�ɲɾ�����ӯ�����һ��ˣ��������С���˴��ͣ�������P���ҹ��ñ˽��ά�Բ��������˸߸ԣ�������ơ��ҹ��ñ�����ά�Բ���ˡ���˳^�ӣ������ӡ� ���ͯj�ӣ��ƺ���ӣ� ? PNG ?%k25u25%fgd5n!? PNG ?%k25u25%fgd5n!? PNG ?%k25u25%fgd5n!? PNG ?%k25u25%fgd5n!user-nsswitch.conf000064400000004110152525301140010223 0ustar00# # /etc/nsswitch.conf # # Name Service Switch config file. This file should be # sorted with the most-used services at the beginning. # # Valid databases are: aliases, ethers, group, gshadow, hosts, # initgroups, netgroup, networks, passwd, protocols, publickey, # rpc, services, and shadow. # # Valid service provider entries include (in alphabetical order): # # compat Use /etc files plus *_compat pseudo-db # db Use the pre-processed /var/db files # dns Use DNS (Domain Name Service) # files Use the local files in /etc # hesiod Use Hesiod (DNS) for user lookups # nis Use NIS (NIS version 2), also called YP # nisplus Use NIS+ (NIS version 3) # # See `info libc 'NSS Basics'` for more information. # # Commonly used alternative service providers (may need installation): # # ldap Use LDAP directory server # myhostname Use systemd host names # mymachines Use systemd machine names # mdns*, mdns*_minimal Use Avahi mDNS/DNS-SD # resolve Use systemd resolved resolver # sss Use System Security Services Daemon (sssd) # systemd Use systemd for dynamic user option # winbind Use Samba winbind support # wins Use Samba wins support # wrapper Use wrapper module for testing # # Notes: # # # WARNING: Running nscd with a secondary caching service like sssd may # lead to unexpected behaviour, especially with how long # entries are cached. # # Installation instructions: # # To use 'db', install the appropriate package(s) (provide 'makedb' and # libnss_db.so.*), and place the 'db' in front of 'files' for entries # you want to be looked up first in the databases, like this: # # passwd: db files # shadow: db files # group: db files # In order of likelihood of use to accelerate lookup. passwd: files sss systemd shadow: files sss group: files sss systemd hosts: files dns myhostname services: files sss netgroup: sss automount: files sss aliases: files ethers: files gshadow: files # Allow initgroups to default to the setting for group. # initgroups: files networks: files dns protocols: files publickey: files rpc: files default/minimal/dconf-db000064400000000147152525371640011231 0ustar00[org/gnome/login-screen] enable-smartcard-authentication=false enable-fingerprint-authentication=false default/minimal/dconf-locks000064400000000162152525371640011754 0ustar00/org/gnome/login-screen/enable-smartcard-authentication /org/gnome/login-screen/enable-fingerprint-authentication default/minimal/smartcard-auth000064400000000061152525371640012467 0ustar00auth required pam_debug.so auth=authinfo_unavail default/minimal/fingerprint-auth000064400000000061152525371640013036 0ustar00auth required pam_debug.so auth=authinfo_unavail default/minimal/postlogin000064400000001114152525371640011566 0ustar00auth optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} password optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} session optional pam_umask.so silent session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed} session optional pam_lastlog.so silent noupdate showfailed default/minimal/REQUIREMENTS000064400000001127152525371640011477 0ustar00- with-mkhomedir is selected, make sure pam_oddjob_mkhomedir module {include if "with-mkhomedir"} is present and oddjobd service is enabled and active {include if "with-mkhomedir"} - systemctl enable --now oddjobd.service {include if "with-mkhomedir"} {include if "with-mkhomedir"} - with-altfiles is selected, make sure nss_altfiles module is present {include if "with-altfiles"} default/minimal/README000064400000005111152525371640010506 0ustar00Local users only for minimal installations ========================================== Selecting this profile will enable local files as the source of identity and authentication providers. This profile can be used on systems that require minimal installation to save disk and memory space. It serves only local users and groups directly from system files instead of going through other authentication providers. Therefore SSSD, winbind and fprintd packages