Password setting policies Introduction 11.. PPoolliicciieess ffoorr ppaasssswwoorrdd You can define here what is acceptable as a password. You control the minimum length and the number of non alpha characters. By forcing passwords made with other character, you are encouraging the choice of better password (hard to guess and crack). Note that this is not effective on PAM aware system such as _R_e_d_H_a_t _5. The PAM library has its own set of rules to accept/reject a new password. 22.. PPrriivvaattee ggrroouupp When this feature is enabled, linuxconf will create a group having the same name as the user account, unless a group is specified. The dialog for a new account appears with the group field empty. When disabled, linuxconf assigns a default group to new account (users). This feature is not effective for special accounts such as POP and PPP accounts since those accounts are assigned to a specific group (popusers and pppusers). Note also that this feature does not prevent you from assigning the group you want to an account. If the group does not exist, you will have the opportunity to create it on the fly. 33.. DDeeffaauulltt bbaassee ddiirr ffoorr hhoommeess Enter here the base directory which will be used to create new user accounts. It defaults to /home. 44.. UUsseerr ddeeffiinneedd aaccccoouunntt mmaannaaggeemmeenntt ccoommmmaannddss When linuxconf creates or deletes user accounts, it calls various scripts. You can override those scripts by entering the path of your own version. You can also disable this processing by erasing the path. Linuxconf is providing default values for some of those scripts. 44..11.. CCoommmmaanndd lliinnee aarrgguummeennttss Linuxconf always call those scripts with the same command line. It is built with the following arguments. +o --uid userid This is the userid of the new account +o --name full name This is the full name (the gecos field) of the account. +o --basehome dir This is the directory where new accounts are created. This can be used by archiving commands to create archives. The sample accountarchive.sh (see Pre-delete command below) is using that to reach the oldaccounts sub-directory. +o --home home_directory This is the home directory of the account. Note that the home is supplied without the first /. So it is supplied as a relative path. This helps commands such as tar which complain when supplied with an absolute path. So doing a cd / at the beginning of your command is a good idea. +o --domain domain This is either / or the virtual email domain. From this the proper in-box mail file may be computed. 44..22.. DDeelleettee aaccccoouunntt ccoommmmaanndd This command (if non empty) is used to delete the account data: the HOME directory and the mail inbox folder. When you delete an account, a pop-up dialog lets you pick the proper action: Archive the data, delete or left in place. A default delete command is supplied, but you can define a new one 44..33.. AArrcchhiivvee aaccccoouunntt ccoommaanndd A default archiving command is supplied. It preserves the HOME directory and the mail inbox folder in a compressed tar file. This file is stored in /home/oldaccounts. The name of the file has the following format user-YYYY-MM-DD-PID.tar.gz The PID is simply the process ID of the archive command. This is used to make the name fully unique. Files archived in /home/oldaccounts are left there forever. You may want to clean the old ones from time to time, according to the administritation policies applying to your organisation. You can use this field to specify your own archiving command. 44..44.. PPoosstt--ccrreeaattee ccoommmmaanndd Each time you create a user account, a command may be executed. You must specify here the full path of the command as well as any arguments. Note that this command is called after the account has been created and committed in the password database (/etc/passwd). The output and error code of the command are logged in the "Linuxconf's logs". 44..55.. PPoosstt--ddeelleettee ccoommmmaanndd You can specify a command which is executed before the account is removed from the password database (/etc/passwd). Output and error code are also logged. If any error is detected, the user will be allowed to see the log and will be asked if the accounts should be deleted. 55.. AAccccoouunntt ddeeffaauullttss When using shadow password, you have control both on the password expiration date and also on the account expiration date. You can set defaults here. They will be used to setup new accounts. Note that this section only shows up if you have enabled shadow password. Some linux distributions do not support shadow passwords. Some distribution do not install them by default. Linuxconf adapt to this situation on the fly.