spwd *sgetspent __P ((__const char *__string));
extern struct spwd *fgetspent __P ((FILE *__fp));
extern struct spwd *getspent __P ((void));
extern struct spwd *getspnam __P ((__const char *__name));
extern int putspent __P ((__const struct spwd *__sp, FILE *__fp));
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}


ÎÒÃÇ½«Ê¹ÓÃµÄ¡õÀý³ÌÊ½ÊÇ£º {\ttfamily getspnam} ½«¶Ô¹©Ó¦Ãû³Æ»Ö¸´¶ÔÎÒÃÇ {\ttfamily spwd} ½á¹¹¡£




\subsection{¡õÀý}

ÕâÊÇÒ»¸ö¡õÀýÃèÊöÐÂÔö shadow Ö§Ô®³ÌÊ½£¬µ«Ô¤ÉèÖµ²¢Ã»ÓÐ¡£



±¾¡õÀýÊ¹ÓÃ {\itshape Point-to-Point Protocol Server\/} (pppd-1.2.1d)£¬ËüÓÐ¸öÄ£Ê½ÊÇ±íÊ¾ 
´Ó {\ttfamily /etc/passwd} µµÈ¡´ú {\itshape PAP\/} »ò {\itshape CHAP\/} µµÊ¹ÓÃÕÊºÅÃÜÂëµÄ {\itshape PAP\/} 
È¨ÏÞ£¬Äã½«²»ÐèÒªÔÚ {\ttfamily pppd-2.2.0} ¼ÓÕâÐ©³ÌÊ½Âë£¬ÒòÎªËüÒÑ¾­´æÔÚÂÞ¡£





pppd µÄÎ´À´´óÖÂÉÏ²»»á±»Ê¹ÓÃºÜ¶à£¬µ«ÊÇÈç¹ûÄã°²×° {\itshape Shadow Suite\/}£¬´¢´æÔÚ
{\ttfamily /etc/passwd} µµµÄÃÜÂë½«ÎÞ·¨ÔË×÷¡£

ÔÚ {\ttfamily pppd-1.2.1d} È¨ÏÞÊ¹ÓÃµÄ³ÌÊ½ÂëÊÇÎ»ÔÚ {\ttfamily /usr/src/pppd-1.2.1d/pppd/auth.c} µµ¡£

½ÓÏÂÀ´³ÌÊ½ÂëÐèÒª±»¼ÓÔÚËùÓÐÆäËû {\ttfamily \#include} Ö¸Áîµµ°¸µÄ×îÉÏÍ·£¬ÎÒÃÇ½«×¢ÒâÓÐ»·¾³Ö¸ÁîµÄ
{\ttfamily \#includes}¡£

\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
#ifdef HAS_SHADOW
#include <shadow.h>
#include <shadow/pwauth.h>
#endif
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}
 

½ÓÏÂÀ´Òª×öµÄÊÂÇéÊÇ±ä¸üÊµ¼ÊÂë£¬ ÎÒÃÇ½«±ä¸ü {\ttfamily auth.c} µµ¡£

±ä¸üÇ° {\ttfamily auth.c} µµ function Îª£º
\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
/*
 * login - Check the user name and password against the system
 * password database, and login the user if OK.
 *
 * returns:
 *      UPAP_AUTHNAK: Login failed.
 *      UPAP_AUTHACK: Login succeeded.
 * In either case, msg points to an appropriate message.
 */
static int
login(user, passwd, msg, msglen)
    char *user;
    char *passwd;
    char **msg;
    int *msglen;
{
    struct passwd *pw;
    char *epasswd;
    char *tty;

    if ((pw = getpwnam(user)) == NULL) {
        return (UPAP_AUTHNAK);
    }
     /*
     * XXX If no passwd, let them login without one.
     */
    if (pw->pw_passwd == '\0') {
        return (UPAP_AUTHACK);
    }

    epasswd = crypt(passwd, pw->pw_passwd);
    if (strcmp(epasswd, pw->pw_passwd)) {
        return (UPAP_AUTHNAK);
    }

    syslog(LOG_INFO, "user %s logged in", user);

    /*
     * Write a wtmp entry for this user.
     */
    tty = strrchr(devname, '/');
    if (tty == NULL)
        tty = devname;
    else
        tty++;
    logwtmp(tty, user, "");             /* Add wtmp login entry */
    logged_in = TRUE;

    return (UPAP_AUTHACK);
}
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}


Ê¹ÓÃÕßµÄÃÜÂë±»·ÅÔÚ {\ttfamily pw-{$>$}pw\_passwd}£¬ËùÒÔÎÒÃÇÐèÐÂÔö {\ttfamily getspnam}
function£¬Õâ½«»á°ÑÃÜÂë·Åµ½ {\ttfamily spwd-{$>$}sp\_pwdp}¡£

