pkgname: shadow
pkgver: '4.20.2'
pkgrel: '3'
pkgdesc: The Shadow package contains programs for handling passwords in a secure way.
url: 'https://shadow-maint.github.io/shadow/'
arch: x86_64
depends:
- pam
- libxcrypt
- libpwquality
makedepends:
- autoconf
- automake
- libtool
- m4
- libxcrypt
- pam
source:
- useradd
- Makefile.patch
- 'https://github.com/shadow-maint/shadow/releases/download/${pkgver}/shadow-${pkgver}.tar.xz'
sha256sums:
- 9c45c0d0f15244cf7d8962d53ba571b059eb09bce6c094b43d42b804fa39d0df
- 4cb247416e32cce0fabf7926bb9cafb8137f838358f6559997962764c8ed3cfb
- b89f432b75ae55a2d852b446d0365484795fdf533ab97d550e325fa15594a224
build: "cd shadow-${pkgver}\npatch -Np1 -i ../Makefile.patch\nautoreconf -fiv\n\nsed -i 's/groups$(EXEEXT) //' src/Makefile.in\nfind man -name Makefile.in -exec sed -i 's/groups\\.1 / /'   {} \\;\nfind man -name Makefile.in -exec sed -i 's/getspnam\\.3 / /' {} \\;\nfind man -name Makefile.in -exec sed -i 's/passwd\\.5 / /'   {} \\;\n\nsed -i -e 's@^#ENCRYPT_METHOD .*@ENCRYPT_METHOD SHA512@' \\\n       -e 's@#\\(SHA_CRYPT_..._ROUNDS 5000\\)@\\100@'       \\\n       -e 's@/var/spool/mail@/var/mail@' -i etc/login.defs\n\n./configure          \\\n --sysconfdir=/etc   \\\n --bindir=/usr/bin   \\\n --sbindir=/usr/bin \\\n --libdir=/usr/lib   \\\n --with-{b,yes}crypt \\\n --without-libbsd    \\\n --disable-logind    \\\n --with-group-name-max-length=32\n\nmake\n\nmake DESTDIR=${PKGDIR} install\n\ninstall -Dm 600 ../useradd ${PKGDIR}/etc/default/useradd\n\n#\n# Configuration files for pam\ninstall -v -m755 -d  ${PKGDIR}/etc/pam.d\ncat > ${PKGDIR}/etc/pam.d/system-login << \"EOF\"\n# Begin /etc/pam.d/system-login\n\n# Set failure delay before next prompt to 3 seconds\nauth      optional    pam_faildelay.so  delay=3000000\n\n# Check to make sure that the user is allowed to login\nauth      requisite   pam_nologin.so\n\n# Check to make sure that root is allowed to login \n# Disabled by default. You will need to create /etc/securetty\n# file for this module to function. See man 5 securetty.\n#auth      required    pam_securetty.so\n\n# Additional group memberships - disabled by default\n#auth      optional    pam_group.so\n\n# include the default auth settings\nauth      include     system-auth\n\n# check access for the user\naccount   required    pam_access.so\n\n# include the default account settings\naccount   include     system-account\n\n# Set default environment variables for the user\nsession   required    pam_env.so\n\n# Set resource limits for the user\nsession   required    pam_limits.so\n\n# Display date of last login - Disabled by default\n#session   optional    pam_lastlog.so\n\n# Display the message of the day - Disabled by default\n#session   optional    pam_motd.so\n\n# Check user's mail - Disabled by default\n#session   optional    pam_mail.so      standard quiet\n\n# include the default session and password settings\nsession   include     system-session\npassword  include     system-password\n\n# End /etc/pam.d/system-login\n\nEOF\ncat > ${PKGDIR}/etc/pam.d/system-account << \"EOF\"\n# Begin /etc/pam.d/system-account\n\naccount   required    pam_unix.so\naccount   required    pam_faillock.so\n\n# End /etc/pam.d/system-account\nEOF\n\ncat > ${PKGDIR}/etc/pam.d/system-auth << \"EOF\"\n# Begin /etc/pam.d/system-auth\n\n# Blokada konta po nieudanych probach logowania. Parametry (deny,\n# unlock_time) ustawia /etc/security/faillock.conf; root nie jest objety.\nauth      required      pam_faillock.so preauth\nauth      [success=1 default=ignore]  pam_unix.so\nauth      [default=die] pam_faillock.so authfail\nauth      sufficient    pam_faillock.so authsucc\n\n# End /etc/pam.d/system-auth\nEOF\n\ncat > ${PKGDIR}/etc/pam.d/system-password << \"EOF\"\n# Begin /etc/pam.d/system-password\n\n# use sha512 hash for encryption, use shadow, and try to use any previously\n# defined authentication token (chosen password) set by any prior module\n# Jakosc hasel - parametry w /etc/security/pwquality.conf.\n# Pamiec: ostatnie 24 hasla.