is known in UNIX circles as the epoch. Just so you know, the billionth second since the epoch occurred was in September 2001; that was the UNIX version of Y2K — not much happened because of it.
> The number of days before the password can be changed (prevents changing a password and then changing it back to the old password right away — a dangerous security practice).
> The number of days after which the password must be changed. This can be set to force the change of a newly issued password known to the system administrator.
> The number of days before password expiration that the user is warned it will expire.
> The number of days after the password expires that the account is disabled (for security).
> The number of days since January 1, 1970 that the account has been disabled.
> The final field is a 'reserved' field and is not currently allocated for any use.
Note that password expiration dates and warnings are disabled by default in Fedora. These features are not used on home systems and usually not used for small offices. It is the sysadmin's responsibility to establish and enforce password expiration policies.
The permissions on the /etc/shadow file should be set so that it is not writable or read able by regular users: The permissions should be 600.
The configuration files in Fedora are found in /etc/pam.d. These files are named for the service they control, and the format is as follows:
type control module-path module-arguments
The type field is the management group to which the rule corresponds. The control field tells PAM what to do if authentication fails. The final two items deal with the PAM module used and any arguments it needs. Programs that use PAM typically come pack aged with appropriate entries for the /etc/pam.d directory. To achieve greater security, the system administrator can modify the default entries. Misconfiguration can have unpredictable results, so back up the configuration files before you modify them. The defaults provided by Fedora are adequate for home and small office users.
An example of a PAM configuration file with the formatted entries as described previously is shown next. Here are the contents of /etc/pam.d/system-config-users:
#%PAM-1.0
auth include config-util
account include config-util
session include config-util
Amusingly, even the PAM documents state that you do not really need (or want) to know a lot about PAM to use it effectively.
You will likely need only the PAM system administrator's guide. Look under the /usr/share/doc/pam* directory for additional documents in PostScript, text, and HTML formats.
Managing Password Security for Users
Selecting appropriate user passwords is always an exercise in trade-offs. A password such as password (don't laugh, it has been used too often before in the real world) is just too easy to guess by an intruder, as are simple words or number combinations (a street address, for example). A security auditor for one of my former employers used to take the cover sheet from an employee's personnel file (which contained the usual personal information of name, address, birth date, and so on) and then attempt to log on to a terminal with passwords constructed from that information—and often succeeded in logging on.
On the other hand, a password such as 2a56u''F($84u&#*Hiu44Ik%$([#EJD is sure to present great difficulty to an intruder (or an auditor). However, that password is so difficult to remember that it would be likely that the password owner would write that password down and tape it next to her keyboard. I worked for a business in which the safe combination was written on the ceiling tile over the safe; the manager could not remember it and was told he should not keep it on a piece of paper in his wallet. This is but one of many examples of poor security in the field.
The sysadmin has control, with settings in the /etc/shadow file, over how often the pass word must be changed. The settings can be changed with a text editor, the change command, or a configuration tool such as Fedora's User Manager, as shown in Figure 10.1. Click the Password Info tab under that particular user's Properties to set individual password policies.
Changing Passwords in a Batch
On a large system, there might be times when a large number of users and their pass words need some attention. The super user can change passwords in a batch by using the chpasswd command, which accepts input as a name/password pair per line in the following form:
# chpasswd
You can change passwords
However, Fedora also provides the newusers command to add users in a batch from a text file. This command also allows a user to be added to a group, and a new directory can be added for the user, too.
Granting System Administrator Privileges to Regular Users
It may be necessary for regular users to run a command as if they were the root user. They usually do not need these powers, but they might on occasion — for example, to temporarily access certain devices or run a command for testing purposes.
There are two ways to run commands with root privileges: The first is useful if you are the super user and the user; the second if you are not the regular user (as on a large, multiuser network).
Temporarily Changing User Identity with the su Command
What if you are also root, but are logged on as a regular user because you are performing
