Home | History | Annotate | Download | only in libsecdb
      1 #
      2 # CDDL HEADER START
      3 #
      4 # The contents of this file are subject to the terms of the
      5 # Common Development and Distribution License (the "License").
      6 # You may not use this file except in compliance with the License.
      7 #
      8 # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9 # or http://www.opensolaris.org/os/licensing.
     10 # See the License for the specific language governing permissions
     11 # and limitations under the License.
     12 #
     13 # When distributing Covered Code, include this CDDL HEADER in each
     14 # file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15 # If applicable, add the following below this CDDL HEADER, with the
     16 # fields enclosed by brackets "[]" replaced with your own identifying
     17 # information: Portions Copyright [yyyy] [name of copyright owner]
     18 #
     19 # CDDL HEADER END
     20 #
     21 #
     22 # Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
     23 # Use is subject to license terms.
     24 #
     25 # /etc/security/policy.conf
     26 #
     27 # security policy configuration for user attributes. see policy.conf(4)
     28 #
     29 AUTHS_GRANTED=solaris.device.cdrw
     30 PROFS_GRANTED=Basic Solaris User
     31 CONSOLE_USER=Console User
     32 
     33 # crypt(3c) Algorithms Configuration
     34 #
     35 # CRYPT_ALGORITHMS_ALLOW specifies the algorithms that are allowed to
     36 # be used for new passwords.  This is enforced only in crypt_gensalt(3c).
     37 #
     38 CRYPT_ALGORITHMS_ALLOW=1,2a,md5,5,6
     39 
     40 # To deprecate use of the traditional unix algorithm, uncomment below
     41 # and change CRYPT_DEFAULT= to another algorithm.  For example,
     42 # CRYPT_DEFAULT=1 for BSD/Linux MD5.
     43 #
     44 #CRYPT_ALGORITHMS_DEPRECATE=__unix__
     45 
     46 # The Solaris default is the traditional UNIX algorithm.  This is not
     47 # listed in crypt.conf(4) since it is internal to libc.  The reserved
     48 # name __unix__ is used to refer to it.
     49 #
     50 CRYPT_DEFAULT=__unix__
     51 #
     52 # These settings determine the default privileges users have.  If not set,
     53 # the default privileges are taken from the inherited set.
     54 # There are two different settings; PRIV_DEFAULT determines the default
     55 # set on login; PRIV_LIMIT defines the Limit set on login.
     56 # Individual users can have privileges assigned or taken away through
     57 # user_attr.  Privileges can also be assigned to profiles in which case
     58 # the users with those profiles can use those privileges through pfexec(1).
     59 # For maximum future compatibility, the specifications should
     60 # always include "basic" or "all"; privileges should then be removed using
     61 # the negation.  E.g., PRIV_LIMIT=all,!sys_linkdir takes away only the
     62 # sys_linkdir privilege, regardless of future additional privileges.
     63 # Similarly, PRIV_DEFAULT=basic,!file_link_any takes away only the
     64 # file_link_any privilege from the basic privilege set; only that notation
     65 # is immune from a future addition of currently unprivileged operations to
     66 # the basic privilege set.
     67 # NOTE: removing privileges from the the Limit set requires EXTREME care
     68 # as any set-uid root program may suddenly fail because it lacks certain
     69 # privilege(s).
     70 #
     71 #PRIV_DEFAULT=basic
     72 #PRIV_LIMIT=all
     73 #
     74 # LOCK_AFTER_RETRIES specifies the default account locking policy for local
     75 # user accounts (passwd(4)/shadow(4)).  The default may be overridden by
     76 # a user's user_attr(4) "lock_after_retries" value.
     77 # YES enables local account locking, NO disables local account locking.
     78 # The default value is NO.
     79 #
     80 #LOCK_AFTER_RETRIES=NO
     81