i.policyconf revision 499fd60129a966ad9d9e752e65f591c3a6a1c697
246N/A# The contents of this file are subject to the terms of the 246N/A# Common Development and Distribution License (the "License"). 246N/A# You may not use this file except in compliance with the License. 246N/A# See the License for the specific language governing permissions 246N/A# and limitations under the License. 246N/A# When distributing Covered Code, include this CDDL HEADER in each 246N/A# If applicable, add the following below this CDDL HEADER, with the 246N/A# fields enclosed by brackets "[]" replaced with your own identifying 246N/A# information: Portions Copyright [yyyy] [name of copyright owner] 246N/A#ident "%Z%%M% %I% %E% SMI" 246N/A# Copyright 2008 Sun Microsystems, Inc. All rights reserved. 1424N/A# Use is subject to license terms. 3996N/A # Copy copyright and ident from new file ($src); 3996N/A # update the AUTHS_GRANTED and PROFS_GRANTED field. 246N/A # Add the latter if it does not exist. 246N/A # Strip trailing spaces. 246N/A pg=
"PROFS_GRANTED=Basic Solaris User" 246N/A echo "${dest} updating entries for CONSOLE_USER," \
3996N/A echo "${dest} updating entries for crypt(3c)," \
# crypt(3c) Algorithms Configuration # CRYPT_ALGORITHMS_ALLOW specifies the algorithms that are allowed to # be used for new passwords. This is enforced only in crypt_gensalt(3c). CRYPT_ALGORITHMS_ALLOW=1,2a,md5 # To deprecate use of the traditional unix algorithm, uncomment below # and change CRYPT_DEFAULT= to another algorithm. For example, # CRYPT_DEFAULT=1 for BSD/Linux MD5. #CRYPT_ALGORITHMS_DEPRECATE=__unix__ # The Solaris default is the traditional UNIX algorithm. This is not # listed in crypt.conf(4) since it is internal to libc. The reserved # name __unix__ is used to refer to it. echo "${dest} updating entries for privileges(5)," \
# These settings determine the default privileges users have. If not set, # the default privileges are taken from the inherited set. # There are two different settings; PRIV_DEFAULT determines the default # set on login; PRIV_LIMIT defines the Limit set on login. # Individual users can have privileges assigned or taken away through # user_attr. Privileges can also be assigned to profiles in which case # the users with those profiles can use those privileges through pfexec(1m). # For maximum future compatibility, the specifications should # always include "basic" or "all"; privileges should then be removed using # the negation. E.g., PRIV_LIMIT=all,!sys_linkdir takes away only the # sys_linkdir privilege, regardless of future additional privileges. # Similarly, PRIV_DEFAULT=basic,!file_link_any takes away only the # file_link_any privilege from the basic privilege set; only that notation # is immune from a future addition of currently unprivileged operations to # the basic privilege set. # NOTE: removing privileges from the the Limit set requires EXTREME care # as any set-uid root program may suddenly fail because it lacks certain echo "${dest} updating entry for LOCK_AFTER_RETRIES," \
"see pam_unix_auth(5) for details." \
# LOCK_AFTER_RETRIES specifies the default account locking policy for local # user accounts (passwd(4)/shadow(4)). The default may be overridden by # a user's user_attr(4) "lock_after_retries" value. # YES enables local account locking, NO disables local account locking. # The default value is NO.