知识大全 Linux Shadow-Password-HOWTO - 3. 取得 Shadow Suite

Posted 2022-07-15 程式

篇首语：新长征路上，有风有雨是常态，风雨无阻是心态，风雨兼程是状态。本文由小常识网(cha138.com)小编为大家整理，主要介绍了知识大全 Linux Shadow-Password-HOWTO - 3. 取得 Shadow Suite相关的知识，希望对你有一定的参考价值。

Linux Shadow-Password-HOWTO - 3. 取得 Shadow Suite 以下文字资料是由(全榜网网www.cha138.com)小编为大家搜集整理后发布的内容，让我们赶快一起来看一下吧！

　　 Shadow Suite for Linux 的历史(暂不翻译) 　　 History of the Shadow Suite for Linux 　　DO NOT USE THE PACKAGES IN THIS SECTION THEY HAVE SECURITY PROBLEMS 　　　　The original Shadow Suite was written by John F Haugh II 　　　　There are several versions that have been used on Linux systems: 　　　　shadow is the original 　　shadow is Linux specific patch made by Florian La Roche and contains some further enhancements 　　shadow mk was specifically packaged for Linux 　　The shadow mk package contains the shadow package distributed by John F Haugh II with the shadow patch installed a few fixes made by Mohan Kokal that make installation a lot easier a patch by Joseph R M Zbiciak for login c (login secure) that eliminates the f h security holes in /bin/login and some other miscellaneous patches 　　　　The shadow mk package was the previously remended package but should be replaced due to a security problem with the login program 　　　　There are security problems with Shadow versions and shadow mk involving the login program This login bug involves not checking the length of a login name This causes the buffer to overflow causing crashes or worse It has been rumored that this buffer overflow can allow someone with an account on the system to use this bug and the shared libraries to gain root access I won t discuss exactly how this is possible because there are a lot of Linux systems that are affected but systems with these Shadow Suites installed and most pre ELF distributions without the Shadow Suite are vulnerable! 　　　　For more information on this and other Linux security issues see the Linux Security home page (Shared Libraries and login Program Vulnerability) 　　　　　　　　如何取得 Shadow Suite？　　目前建议 Shadow Suite 版本目前还是 BETA 测试版然后最近版本在生产环境是安全的且没有包含易受攻击的签入(login) 程式　　　　该套件(package)使用惯例命名为　　　　shadow YYMMDD tar gz 　　　　其中 YYMMDD 是Suite 的发行日期　　目前 BETA 测试版本是 Version 且由 Marek Michalkiewicz 维护　　　　还可以从该处得到 shadow current tar gz 　　　　下列网站也可以找到相关资讯　　　　ftp://ftp icm edu pl/pub/Linux/shadow/shadow current tar gz 　　ftp://iguana hut fi/pub/linux/shadow/shadow current tar gz 　　ftp:///usr/ggallag/shadow/shadow current tar gz 　　ftp:///pub/linux/shadow/shadow current tar gz 　　你应该可以获得目前最新的版本　　　　你应该不要是用比 shadow 更旧版本因为它们有签入的安全问题　　　　　　　　于参考资料方面我用 shadow 档进行安装介绍　　　　如果你之前使用 shadow mk 你应该更信这个版本且重建编译　　　　　　 Shadow Suite包含什么？　　Shadow Suite 包括对下列功能之替代程式　　　　su login passwd newgrp chfn chsh and id 　　　　该套件还包括新程式　　　　chage newusers dpasswd gpasswd useradd userdel usermod groupadd groupdel groupmod groups pwck grpck lastlog pwconv and pwunconv 　　　　除此之外函式库 libshadow a 也包括需要存取使用者密码之写和编译程式　　　　程式之操作手册也包含在其中　　　　　　也有对签入程式的 configuration file 它将被安装在 /etc/login defs 档 cha138/Article/program/Oracle/201311/18514