1 # DO NOT EDIT. This file is generated from Config.src
3 # For a description of the syntax of this configuration file,
4 # see scripts/kbuild/config-language.txt.
7 menu "Login/Password Management Utilities"
9 config BUSYBOX_CONFIG_FEATURE_SHADOWPASSWDS
10 bool "Support shadow passwords"
11 default BUSYBOX_DEFAULT_FEATURE_SHADOWPASSWDS
13 Build support for shadow password in /etc/shadow. This file is only
14 readable by root and thus the encrypted passwords are no longer
17 config BUSYBOX_CONFIG_USE_BB_PWD_GRP
18 bool "Use internal password and group functions rather than system functions"
19 default BUSYBOX_DEFAULT_USE_BB_PWD_GRP
21 If you leave this disabled, busybox will use the system's password
22 and group functions. And if you are using the GNU C library
23 (glibc), you will then need to install the /etc/nsswitch.conf
24 configuration file and the required /lib/libnss_* libraries in
25 order for the password and group functions to work. This generally
26 makes your embedded system quite a bit larger.
28 Enabling this option will cause busybox to directly access the
29 system's /etc/password, /etc/group files (and your system will be
30 smaller, and I will get fewer emails asking about how glibc NSS
31 works). When this option is enabled, you will not be able to use
32 PAM to access remote LDAP password servers and whatnot. And if you
33 want hostname resolution to work with glibc, you still need the
34 /lib/libnss_* libraries.
36 If you need to use glibc's nsswitch.conf mechanism
37 (e.g. if user/group database is NOT stored in /etc/passwd etc),
38 you must NOT use this option.
40 If you enable this option, it will add about 1.5k.
42 config BUSYBOX_CONFIG_USE_BB_SHADOW
43 bool "Use internal shadow password functions"
44 default BUSYBOX_DEFAULT_USE_BB_SHADOW
45 depends on BUSYBOX_CONFIG_USE_BB_PWD_GRP && BUSYBOX_CONFIG_FEATURE_SHADOWPASSWDS
47 If you leave this disabled, busybox will use the system's shadow
48 password handling functions. And if you are using the GNU C library
49 (glibc), you will then need to install the /etc/nsswitch.conf
50 configuration file and the required /lib/libnss_* libraries in
51 order for the shadow password functions to work. This generally
52 makes your embedded system quite a bit larger.
54 Enabling this option will cause busybox to directly access the
55 system's /etc/shadow file when handling shadow passwords. This
56 makes your system smaller (and I will get fewer emails asking about
57 how glibc NSS works). When this option is enabled, you will not be
58 able to use PAM to access shadow passwords from remote LDAP
59 password servers and whatnot.
61 config BUSYBOX_CONFIG_USE_BB_CRYPT
62 bool "Use internal crypt functions"
63 default BUSYBOX_DEFAULT_USE_BB_CRYPT
65 Busybox has internal DES and MD5 crypt functions.
66 They produce results which are identical to corresponding
67 standard C library functions.
69 If you leave this disabled, busybox will use the system's
70 crypt functions. Most C libraries use large (~70k)
71 static buffers there, and also combine them with more general
72 DES encryption/decryption.
74 For busybox, having large static buffers is undesirable,
75 especially on NOMMU machines. Busybox also doesn't need
76 DES encryption/decryption and can do with smaller code.
78 If you enable this option, it will add about 4.8k of code
79 if you are building dynamically linked executable.
80 In static build, it makes code _smaller_ by about 1.2k,
81 and likely many kilobytes less of bss.
83 config BUSYBOX_CONFIG_USE_BB_CRYPT_SHA
84 bool "Enable SHA256/512 crypt functions"
85 default BUSYBOX_DEFAULT_USE_BB_CRYPT_SHA
86 depends on BUSYBOX_CONFIG_USE_BB_CRYPT
88 Enable this if you have passwords starting with "$5$" or "$6$"
89 in your /etc/passwd or /etc/shadow files. These passwords
90 are hashed using SHA256 and SHA512 algorithms. Support for them
91 was added to glibc in 2008.
92 With this option off, login will fail password check for any
93 user which has password encrypted with these algorithms.
