The /etc/login.defs file defines the site-specific configuration for the shadow password suite. This file is required. Absence of this file will not prevent system operation, but will probably result in undesirable operation.
This file is a readable text file, each line of the file describing one configuration parameter. The lines consist of a configuration name and value, separated by whitespace. Blank lines and comment lines are ignored. Comments are introduced with a "#" pound sign and the pound sign must be the first non-white character of the line.
Parameter values may be of four types: strings, booleans, numbers, and long numbers. A string is comprised of any printable characters. A boolean should be either the value yes or no. An undefined boolean parameter or one with a value other than these will be given a no value. Numbers (both regular and long) may be either decimal values, octal values (precede the value with 0) or hexadecimal values (precede the value with 0x). The maximum value of the regular and long numeric parameters is machine-dependent.
The following configuration items are provided:
CHFN_AUTH (boolean)
CHFN_RESTRICT (string)
CHSH_AUTH (boolean)
CONSOLE (string)
If not defined, root will be allowed on any device.
The device should be specified without the /dev/ prefix.
CONSOLE_GROUPS (string)
Use with caution - it is possible for users to gain permanent access to these groups, even when not logged in on the console.
CREATE_HOME (boolean)
This setting does not apply to system users, and can be overriden on the command line.
DEFAULT_HOME (boolean)
If set to yes, the user will login in the root (/) directory if it is not possible to cd to her home directory.
ENCRYPT_METHOD (string)
It can take one of these values:
Note: this parameter overrides the MD5_CRYPT_ENAB variable.
ENV_HZ (string)
ENV_PATH (string)
ENV_SUPATH (string)
ENV_TZ (string)
If a full path is specified but the file does not exist or cannot be read, the default is to use TZ=CST6CDT.
ENVIRON_FILE (string)
Lines starting with a # are treated as comment lines and ignored.
ERASECHAR (number)
The value can be prefixed "0" for an octal value, or "0x" for an hexadecimal value.
FAIL_DELAY (number)
FAILLOG_ENAB (boolean)
FAKE_SHELL (string)
FTMP_FILE (string)
GID_MAX (number), GID_MIN (number)
HUSHLOGIN_FILE (string)
ISSUE_FILE (string)
KILLCHAR (number)
The value can be prefixed "0" for an octal value, or "0x" for an hexadecimal value.
LASTLOG_ENAB (boolean)
LOG_OK_LOGINS (boolean)
LOG_UNKFAIL_ENAB (boolean)
Note: logging unknown usernames may be a security issue if an user enter her password instead of her login name.
LOGIN_RETRIES (number)
LOGIN_STRING (string)
If the string contains %s, this will be replaced by the user's name.
LOGIN_TIMEOUT (number)
MAIL_CHECK_ENAB (boolean)
You should disable it if the shell startup files already check for mail ("mailx -e" or equivalent).
MAIL_DIR (string)
MAIL_FILE (string)
The MAIL_DIR and MAIL_FILE variables are used by useradd, usermod, and userdel to create, move, or delete the user's mail spool.
If MAIL_CHECK_ENAB is set to yes, they are also used to define the MAIL environment variable.
MAX_MEMBERS_PER_GROUP (number)
The default value is 0, meaning that there are no limits in the number of members in a group.
This feature (split group) permits to limit the length of lines in the group file. This is useful to make sure that lines for NIS groups are not larger than 1024 characters.
If you need to enforce such limit, you can use 25.
Note: split groups may not be supported by all tools (even in the Shadow toolsuite). You should not use this variable unless you really need it.
MD5_CRYPT_ENAB (boolean)
This variable is superceded by the ENCRYPT_METHOD variable or by any command line option used to configure the encryption algorithm.
This variable is deprecated. You should use ENCRYPT_METHOD.
MOTD_FILE (string)
NOLOGINS_FILE (string)
OBSCURE_CHECKS_ENAB (boolean)
PASS_ALWAYS_WARN (boolean)
PASS_CHANGE_TRIES (number)
PASS_MAX_DAYS (number)
PASS_MIN_DAYS (number)
PASS_WARN_AGE (number)
PASS_MAX_DAYS, PASS_MIN_DAYS and PASS_WARN_AGE are only used at the time of account creation. Any changes to these settings won't affect existing accounts.