ÎÒÃÇ½«ÐÂÔö {\ttfamily pwauth} function À´±íÊ¾ÕæÕýµÄÈ¨ÏÞ¡£ Õâ½«ÔÚ shadow µµÉè¶¨Ê±
×Ô¶¯²úÉúµÚ¶þ¸öÈ¨ÏÞ¡£

±ä¸üÎª¿ÉÒÔÖ§Ô® shadow ááµÄ {\ttfamily auth.c} function£º

\par
\addvspace{\medskipamount}
\nopagebreak\hrule
\begin{verbatim}
/*
 * login - Check the user name and password against the system
 * password database, and login the user if OK.
 *
 * This function has been modified to support the Linux Shadow Password
 * Suite if USE_SHADOW is defined.
 *
 * returns:
 *      UPAP_AUTHNAK: Login failed.
 *      UPAP_AUTHACK: Login succeeded.
 * In either case, msg points to an appropriate message.
 */
static int
login(user, passwd, msg, msglen)
    char *user;
    char *passwd;
    char **msg;
    int *msglen;
{
    struct passwd *pw;
    char *epasswd;
    char *tty;

#ifdef USE_SHADOW
    struct spwd *spwd;
    struct spwd *getspnam();
#endif

    if ((pw = getpwnam(user)) == NULL) {
        return (UPAP_AUTHNAK);
    }

#ifdef USE_SHADOW
        spwd = getspnam(user);
        if (spwd)
                pw->pw_passwd = spwd->sp-pwdp;
#endif
 
     /*
     * XXX If no passwd, let NOT them login without one.
     */
    if (pw->pw_passwd == '\0') {
        return (UPAP_AUTHNAK);
    }
#ifdef HAS_SHADOW
    if ((pw->pw_passwd && pw->pw_passwd[0] == '@'
         && pw_auth (pw->pw_passwd+1, pw->pw_name, PW_LOGIN, NULL))
        || !valid (passwd, pw)) {
        return (UPAP_AUTHNAK);
    }
#else
    epasswd = crypt(passwd, pw->pw_passwd);
    if (strcmp(epasswd, pw->pw_passwd)) {
        return (UPAP_AUTHNAK);
    }
#endif

    syslog(LOG_INFO, "user %s logged in", user);

    /*
     * Write a wtmp entry for this user.
     */
    tty = strrchr(devname, '/');
    if (tty == NULL)
        tty = devname;
    else
        tty++;
    logwtmp(tty, user, "");             /* Add wtmp login entry */
    logged_in = TRUE;

    return (UPAP_AUTHACK);
}
\end{verbatim} 
\nopagebreak\hrule 
\addvspace{\medskipamount}


ÑÏ½÷µÄ¡õÀý½«Æô·¢ÎÒÃÇÔÚ×÷ÆäËû¸Ä±äµÄ°ïÖú¡£ Ô­Ê¼µÄ°æ±¾Èç¹ûÔÚ {\ttfamily /etc/passwd} µµ
Ã»ÓÐÈÎºÎÃÜÂë£¬¿ÉÔÊÐí´æÈ¡´«»ØµÄ {\ttfamily UPAP\_AUTHACK} ¡£ÕâÊÇ{\itshape ²»\/}ºÃµÄ£¬ÒòÎª
Ç©ÈëµÄÊ¹ÓÃÊÇÊ¹ÓÃÒ»¸öÔÊÐí´æÈ¡ PPP processµÄÕÊºÅ£¬È»áá¼ì²éÕÊºÅÃÜÂë£¬¸ÃÕÊºÅÃÜÂëÊÇÓÉ
RAP ¡¢ÔÚ {\ttfamily /etc/passwd} µµµÄÕÊºÅºÍ {\ttfamily /etc/shadow} µµµÄÃÜÂë¹©Ó¦¡£



ËùÒÔÈç¹ûÎÒÃÇÉè¶¨Ô­±¾°æ±¾¶ÔÃ¿¸öÊ¹ÓÃÕß£¬Èç {\ttfamily ppp} ¿ÉÒÔÔÚ shell Ö´ÐÐ£¬È»ááÈÎºÎÈË¿ÉÒÔ
»ñµÃ ppp Á´½áÍ¸¹ýÉè¶¨ËûÃÇ¶ÔÊ¹ÓÃÕß {\ttfamily ppp} µÄ PAP ºÍ null µÄÃÜÂë¡£



ÎÒÃÇÐÞÕý {\ttfamily UPAP\_AUTHNAK} È¡´ú
{\ttfamily UPAP\_AUTHACK} Èç¹ûÃÜÂëÀ¸Î»ÊÇ¿ÕµÄ¡£