95 config BUSYBOX_CONFIG_ADD_SHELL
97 default BUSYBOX_DEFAULT_ADD_SHELL if BUSYBOX_CONFIG_DESKTOP
99 Add shells to /etc/shells.
101 config BUSYBOX_CONFIG_REMOVE_SHELL
103 default BUSYBOX_DEFAULT_REMOVE_SHELL if BUSYBOX_CONFIG_DESKTOP
105 Remove shells from /etc/shells.
106 config BUSYBOX_CONFIG_ADDGROUP
108 default BUSYBOX_DEFAULT_ADDGROUP
110 Utility for creating a new group account.
112 config BUSYBOX_CONFIG_FEATURE_ADDGROUP_LONG_OPTIONS
113 bool "Enable long options"
114 default BUSYBOX_DEFAULT_FEATURE_ADDGROUP_LONG_OPTIONS
115 depends on BUSYBOX_CONFIG_ADDGROUP && BUSYBOX_CONFIG_LONG_OPTS
117 config BUSYBOX_CONFIG_FEATURE_ADDUSER_TO_GROUP
118 bool "Support adding users to groups"
119 default BUSYBOX_DEFAULT_FEATURE_ADDUSER_TO_GROUP
120 depends on BUSYBOX_CONFIG_ADDGROUP
122 If called with two non-option arguments,
123 addgroup will add an existing user to an
125 config BUSYBOX_CONFIG_ADDUSER
127 default BUSYBOX_DEFAULT_ADDUSER
129 Utility for creating a new user account.
131 config BUSYBOX_CONFIG_FEATURE_ADDUSER_LONG_OPTIONS
132 bool "Enable long options"
133 default BUSYBOX_DEFAULT_FEATURE_ADDUSER_LONG_OPTIONS
134 depends on BUSYBOX_CONFIG_ADDUSER && BUSYBOX_CONFIG_LONG_OPTS
136 config BUSYBOX_CONFIG_FEATURE_CHECK_NAMES
137 bool "Enable sanity check on user/group names in adduser and addgroup"
138 default BUSYBOX_DEFAULT_FEATURE_CHECK_NAMES
139 depends on BUSYBOX_CONFIG_ADDUSER || BUSYBOX_CONFIG_ADDGROUP
141 Enable sanity check on user and group names in adduser and addgroup.
142 To avoid problems, the user or group name should consist only of
143 letters, digits, underscores, periods, at signs and dashes,
144 and not start with a dash (as defined by IEEE Std 1003.1-2001).
145 For compatibility with Samba machine accounts "$" is also supported
146 at the end of the user or group name.
148 config BUSYBOX_CONFIG_LAST_ID
149 int "Last valid uid or gid for adduser and addgroup"
150 depends on BUSYBOX_CONFIG_ADDUSER || BUSYBOX_CONFIG_ADDGROUP
151 default BUSYBOX_DEFAULT_LAST_ID
153 Last valid uid or gid for adduser and addgroup
155 config BUSYBOX_CONFIG_FIRST_SYSTEM_ID
156 int "First valid system uid or gid for adduser and addgroup"
157 depends on BUSYBOX_CONFIG_ADDUSER || BUSYBOX_CONFIG_ADDGROUP
158 range 0 BUSYBOX_CONFIG_LAST_ID
159 default BUSYBOX_DEFAULT_FIRST_SYSTEM_ID
161 First valid system uid or gid for adduser and addgroup
163 config BUSYBOX_CONFIG_LAST_SYSTEM_ID
164 int "Last valid system uid or gid for adduser and addgroup"
165 depends on BUSYBOX_CONFIG_ADDUSER || BUSYBOX_CONFIG_ADDGROUP
166 range BUSYBOX_CONFIG_FIRST_SYSTEM_ID BUSYBOX_CONFIG_LAST_ID
167 default BUSYBOX_DEFAULT_LAST_SYSTEM_ID
169 Last valid system uid or gid for adduser and addgroup
170 config BUSYBOX_CONFIG_CHPASSWD
172 default BUSYBOX_DEFAULT_CHPASSWD
174 Reads a file of user name and password pairs from standard input
175 and uses this information to update a group of existing users.
177 config BUSYBOX_CONFIG_FEATURE_DEFAULT_PASSWD_ALGO
178 string "Default encryption method (passwd -a, cryptpw -m, chpasswd -c ALG)"
179 default BUSYBOX_DEFAULT_FEATURE_DEFAULT_PASSWD_ALGO
180 depends on BUSYBOX_CONFIG_PASSWD || BUSYBOX_CONFIG_CRYPTPW || BUSYBOX_CONFIG_CHPASSWD
182 Possible choices are "d[es]", "m[d5]", "s[ha256]" or "sha512".
183 config BUSYBOX_CONFIG_CRYPTPW
185 default BUSYBOX_DEFAULT_CRYPTPW
187 Encrypts the given password with the crypt(3) libc function
188 using the given salt.
190 config BUSYBOX_CONFIG_MKPASSWD
192 default BUSYBOX_DEFAULT_MKPASSWD
194 Encrypts the given password with the crypt(3) libc function
195 using the given salt. Debian has this utility under mkpasswd
196 name. Busybox provides mkpasswd as an alias for cryptpw.
197 config BUSYBOX_CONFIG_DELUSER
199 default BUSYBOX_DEFAULT_DELUSER
201 Utility for deleting a user account.
203 config BUSYBOX_CONFIG_DELGROUP
205 default BUSYBOX_DEFAULT_DELGROUP
207 Utility for deleting a group account.
209 config BUSYBOX_CONFIG_FEATURE_DEL_USER_FROM_GROUP
210 bool "Support removing users from groups"
211 default BUSYBOX_DEFAULT_FEATURE_DEL_USER_FROM_GROUP
212 depends on BUSYBOX_CONFIG_DELGROUP
214 If called with two non-option arguments, deluser
215 or delgroup will remove an user from a specified group.
216 config BUSYBOX_CONFIG_GETTY
218 default BUSYBOX_DEFAULT_GETTY
219 select BUSYBOX_CONFIG_FEATURE_SYSLOG
221 getty lets you log in on a tty. It is normally invoked by init.
