$Id: README.linux,v 1.8 1997/06/15 23:51:19 marekm Exp $

This is the shadow suite hacked a bit for Linux.  See CHANGES for
short description of changes.  See also WISHLIST if you have too
much time on your hands :-).  Now that copyright issues have been
resolved, the most important thing is testing.  Please test this
code as much as you can, and report any problems.

Now that this package uses GNU autoconf, it should hopefully be
easier to port - but it hasn't been tested much on anything but
Linux/x86.  It has been reported to work on SunOS 4.1.x.

There is a developers mailing list, now maintained by Jon Lewis
<jlewis@fdt.net>.  The mailing list address has changed.  Send
the command "subscribe shadow-list" to majordomo@lists.fdt.net
to subscribe if you are interested.  To send mail to everyone on
the list, send it to shadow-list@lists.fdt.net.

Before reporting bugs, please check if they still exist in my latest
development snapshot.  Every few weeks I make a new version available
at ftp://ftp.ists.pwr.wroc.pl/pub/linux/shadow/.

After installation, please remember to remove any old binaries like
/bin/passwd (this version installs /usr/bin/passwd).  If your passwd
program doesn't like the new /etc/login.defs settings, and complains
about "configuration error", this is most likely the problem.

Current versions of the Linux C library (both libc 5.x and glibc)
have the shadow support built in.  It is now possible to build
libshadow.a without these functions and use the ones from libc
instead.  The configure script (generated using GNU autoconf) will
check for shadow functions in libc and use them instead of the ones
in libshadow.a.

Remember that shadow passwords will not make your system more secure
if your distribution has gaping holes which let any user become root.
Some distributions, especially the older ones, are much like SunOS 4.1
without any security patches installed :-).  Read the linux-security
mailing list archives, and plug all holes before attempting to install
the shadow suite.

Older versions of this package (shadow-3.3.x, shadow-mk) have a few
nasty security holes, too.  Please use the latest version if possible.

Encrypted passwords are not readable, but it is highly recommended
to use cracklib with a big dictionary to prevent users from choosing
weak passwords.  This way if someone ever gets access to /etc/shadow
(for example, because of some not yet discovered bug), they will not
get half of the passwords using Crack...  There is a configure option
to use cracklib, I haven't tested it myself but I'm told it works.

The code feels like stabilizing now - while still BETA, it should
work quite well.  Many bugs have been fixed, but there may be still
a few lurking.  Again, please test it and report any problems.

Thanks to Julianne Frances Haugh <jfh@tab.com> who wrote the thing
in the first place, sent me the latest version, and released it under
a "free" BSD-style license, so that it can be included in Linux
distributions (at least Debian 1.3 and Slackware 3.2 are already
doing that; Debian and Red Hat packaging standards are supported in
the standard source tree).  David Frey <David.Frey@lugs.ch>, Michael
Meskes <meskes@topsystem.de> and Guy Maor <maor@debian.org> have
done a lot of work to integrate shadow passwords into Debian Linux.

Special thanks to Michael H. Jackson <mhjack@tscnet.com> who wrote
the Linux Shadow Password HOWTO.  Special thanks to Greg Gallagher
<ggallag@orion.it.luc.edu> for maintaining the developers mailing
list for over a year, and to Jon Lewis <jlewis@fdt.net> for giving
the list a new home.

Ian Jackson <iwj10@cus.cam.ac.uk> criticized the current shadow password
system (see the linux-security mailing list archives).  We disagree on
some points, but this started a discussion on possible better solutions.
Theodore Ts'o <tytso@mit.edu> has started a new project to implement
Pluggable Authentication Modules - a relatively new standard API which
makes it easier to add new authentication mechanisms (it's more than
just shadow passwords).  See http://parc.power.net/morgan/Linux-PAM/ for
more information.

Thanks to at least the following people for sending me patches, bug
reports and various comments.  This list may be incomplete, I received
a lot of mail...

John Adelsberger <jja@umr.edu>
Luca Berra <bluca@www.polimi.it>
Darcy Boese <possum@chardonnay.niagara.com>
Judd Bourgeois <shagboy@bluesky.net>
Ed Carp <ecarp@netcom.com>
Rani Chouha <ranibey@smartec.com>
Joshua Cowan <jcowan@hermit.reslife.okstate.edu>
Alan Curry <pacman@tardis.mars.net>
Frank Denis <j@digiweb.net.ma>
Hrvoje Dogan <hdogan@bjesomar.srce.hr>
Chris Evans <lady0110@sable.ox.ac.uk>
Marc Ewing <marc@redhat.com>
Janos Farkas <chexum@bankinf.banki.hu>
Werner Fink <werner@suse.de>
David Frey <David.Frey@lugs.ch>
Brian R. Gaeke <brg@dgate.org>
Cristian Gafton <gafton@sorosis.ro>
Juergen Heinzl <unicorn@noris.net>
Joey Hess <joey@kite.ml.org>
Tim Hockin <thockin@eagle.ais.net>
David A. Holland <dholland@hcs.harvard.edu>
Timo Karjalainen <timok@iki.fi>
Thorsten Kukuk <kukuk@vt.uni-paderborn.de>
Jon Lewis <jlewis@fdt.net>
Guy Maor <maor@debian.org>
Rafal Maszkowski <rzm@torun.pdi.net>
Michael Meskes <meskes@topsystem.de>
Steve M. Robbins <steve@nyongwa.montreal.qc.ca>
Adam Rudnicki <adam@v-lo.krakow.pl>
Algis Rudys <security@musashi.gsgis.k12.va.us>
Juha Virtanen <jiivee@iki.fi>
Michael Talbot-Wilson <mike@calypso.bns.com.au>
Shane Watts <shane@nexus.mlckew.edu.au>
Alexander O. Yuriev <alex@bach.cis.temple.edu>

Thanks,
-- Marek Michalkiewicz <marekm@i17linuxb.ists.pwr.wroc.pl>
