Free passwd software for linux

Alternate Password Library (libaltpw) adds alternate password support dynamically with LD_PRELOAD or by linking the shared library with the executable.
Useful, for example, to make sendmail, procmail, and pop3d use an alternate password if you are an ISP.
Works with any program that uses the getpw* family of functions and the password file is configurable through the environment.
Basically this is just another library, you can link against it and it overrides getpw* to point at an alternate password file specified by the environment variable ALTPASSWD.
So the normal way to use it, in non SUID form, would be:
# export ALTPASSWD=/some/other/passwd.file
# export LD_PRELOAD=/usr/local/lib/libaltpw.so.X
# < some command >
And some command will see the alternate password file. This does not work in an SUID contect because LD_PRELOAD is ignored for SUID binaries. To help determine when things will and will not work like expected, there is the runaltpw command. So the above becomes this:
# runaltpw /some/other/passwd.file < some command > < arg > < arg >
And if it thinks things look OK, i.e. not SUID, passwd exists and everything else, it will exec the command after setting up the environment. If things look strange, if will exit instead.
There are also some README.* files that deal with specific programs I had trouble with, either because they had a strange build process, were SUID by default, or both.
Enhancements:
- Added support for the getgr* group handling functions, and a /etc/group.switch and ALTGROUP in the environment, all similar to how the altpw functions work but for groups, as suggested by Bruce Richardson.

File::LckPwdF is a Perl module to lock and unlock the passwd and shadow files with lckpwdf and ulckpwdf.

SYNOPSIS

use File::LckPwdF;

(lock_passwd(15)) || (die "Cant lock password file:n$! stopped");

# ... do stuff with the passwd file ...

(unlock_passwd()) || (die "Cant unlock password file:n$! stopped");

This is a perl module to use lckpwdf(3) and ulckpwdf(3) to lock the /etc/passwd and (if present) /etc/shadow files.

Functions exported automatically

lock_passwd($timeout)

$timeout works as follows:

1. The initial time is checked.

2. If $timeout is 0, it tries lckpwdf() until it succeeds, waiting a random time in between.

3. If $timeout is above 0, it tries lckpwdf() once. If that (or any following lckpwdf()) succeeds, it returns 1. It will try lckpwdf() until either it succeeds or the time is greater than the initial time plus $timeout. In the latter case, it returns 0. It waits a random time in between tries of lckpwdf().

The random timeout is controlled by $File::LckPwdF::Rand_Wait, which is exported on request. It is used via

sleep int(rand($Rand_Wait) + 1);

inside an until loop. This sleep is only done if $File::LckPwdF::Rand_Wait is above 0.

$timeout defaults to $File::LckPwdF::Default_Timeout, which is also exported on request; the initial setting of $File::LckPwdF::Default_Timeout (the default default) is 15 seconds. The default setting for $File::LckPwdF::Rand_Wait is 10 seconds.

unlock_passwd()

This function uses ulckpwdf(). If lock_passwd() has previously been used to lock the passwd file, and unlock_passwd() has not been used to lock it, then it will be used to unlock the passwd file in an END: statement. (Admittedly, with many implementations of lckpwdf() this is not necessary, since when a process exits it loses the passwd file lock; it is present as a safety measure for those systems for which this is not true.)

Functions exported by request

lckpwdf() ulckpwdf()

These are the xs-loaded versions of lckpwdf(3) and ulckpwdf(3), respectively.

bftpd program is a small, easy-to-configure FTP server. It strives to be fast, secure and quick to install/configure.
Main features:
- Easy configuration
- Speed
- Support for most RFC FTP commands
- tar.gz on-the-fly compression/archiving
- Security with chroot without special setup
- No need for files (sh, ls...) in a chroot environment
- Logging to wtmp and to a logfile or syslog
- PAM and passwd/shadow support
- Support for SITE CHOWN/CHMOD
Running the server:
bftpd runs in either standalone or inetd mode.
If you want inetd mode
Add the following to your /etc/inetd.conf:
ftp stream tcp nowait root /usr/sbin/bftpd bftpd
Give inetd a HUP or reboot your system. Your FTP server should work now.
If you want inetd mode with xinetd
Add the following to your /etc/xinetd.conf:
service ftp
{
disable = no
socket_type = stream
wait = no
user = root
server = /usr/sbin/bftpd
log_on_success += DURATION USERID
log_on_failure += USERID
nice = 10
}

cvsdadm is a tool to assist CVSd administrators in the user admin of the CVSROOT/passwd, CVSROOT/readers, CVSROOT/writers files when pserver authentication is being used for the repository.
Cvsdadm project is a fork of cvspadm.
Enhancements:
- The copyright notice of the original cvspadm author was added again.
- It had been removed in ignorance about the license requirements.

PAM Lockout Module is a PAM module is used to lockout users or groups from access to the machine. The module only supports authentication queries and the command line arguments are used to pass the users and groups.

A sample usage is for locking root out from remote access.

--------------- /etc/pam.d/sshd ---------
#%PAM-1.0
auth requisite /lib/security/pam_lockout.so user=root
auth required /lib/security/pam_stack.so service=system-auth
auth required /lib/security/pam_nologin.so
account required /lib/security/pam_stack.so service=system-auth
password required /lib/security/pam_stack.so service=system-auth
session required /lib/security/pam_stack.so service=system-auth
-----------------------------------------

The arguments to the module are in the form of user= or group=. There MUST NOT be any spaces in the arguments for the module to work.

I placed the module at the head of the stack to prevent other PAM modules from being accessed by the locked out users. In order for the user or group lockout to work the username or group name should be available via the getpwnam(3) or getgrnam(3) functions.

User comarisions are done using the pw_uid field in the passwd structure. So any user with and id of zero would be locked out in the above example. Group comparisions are done via string compares of the inbound user and the names returned by getgrnam(3).