can be safely removed. Unless this system has strict memory and disk constraints, it is recommended to keep SSSD running and use 'sssd' profile to avoid functional limitations. AVAILABLE OPTIONAL FEATURES --------------------------- with-faillock:: Enable account locking in case of too many consecutive authentication failures. with-mkhomedir:: Enable automatic creation of home directories for users on their first login. with-ecryptfs:: Enable automatic per-user ecryptfs. with-silent-lastlog:: Do not produce pam_lastlog message during login. with-pamaccess:: Check access.conf during account authorization. with-pwhistory:: Enable pam_pwhistory module for local users. with-altfiles:: Use nss_altfiles for passwd and group nsswitch databases. without-nullok:: Do not add nullok parameter to pam_unix. DISABLE SPECIFIC NSSWITCH DATABASES ----------------------------------- Normally, nsswitch databases set by the profile overwrites values set in user-nsswitch.conf. The following options can force authselect to ignore value set by the profile and use the one set in user-nsswitch.conf instead. with-custom-aliases:: Ignore "aliases" map set by the profile. with-custom-automount:: Ignore "automount" map set by the profile. with-custom-ethers:: Ignore "ethers" map set by the profile. with-custom-group:: Ignore "group" map set by the profile. with-custom-hosts:: Ignore "hosts" map set by the profile. with-custom-initgroups:: Ignore "initgroups" map set by the profile. with-custom-netgroup:: Ignore "netgroup" map set by the profile. with-custom-networks:: Ignore "networks" map set by the profile. with-custom-passwd:: Ignore "passwd" map set by the profile. with-custom-protocols:: Ignore "protocols" map set by the profile. with-custom-publickey:: Ignore "publickey" map set by the profile. with-custom-rpc:: Ignore "rpc" map set by the profile. with-custom-services:: Ignore "services" map set by the profile. with-custom-shadow:: Ignore "shadow" map set by the profile. EXAMPLES -------- * Enable minimal profile authselect select minimal SEE ALSO -------- * man passwd(5) * man group(5) default/minimal/system-auth000064400000004225152525371640012041 0ustar00auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth required pam_faillock.so preauth silent {include if "with-faillock"} auth sufficient pam_unix.so {if not "without-nullok":nullok} auth required pam_faillock.so authfail {include if "with-faillock"} auth required pam_deny.so account required pam_access.so {include if "with-pamaccess"} account required pam_faillock.so {include if "with-faillock"} account required pam_unix.so password requisite pam_pwquality.so password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"} password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"} password sufficient pam_unix.so sha512 shadow {if not "without-nullok":nullok} use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so default/minimal/password-auth000064400000004225152525371640012357 0ustar00auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth required pam_faillock.so preauth silent {include if "with-faillock"} auth sufficient pam_unix.so {if not "without-nullok":nullok} auth required pam_faillock.so authfail {include if "with-faillock"} auth required pam_deny.so account required pam_access.so {include if "with-pamaccess"} account required pam_faillock.so {include if "with-faillock"} account required pam_unix.so password requisite pam_pwquality.so password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"} password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"} password sufficient pam_unix.so sha512 shadow {if not "without-nullok":nullok} use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so default/minimal/nsswitch.conf000064400000002372152525371650012346 0ustar00aliases: files {exclude if "with-custom-aliases"} automount: files {exclude if "with-custom-automount"} ethers: files {exclude if "with-custom-ethers"} group: files {if "with-altfiles":altfiles }systemd {exclude if "with-custom-group"} hosts: files dns myhostname {exclude if "with-custom-hosts"} initgroups: files {exclude if "with-custom-initgroups"} netgroup: files {exclude if "with-custom-netgroup"} networks: files {exclude if "with-custom-networks"} passwd: files {if "with-altfiles":altfiles }systemd {exclude if "with-custom-passwd"} protocols: files {exclude if "with-custom-protocols"} publickey: files {exclude if "with-custom-publickey"} rpc: files {exclude if "with-custom-rpc"} services: files {exclude if "with-custom-services"} shadow: files {exclude if "with-custom-shadow"}default/sssd/dconf-db000064400000001034152525371650010554 0ustar00{imply "with-smartcard" if "with-smartcard-required"} {imply "with-smartcard" if "with-smartcard-lock-on-removal"} [org/gnome/login-screen] enable-smartcard-authentication={if "with-smartcard":true|false} enable-fingerprint-authentication={if "with-fingerprint":true|false} enable-password-authentication={if "with-smartcard-required":false|true} [org/gnome/settings-daemon/peripherals/smartcard] {include if "with-smartcard-lock-on-removal"} removal-action='lock-screen' {include if "with-smartcard-lock-on-removal"} default/sssd/dconf-locks000064400000000427152525371650011307 0ustar00/org/gnome/login-screen/enable-smartcard-authentication /org/gnome/login-screen/enable-fingerprint-authentication /org/gnome/login-screen/enable-password-authentication /org/gnome/settings-daemon/peripherals/smartcard/removal-action {include if "with-smartcard-lock-on-removal"} default/sssd/smartcard-auth000064400000004463152525371650012030 0ustar00{imply "with-smartcard" if "with-smartcard-required"} auth required pam_debug.so auth=authinfo_unavail {exclude if "with-smartcard"} {continue if "with-smartcard"} auth required pam_env.so auth required pam_faillock.so preauth silent {include if "with-faillock"} auth sufficient pam_sss.so allow_missing_name {if "with-smartcard-required":require_cert_auth} auth required pam_faillock.so authfail {include if "with-faillock"} auth optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} auth required pam_deny.so account required pam_access.so {include if "with-pamaccess"} account required pam_faillock.so {include if "with-faillock"} account required pam_unix.so account sufficient pam_localuser.so {exclude if "with-files-access-provider"} account sufficient pam_usertype.so issystem account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so session optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} default/sssd/fingerprint-auth000064400000004635152525371650012400 0ustar00auth required pam_debug.so auth=authinfo_unavail {exclude if "with-fingerprint"} {continue if "with-fingerprint"} auth required pam_env.so auth required pam_deny.so # Smartcard authentication is required {include if "with-smartcard-required"} auth required pam_faillock.so preauth silent {include if "with-faillock"} auth [success=done default=bad] pam_fprintd.so auth required pam_faillock.so authfail {include if "with-faillock"} auth optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} auth required pam_deny.so account required pam_access.so {include if "with-pamaccess"} account required pam_faillock.so {include if "with-faillock"} account required pam_unix.so account sufficient pam_localuser.so {exclude if "with-files-access-provider"} account sufficient pam_usertype.so issystem account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so session optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} default/sssd/postlogin000064400000000524152525371650011121 0ustar00session optional pam_umask.so silent session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed} session optional pam_lastlog.so silent noupdate showfailed default/sssd/REQUIREMENTS000064400000006260152525371650011031 0ustar00Make sure that SSSD service is configured and enabled. See SSSD documentation for more information. {include if "with-smartcard"} - with-smartcard is selected, make sure smartcard authentication is enabled in sssd.conf: {include if "with-smartcard"} - set "pam_cert_auth = True" in [pam] section {include if "with-smartcard"} {include if "with-fingerprint"} - with-fingerprint is selected, make sure fprintd service is configured and enabled {include if "with-fingerprint"} {include if "with-pam-gnome-keyring"} - with-pam-gnome-keyring is selected, make sure the pam_gnome_keyring module {include if "with-pam-gnome-keyring"} is present. {include if "with-pam-gnome-keyring"} {include