\npassword  required    pam_pwquality.so  retry=3\npassword  required    pam_pwhistory.so  remember=24 retry=3\npassword  required    pam_unix.so       sha512 shadow try_first_pass\n\n# End /etc/pam.d/system-password\nEOF\n\ncat > ${PKGDIR}/etc/pam.d/system-session << \"EOF\"\n# Begin /etc/pam.d/system-session\n\nsession   required    pam_unix.so\nsession   required    pam_loginuid.so\nsession   optional    pam_systemd.so\n# End /etc/pam.d/system-session\nEOF\n\ncat > ${PKGDIR}/etc/pam.d/login << \"EOF\"\n# Begin /etc/pam.d/login\n\n# Set failure delay before next prompt to 3 seconds\nauth      optional    pam_faildelay.so  delay=3000000\n\n# Check to make sure that the user is allowed to login\nauth      requisite   pam_nologin.so\n\n# Check to make sure that root is allowed to login \n# Disabled by default. You will need to create /etc/securetty\n# file for this module to function. See man 5 securetty.\n#auth      required    pam_securetty.so\n\n# Additional group memberships - disabled by default\n#auth      optional    pam_group.so\n\n# include the default auth settings\nauth      include     system-auth\n\n# check access for the user\naccount   required    pam_access.so\n\n# include the default account settings\naccount   include     system-account\n\n# Set default environment variables for the user\nsession   required    pam_env.so\n\n# Set resource limits for the user\nsession   required    pam_limits.so\n\n# Display date of last login - Disabled by default\n#session   optional    pam_lastlog.so\n\n# Display the message of the day - Disabled by default\n#session   optional    pam_motd.so\n\n# Check user's mail - Disabled by default\n#session   optional    pam_mail.so      standard quiet\n\n# include the default session and password settings\nsession   include     system-session\npassword  include     system-password\n\n# End /etc/pam.d/login\nEOF\n\ncat > ${PKGDIR}/etc/pam.d/passwd << \"EOF\"\n# Begin /etc/pam.d/passwd\n\npassword  include     system-password\n\n# End /etc/pam.d/passwd\nEOF\n\ncat > ${PKGDIR}/etc/pam.d/su << \"EOF\"\n# Begin /etc/pam.d/su\n\n# always allow root\nauth      sufficient  pam_rootok.so\nauth      include     system-auth\n\n# include the default account settings\naccount   include     system-account\n\n# Set default environment variables for the service user\nsession   required    pam_env.so\n\n# include system session defaults\nsession   include     system-session\n\n# End /etc/pam.d/su\nEOF\n\ncat > ${PKGDIR}/etc/pam.d/chage << \"EOF\"\n#Begin /etc/pam.d/chage\n\n# always allow root\nauth      sufficient  pam_rootok.so\n\n# include system defaults for auth account and session\nauth      include     system-auth\naccount   include     system-account\nsession   include     system-session\n\n# Always permit for authentication updates\npassword  required    pam_permit.so\n\n# End /etc/pam.d/chage\nEOF\n\nfor PROGRAM in chfn chgpasswd chpasswd chsh groupadd groupdel \\\n               groupmems groupmod newusers useradd userdel usermod\ndo\n    install -v -m644 ${PKGDIR}/etc/pam.d/chage ${PKGDIR}/etc/pam.d/${PROGRAM}\n    sed -i \"s/chage/$PROGRAM/\" ${PKGDIR}/etc/pam.d/${PROGRAM}\ndone\n\n# Backup others\n[ -f ${PKGDIR}/pam.d/other ] && install -v -m644 ${PKGDIR}/etc/pam.d/other{,.orig}\n\n# Other \n#\ncat > ${PKGDIR}/etc/pam.d/other << \"EOF\"\n# Begin /etc/pam.d/other\n\nauth        required        pam_warn.so\nauth        required        pam_deny.so\naccount     required        pam_warn.so\naccount     required        pam_deny.so\npassword    required        pam_warn.so\npassword    required        pam_deny.so\nsession     required        pam_warn.so\nsession     required        pam_deny.so\n\n# End /etc/pam.d/other\nEOF\ninstall -v -m755 -d ${PKGDIR}/etc/security\ncat > ${PKGDIR}/etc/security/faillock.conf << \"EOF\"\n# Blokada konta po nieudanych probach logowania (pam_faillock,\n# uzywany przez /etc/pam.d/system-auth i system-account).\ndeny = 5\nfail_interval = 900\nunlock_time = 900\n# even_deny_root nie jest ustawione - root nie zostaje zablokowany.\nEOF\n\n# Pliki system-* ZOSTAJA w pakiecie - wczesniej byly usuwane i pozostawaly\n# niezarzadzane, przez co zmiany w PAM nie docieraly do systemu.\n\n# Replace the login and ressource limits file \nif [ -f ${PKGDIR}/etc/login.access ]; then\n mv -v ${PKGDIR}/etc/login.access{,.NOUSE}\nfi\nif [ -f ${PKGDIR}/etc/limits ]; then\n mv -v ${PKGDIR}/etc/limits{,.NOUSE}\nfi\n"
package: |
  true