PASS_MAX_LEN (number), PASS_MIN_LEN (number)
PORTTIME_CHECKS_ENAB (boolean)
QUOTAS_ENAB (boolean)
SHA_CRYPT_MIN_ROUNDS (number), SHA_CRYPT_MAX_ROUNDS (number)
With a lot of rounds, it is more difficult to brute forcing the password. But note also that more CPU resources will be needed to authenticate users.
If not specified, the libc will choose the default number of rounds (5000).
The values must be inside the 1000-999999999 range.
If only one of the SHA_CRYPT_MIN_ROUNDS or SHA_CRYPT_MAX_ROUNDS values is set, then this value will be used.
If SHA_CRYPT_MIN_ROUNDS > SHA_CRYPT_MAX_ROUNDS, the highest value will be used.
SULOG_FILE (string)
SU_NAME (string)
SU_WHEEL_ONLY (boolean)
SYS_GID_MAX (number), SYS_GID_MIN (number)
SYS_UID_MAX (number), SYS_UID_MIN (number)
SYSLOG_SG_ENAB (boolean)
SYSLOG_SU_ENAB (boolean)
TTYGROUP (string), TTYPERM (string)
By default, the ownership of the terminal is set to the user's primary group and the permissions are set to 0600.
TTYGROUP can be either the name of a group or a numeric group identifier.
If you have a write program which is "setgid" to a special group which owns the terminals, define TTYGROUP to the group number and TTYPERM to 0620. Otherwise leave TTYGROUP commented out and assign TTYPERM to either 622 or 600.
TTYTYPE_FILE (string)
UID_MAX (number), UID_MIN (number)
ULIMIT (number)
UMASK (number)
useradd and newusers use this mask to set the mode of the home directory they create
It is also used by login to define users' initial umask. Note that this mask can be overriden by the user's GECOS line (if QUOTAS_ENAB is set) or by the specification of a limit with the K identifier in limits(5).
USERDEL_CMD (string)
The return code of the script is not taken into account.
Here is an example script, which removes the user's cron, at and print jobs:
#! /bin/sh # Check for the required argument. if [ $# != 1 ]; then echo "Usage: $0 username" exit 1 fi # Remove cron jobs. crontab -r -u $1 # Remove at jobs. # Note that it will remove any jobs owned by the same UID, # even if it was shared by a different username. AT_SPOOL_DIR=/var/spool/cron/atjobs find $AT_SPOOL_DIR -name "[^.]*" -type f -user $1 -delete \; # Remove print jobs. lprm $1 # All done. exit 0
USERGROUPS_ENAB (boolean)
If set to yes, userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user.
The following cross references show which programs in the shadow password suite use which parameters.
chfn
CHFN_AUTH CHFN_RESTRICT LOGIN_STRING
chgpasswd
chpasswd
chsh
gpasswd
groupadd
groupdel
groupmems
groupmod
grpck
grpconv
grpunconv
login
CONSOLE CONSOLE_GROUPS DEFAULT_HOME ENV_HZ ENV_PATH ENV_SUPATH ENV_TZ ENVIRON_FILE ERASECHAR FAIL_DELAY FAILLOG_ENAB FAKE_SHELL FTMP_FILE HUSHLOGIN_FILE ISSUE_FILE KILLCHAR LASTLOG_ENAB LOGIN_RETRIES LOGIN_STRING LOGIN_TIMEOUT LOG_OK_LOGINS LOG_UNKFAIL_ENAB MAIL_CHECK_ENAB MAIL_DIR MAIL_FILE MOTD_FILE NOLOGINS_FILE PORTTIME_CHECKS_ENAB QUOTAS_ENAB TTYGROUP TTYPERM TTYTYPE_FILE ULIMIT UMASK USERGROUPS_ENAB
newgrp / sg
newusers
passwd
pwck
pwconv
su
CONSOLE CONSOLE_GROUPS DEFAULT_HOME ENV_HZ ENVIRON_FILE ENV_PATH ENV_SUPATH ENV_TZ LOGIN_STRING MAIL_CHECK_ENAB MAIL_DIR MAIL_FILE QUOTAS_ENAB SULOG_FILE SU_NAME SU_WHEEL_ONLY SYSLOG_SU_ENAB USERGROUPS_ENAB
sulogin
useradd
userdel
usermod
login(1), passwd(1), su(1), passwd(5), shadow(5), pam(8).