ÓÐÈ¤µÄÊÇ {\ttfamily pppd-2.2.0} ÓÐÏàÍ¬µÄÎÊÌâ¡£

½ÓÏÂÀ´ÎÒÃÇÐèÒª±ä¸ü Makefile ÒÔ±ãÈÃÁ½¼þÊÂ·¢Éú£º

{\ttfamily USE\_SHADOW} ±ØÐë±»ÖØÐÂ¶¨ÒåÇÒ{\ttfamily libshadow.a} ÐèÒª±»ÐÂÔöµ½Á´½á process¡£



±à¼­ Makefile ÇÒÐÂÔö£º
\begin{tscreen}
\begin{verbatim}
LIBS = -lshadow
\end{verbatim}
\end{tscreen}


È»ááÎÒÃÇÕÒµ½ÕâÒ»ÐÐ£º
\begin{tscreen}
\begin{verbatim}
COMPILE_FLAGS = -I.. -D_linux_=1 -DGIDSET_TYPE=gid_t
\end{verbatim}
\end{tscreen}


È»áá¸Ä±äËü±ä³É£º
\begin{tscreen}
\begin{verbatim}
COMPILE_FLAGS = -I.. -D_linux_=1 -DGIDSET_TYPE=gid_t -DUSE_SHADOW
\end{verbatim}
\end{tscreen}


ÏÖÔÚÖ´ÐÐ make ¸ú install.




\section{³£ÎÊÎÊÌâ¼°´ð°¸}

{\itshape Q:\/} ÎÒÓÃ tty's ÓÃ{\itshape root\/} È¨ÏÞÊ¹ÓÃ {\ttfamily /etc/securettys} µµ£¬µ«ÊÇ¶¼Ã»ÓÐ
ÈÎºÎÔË×÷£¬¸ÃÈçºÎ½â¾ö£¿

{\itshape A:\/} {\ttfamily /etc/securettys} µµÔÚ {\itshape Shadow Suite\/} °²×°áá¾Í²»¾ßÈÎºÎÒâÒåÂÞ¡£

tty's ÓÃ {\itshape root\/} È¨ÏÞ¿ÉÒÔÊ¹ÓÃÒ»¸ö·ÅÔÚ {\ttfamily /etc/login.defs} Ç©ÈëÉè¶¨µµ½øÐÐÐÞ¸Ä¡£
¸ÃÉè¶¨µµÒ²¿ÉÄÜÖ¸µ½ÁíÒ»¸öµµ¡£





{\itshape Q:\/} ÎÒ¶Ô {\itshape Shadow Suite\/} ½øÐÐ°²×°áá£¬ÏÖÔÚÎÒÃ»°ì·¨Ç©Èë(login)ÏµÍ³£¬
ÎÒÓÐºöÂÔÊ²÷á²½ÖèÂð£¿

{\itshape A:\/} ÄãÊÇÕæµÄ°²×° Shadow ³ÌÊ½ÂÞ£¬µ«ÊÇ²¢Î´Ö´ÐÐ {\ttfamily pwconv} »òÄãÍü¼Ç¸´ÖÆ
{\ttfamily /etc/npasswd} µ½ {\ttfamily /etc/passwd} ÇÒ¸´ÖÆ {\ttfamily /etc/nshadow} µ½ 
{\ttfamily /etc/shadow}ÂÞ¡£ ÄãÒ²ÐèÒª¸´ÖÆ {\ttfamily login.defs} µ½ {\ttfamily /etc}¡£



{\itshape Q:\/} ÔÚ xlock ÄÇÒ»ÕÂ½ÚÓÐÌáµ½¸Ä±ä {\ttfamily /etc/shadow} µµµÄÈº×éÓµÓÐÕßµ½
{\ttfamily shadow}¡£ÎÒÃ»ÓÐ {\ttfamily shadow} Èº×é£¬¸ÃÈçºÎ´¦Àí£¿

{\itshape A:\/} Äã¿ÉÒÔÐÂÔöÒ»¸ö¡£ ¼òµ¥µÄ±à¼­ {\ttfamily /etc/group} µµ£¬È»ááÐÂÔöÒ»ÐÐ¸ø
shadow Èº×é£¬ÄãÐèÒªÈ·ÈÏÈº×é±àºÅ²¢Î´±»ÆäËûÈº×éÊ¹ÓÃ£¬ÇÒÄãÐèÒªÔÚ {\ttfamily nogroup} 
¼ÍÂ¼Ö®Ç°²åÈë¸ÃÉè¶¨¡£ »òÕâÄã¿ÉÒÔ¼ò»¯¶Ô rootÈ¨ÏÞÉè¶¨ suid {\ttfamily xlock}¡£   



