# # /etc/login.defs - Configuration control definitions for the shadow package. # Some variables are used by login(1), su(1) and runuser(1) from util-linux # package as well pam pam_unix(8) from pam package. # # For more, see login.defs(5). Please note that SUSE supports only variables # listed here! Not listed variables from login.defs(5) have no effect. # # # Delay in seconds before being allowed another attempt after a login failure # Note: When PAM is used, some modules may enforce a minimum delay (e.g. # pam_unix(8) enforces a 2s delay) # FAIL_DELAY 3 # # Enable display of unknown usernames when login(1) failures are recorded. # LOG_UNKFAIL_ENAB no # # Enable "syslog" logging of newgrp(1) and sg(1) activity. # # # Limit the highest user ID number for which the lastlog entries should # be updated. # # No LASTLOG_UID_MAX means that there is no user ID limit for writing # lastlog entries. # #LASTLOG_UID_MAX # # Enable "syslog" logging of newgrp(1) and sg(1) activity - in addition # to sulog file logging. # SYSLOG_SG_ENAB yes # # If defined, either full pathname of a file containing device names or # a ":" delimited list of device names. Root logins will be allowed only # from these devices. # CONSOLE /etc/securetty #CONSOLE console:tty01:tty02:tty03:tty04 # # If defined, all su(1) activity is logged to this file. # #SULOG_FILE /var/log/sulog # # If defined, ":" delimited list of "message of the day" files to # be displayed upon login. # MOTD_FILE "" #MOTD_FILE /etc/motd:/usr/share/misc/motd # # If set to "yes", login stops display content specified by MOTD_FILE after # the first accessible item in the list. # #MOTD_FIRSTONLY no # # If defined, file which maps tty line to TERM environment parameter. # Each line of the file is in a format similar to "vt100 tty01". # #TTYTYPE_FILE /etc/ttytype # # If defined, file which inhibits all the usual chatter during the login # sequence. If a full pathname, then hushed mode will be enabled if the # user's name or shell are found in the file. If not a full pathname, then # hushed mode will be enabled if the file exists in the user's home directory. # #HUSHLOGIN_FILE .hushlogin HUSHLOGIN_FILE /etc/hushlogins # If this variable is set to "yes", hostname will be suppressed in the # login: prompt. #LOGIN_PLAIN_PROMPT no # # *REQUIRED* The default PATH settings, for superuser and normal users. # # (they are minimal, add the rest in the shell startup files) # # ENV_PATH: The default PATH settings for non-root. # # ENV_ROOTPATH: The default PATH settings for root # (used by login, su and runuser). # # ENV_SUPATH is an ENV_ROOTPATH override for su and runuser # (and falback for login). # ENV_PATH /usr/local/bin:/bin:/usr/bin ENV_ROOTPATH /usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin #ENV_SUPATH /usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin # If this variable is set to "yes" (default is "no"), su will always set # path. every su call will overwrite the PATH variable. # # Per default, only "su -" will set a new PATH. # # The recommended value is "yes". The default "no" behavior could have # a security implication in applications that use commands without path. # ALWAYS_SET_PATH yes # # Terminal permissions # # TTYGROUP Login tty will be assigned this group ownership. # TTYPERM Login tty will be set to this permission. # # If you have a write(1) program which is "setgid" to a special group # which owns the terminals, define TTYGROUP as the number of such group # and TTYPERM as 0620. Otherwise leave TTYGROUP commented out and # set TTYPERM to either 622 or 600. # TTYGROUP tty TTYPERM 0620 # Default initial "umask" value used by login(1) on non-PAM enabled systems. # Default "umask" value for pam_umask(8) on PAM enabled systems. # UMASK is also used by useradd(8) and newusers(8) to set the mode for new # home directories if HOME_MODE is not set. # 022 is the default value, but 027, or even 077, could be considered # for increased privacy. There is no One True Answer here: each sysadmin # must make up their mind. UMASK 022 # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new # home directories. # If HOME_MODE is not set, the value of UMASK is used to create the mode. HOME_MODE 0700 # # Password aging controls: # # PASS_MAX_DAYS Maximum number of days a password may be used. # PASS_MIN_DAYS Minimum number of days allowed between password changes. # PASS_WARN_AGE Number of days warning given before a password expires. # PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 PASS_WARN_AGE 7 # # Min/max values for automatic uid selection in useradd(8) # # SYS_UID_MIN to SYS_UID_MAX inclusive is the range for # UIDs for dynamically allocated administrative and system