223 Note that you can save a few bytes by disabling it and
224 using login applet directly.
225 If you need to reset tty attributes before calling login,
226 this script approximates getty:
228 exec </dev/$1 >/dev/$1 2>&1 || exit 1
230 stty sane; stty ispeed 38400; stty ospeed 38400
231 printf "%s login: " "`hostname`"
233 exec /bin/login "$login"
234 config BUSYBOX_CONFIG_LOGIN
236 default BUSYBOX_DEFAULT_LOGIN
237 select BUSYBOX_CONFIG_FEATURE_SYSLOG
239 login is used when signing onto a system.
241 Note that Busybox binary must be setuid root for this applet to
244 config BUSYBOX_CONFIG_LOGIN_SESSION_AS_CHILD
245 bool "Run logged in session in a child process"
246 default BUSYBOX_DEFAULT_LOGIN_SESSION_AS_CHILD if BUSYBOX_CONFIG_PAM
247 depends on BUSYBOX_CONFIG_LOGIN
249 Run the logged in session in a child process. This allows
250 login to clean up things such as utmp entries or PAM sessions
251 when the login session is complete. If you use PAM, you
252 almost always would want this to be set to Y, else PAM session
253 will not be cleaned up.
255 config BUSYBOX_CONFIG_LOGIN_SCRIPTS
256 bool "Support login scripts"
257 depends on BUSYBOX_CONFIG_LOGIN
258 default BUSYBOX_DEFAULT_LOGIN_SCRIPTS
260 Enable this if you want login to execute $LOGIN_PRE_SUID_SCRIPT
261 just prior to switching from root to logged-in user.
263 config BUSYBOX_CONFIG_FEATURE_NOLOGIN
264 bool "Support /etc/nologin"
265 default BUSYBOX_DEFAULT_FEATURE_NOLOGIN
266 depends on BUSYBOX_CONFIG_LOGIN
268 The file /etc/nologin is used by (some versions of) login(1).
269 If it exists, non-root logins are prohibited.
271 config BUSYBOX_CONFIG_FEATURE_SECURETTY
272 bool "Support /etc/securetty"
273 default BUSYBOX_DEFAULT_FEATURE_SECURETTY
274 depends on BUSYBOX_CONFIG_LOGIN
276 The file /etc/securetty is used by (some versions of) login(1).
277 The file contains the device names of tty lines (one per line,
278 without leading /dev/) on which root is allowed to login.
279 config BUSYBOX_CONFIG_PASSWD
281 default BUSYBOX_DEFAULT_PASSWD
282 select BUSYBOX_CONFIG_FEATURE_SYSLOG
284 passwd changes passwords for user and group accounts. A normal user
285 may only change the password for his/her own account, the super user
286 may change the password for any account. The administrator of a group
287 may change the password for the group.
289 Note that Busybox binary must be setuid root for this applet to
292 config BUSYBOX_CONFIG_FEATURE_PASSWD_WEAK_CHECK
293 bool "Check new passwords for weakness"
294 default BUSYBOX_DEFAULT_FEATURE_PASSWD_WEAK_CHECK
295 depends on BUSYBOX_CONFIG_PASSWD
297 With this option passwd will refuse new passwords which are "weak".
298 config BUSYBOX_CONFIG_SU
300 default BUSYBOX_DEFAULT_SU
301 select BUSYBOX_CONFIG_FEATURE_SYSLOG
303 su is used to become another user during a login session.
304 Invoked without a username, su defaults to becoming the super user.
305 Note that busybox binary must be setuid root for this applet to
308 config BUSYBOX_CONFIG_FEATURE_SU_SYSLOG
309 bool "Log to syslog all attempts to use su"
310 default BUSYBOX_DEFAULT_FEATURE_SU_SYSLOG
311 depends on BUSYBOX_CONFIG_SU
313 config BUSYBOX_CONFIG_FEATURE_SU_CHECKS_SHELLS
314 bool "If user's shell is not in /etc/shells, disallow -s PROG"
315 default BUSYBOX_DEFAULT_FEATURE_SU_CHECKS_SHELLS
316 depends on BUSYBOX_CONFIG_SU
318 config BUSYBOX_CONFIG_FEATURE_SU_BLANK_PW_NEEDS_SECURE_TTY
319 bool "Allow blank passwords only on TTYs in /etc/securetty"
320 default BUSYBOX_DEFAULT_FEATURE_SU_BLANK_PW_NEEDS_SECURE_TTY
321 depends on BUSYBOX_CONFIG_SU
322 config BUSYBOX_CONFIG_SULOGIN
324 default BUSYBOX_DEFAULT_SULOGIN
325 select BUSYBOX_CONFIG_FEATURE_SYSLOG
327 sulogin is invoked when the system goes into single user
328 mode (this is done through an entry in inittab).
329 config BUSYBOX_CONFIG_VLOCK
331 default BUSYBOX_DEFAULT_VLOCK
333 Build the "vlock" applet which allows you to lock (virtual) terminals.
335 Note that Busybox binary must be setuid root for this applet to