{\itshape Q:\/} ÓÐÈÎºÎ¶Ô Linux Shadow Password Suite µÄµç×ÓÓÊ¼þÁÐ±íÂð£¿

{\itshape A:\/} ÓÐ£¬µ«ÊÇËüµÄÄ¿µÄÊÇÕë¶Ô Linux ÏÂÒ»¸ö Shadow Suite°æ±¾·¢Õ¹¸ú²âÊÔ£¬Äã¿ÉÒÔ
µ½{\ttfamily shadow-list-request@neptune.cin.net} µç×ÓÓÊ¼þÕªÒªÊäÈë£º 
{\ttfamily subscribe}¡£  ÕâÊÇÔÚÌÖÂÛ Linux {\ttfamily shadow-YYMMSS}ÏµÁÐ°æ±¾¡£ÄãÓ¦¸Ã²Î¼ÓÈç¹ûÄã
Ïë²ÎÓèÎ´À´·¢Õ¹»òÄã°²×° Suite ÔÚÄãµÄµçÄÔÇÒÏëÒªµÃµ½ÐÂ°æ±¾µÄ×ÊÑ¶¡£



{\itshape Q:\/} ÎÒ°²×° {\itshape Shadow Suite\/}£¬µ«ÊÇµ±ÎÒÊ¹ÓÃ {\ttfamily userdel} ÃüÁîáá£¬
ÎÒµÃµ½ "userdel: cannot open shadow group file" Ñ¶Ï¢£¬ÎÒÓÐÄÄÀï×÷´íÁËÂð£¿



{\itshape A:\/} Äã±àÒë {\itshape Shadow Suite\/} Ê±ÓÐ¿ªÆô {\ttfamily SHADOWGRP} Ñ¡Ïî£¬µ«ÊÇ
ÄãÃ»ÓÐÒ»¸ö {\ttfamily /etc/gshadow} µµ°¸£¬ÄãÐèÒª±à¼­ {\ttfamily config.h} µµºÍÖØÐÂ±à
Òë»ò½¨Á¢Ò»¸ö {\ttfamily /etc/group} µµ£¬Çë¿´ shadow groups ÄÇÒ»½Ú¡£



{\itshape Q:\/} ÎÒ°²×° {\itshape Shadow Suite\/} µ«ÊÇÎÒÎÞ·¨ÕÒµ½±àÂëÃÜÂëÔÚÎÒµÄ
{\ttfamily /etc/passwd} µµ£¬·¢ÉúÊ²÷áÎÊÌâ£¿

{\itshape A:\/} Äã¿ÉÄÜÔÚ Shadow {\ttfamily config.h} µµ¿ªÆô {\ttfamily AUTOSHADOW} Ñ¡Ïî»òÕß
ÄãµÄ {\ttfamily libc} ±» {\ttfamily SAHDOW\_COMPAT} Ñ¡Ïî±àÒë£¬ÄãÐèÒª¾ö¶¨ÊÇÄÄ¸öÎÊÌâ£¬È»áá
ÔÙÖØÐÂ±àÒë¡£




\section{°æÈ¨ÉùÃ÷(ÔÝ²»·­Òë)}

The Linux Shadow Password HOWTO is Copyright (c) 1996 Michael H. Jackson.

Permission is granted to make and distribute verbatim copies of
this document provided the copyright notice and this permission notice
are preserved on all copies.

Permission is granted to copy and distribute modified versions of this
document under the conditions for verbatim copies above, provided a notice
clearly stating that the document is a modified version is also included in
the modified document.

Permission is granted to copy and distribute translations of this document
into another language, under the conditions specified above for modified
versions.

Permission is granted to convert this document into another media under
the conditions specified above for modified versions provided the requirement
to acknowledge the source document is fulfilled by inclusion of an obvious
reference to the source document in the new media. Where there is any
doubt as to what defines 'obvious' the copyright owner reserves the right
to decide.




\section{Miscellaneous and Acknowledgments.}

The code examples for {\ttfamily auth.c} are taken from pppd-1.2.1d and
ppp-2.1.0e, Copyright (c) 1993 and The Australian National University and
Copyright (c) 1989 Carnegie Mellon University.

Thanks to Marek Michalkiewicz $<$marekm@i17linuxb.ists.pwr.wroc.pl{$>$} for
writing and maintaining the {\itshape Shadow Suite\/} for Linux, and for his
review and comments on this document.

Thanks to Ron Tidd $<$rtidd@tscnet.com{$>$} for his helpful review and testing.

Thanks to everyone who has sent me feedback to help improve this document.

Please, if you have any comments or suggestions then mail them to me.

regards

\onlynameurl{Michael H. Jackson $<$mhjack@tscnet.com{$>$}}



\end{document}