accounts. # UID_MIN to UID_MAX inclusive is the range of UIDs of dynamically # allocated user accounts. # UID_MIN 2000 UID_MAX 60000 # System accounts SYS_UID_MIN 100 SYS_UID_MAX 499 # Extra per user uids SUB_UID_MIN 100000 SUB_UID_MAX 600100000 SUB_UID_COUNT 65536 # # Min/max values for automatic gid selection in groupadd(8) # # SYS_GID_MIN to SYS_GID_MAX inclusive is the range for # GIDs for dynamically allocated administrative and system groups. # GID_MIN to GID_MAX inclusive is the range of GIDs of dynamically # allocated groups. # GID_MIN 1000 GID_MAX 60000 # System accounts SYS_GID_MIN 100 SYS_GID_MAX 499 # Extra per user group ids SUB_GID_MIN 100000 SUB_GID_MAX 600100000 SUB_GID_COUNT 65536 # # Max number of login(1) retries if password is bad # LOGIN_RETRIES 3 # # Tell login to only re-prompt for the password if authentication # failed, but the username is valid. The default value is no. # LOGIN_KEEP_USERNAME no # # Max time in seconds for login(1) # LOGIN_TIMEOUT 60 # # Which fields may be changed by regular users using chfn(1) - use # any combination of letters "frwh" (full name, room number, work # phone, home phone). If not defined, no changes are allowed. # For backward compatibility, "yes" = "rwh" and "no" = "frwh". # CHFN_RESTRICT rwh # # This variable is deprecated. Use ENCRYPT_METHOD instead! # #MD5_CRYPT_ENAB DO_NOT_USE # # If set to MD5, MD5-based algorithm will be used for encrypting password # If set to SHA256, SHA256-based algorithm will be used for encrypting password # If set to SHA512, SHA512-based algorithm will be used for encrypting password # If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password # If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password # If set to DES, DES-based algorithm will be used for encrypting password (default) # MD5 and DES should not be used for new hashes, see crypt(5) for recommendations. # Overrides the MD5_CRYPT_ENAB option # # Note: If you use PAM, it is recommended to use a value consistent with # the PAM modules configuration. # ENCRYPT_METHOD SHA512 # # Only works if ENCRYPT_METHOD is set to SHA256 or SHA512. # # Define the number of SHA rounds. # With a lot of rounds, it is more difficult to brute-force the password. # However, more CPU resources will be needed to authenticate users if # this value is increased. # # If not specified, the libc will choose the default number of rounds (5000), # which is orders of magnitude too low for modern hardware. # The values must be within the 1000-999999999 range. # If only one of the MIN or MAX values is set, then this value will be used. # If MIN > MAX, the highest value will be used. # #SHA_CRYPT_MIN_ROUNDS 5000 #SHA_CRYPT_MAX_ROUNDS 5000 # # Should login be allowed if we can't cd to the home directory? # Default is no. # DEFAULT_HOME yes # # The pwck(8) utility emits a warning for any system account with a home # directory that does not exist. Some system accounts intentionally do # not have a home directory. Such accounts may have this string as # their home directory in /etc/passwd to avoid a spurious warning. # NONEXISTENT /nonexistent # # If defined, this command is run when removing a user. # It should remove any at/cron/print jobs etc. owned by # the user to be removed (passed as the first argument). # #USERDEL_CMD /usr/sbin/userdel_local # # Enable setting of the umask group bits to be the same as owner bits # (examples: 022 -> 002, 077 -> 007) for non-root users, if the uid is # the same as gid, and username is the same as the primary group name. # # This also enables userdel(8) to remove user groups if no members exist. # USERGROUPS_ENAB yes # # If set to a non-zero number, the shadow utilities will make sure that # groups never have more than this number of users on one line. # This permits to support split groups (groups split into multiple lines, # with the same group ID, to avoid limitation of the line length in the # group file). # # 0 is the default value and disables this feature. # #MAX_MEMBERS_PER_GROUP 0 # # If useradd(8) should create home directories for users by default (non # system users only). # This option is overridden with the -M or -m flags on the useradd(8) # command-line. # CREATE_HOME yes # # Force use shadow, even if shadow passwd & shadow group files are # missing. # #FORCE_SHADOW yes # # Allow newuidmap and newgidmap when running under an alternative # primary group. # #GRANT_AUX_GROUP_SUBIDS yes # # Select the HMAC cryptography algorithm. # Used in pam_timestamp module to calculate the keyed-hash message # authentication code. # # Note: It is recommended to check hmac(3) to see the possible algorithms # that are available in your system. # #HMAC_CRYPTO_ALGO SHA512