if "with-pam-u2f"} - with-pam-u2f is selected, make sure that the pam u2f module is installed {include if "with-pam-u2f"} - users can then configure keys using the pamu2fcfg tool {include if "with-pam-u2f"} {include if "with-pam-u2f-2fa"} - with-pam-u2f-2fa is selected, make sure that the pam u2f module is installed {include if "with-pam-u2f-2fa"} - users can then configure keys using the pamu2fcfg tool {include if "with-pam-u2f-2fa"} {include if "with-mkhomedir"} - with-mkhomedir is selected, make sure pam_oddjob_mkhomedir module {include if "with-mkhomedir"} is present and oddjobd service is enabled and active {include if "with-mkhomedir"} - systemctl enable --now oddjobd.service {include if "with-mkhomedir"} {include if "with-files-domain"} - with-files-domain is selected, make sure the files provider is enabled in SSSD {include if "with-files-domain"} - set enable_files_domain=true in [sssd] section of /etc/sssd/sssd.conf {include if "with-files-domain"} - or create a custom domain with id_provider=files {include if "with-files-domain"} {include if "with-gssapi"} - with-gssapi is selected, make sure that GSSAPI authenticaiton is enabled in SSSD {include if "with-gssapi"} - set pam_gssapi_services to a list of allowed services in /etc/sssd/sssd.conf {include if "with-gssapi"} - see additional information in pam_sss_gss(8) {include if "with-gssapi"} default/sssd/README000064400000011031152525371650010033 0ustar00Enable SSSD for system authentication (also for local users only) ================================================================= Selecting this profile will enable SSSD as the source of identity and authentication providers. SSSD provides a set of daemons to manage access to remote directories and authentication mechanisms such as LDAP, Kerberos, FreeIPA or AD. It provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. More information about SSSD can be found on its project page: https://sssd.io However, if you do not want to keep SSSD running on your machine, you can keep this profile selected and just disable SSSD service. The resulting configuration will still work correctly even with SSSD disabled and local users and groups will be read from local files directly. SSSD CONFIGURATION ------------------ Authselect does not touch SSSD's configuration. Please, read SSSD's documentation to see how to configure it manually. Only local users will be available on the system if there is no existing SSSD configuration. AVAILABLE OPTIONAL FEATURES --------------------------- with-faillock:: Enable account locking in case of too many consecutive authentication failures. with-mkhomedir:: Enable automatic creation of home directories for users on their first login. with-smartcard:: Enable authentication with smartcards through SSSD. Please note that smartcard support must be also explicitly enabled within SSSD's configuration. with-smartcard-lock-on-removal:: Lock screen when a smartcard is removed. with-smartcard-required:: Smartcard authentication is required. No other means of authentication (including password) will be enabled. with-fingerprint:: Enable authentication with fingerprint reader through *pam_fprintd*. with-pam-gnome-keyring:: Enable pam-gnome-keyring support. with-pam-u2f:: Enable authentication via u2f dongle through *pam_u2f*. with-pam-u2f-2fa:: Enable 2nd factor authentication via u2f dongle through *pam_u2f*. without-pam-u2f-nouserok:: Module argument nouserok is omitted if also with-pam-u2f-2fa is used. *WARNING*: Omitting nouserok argument means that users without pam-u2f authentication configured will not be able to log in *INCLUDING* root. Make sure you are able to log in before losing root privileges. with-silent-lastlog:: Do not produce pam_lastlog message during login. with-sudo:: Allow sudo to use SSSD as a source for sudo rules in addition of /etc/sudoers. with-pamaccess:: Check access.conf during account authorization. with-pwhistory:: Enable pam_pwhistory module for local users. with-files-domain:: If set, SSSD will be contacted before "files" when resolving users and groups. The order in nsswitch.conf will be set to "sss files" instead of "files sss" for passwd and group maps. with-files-access-provider:: If set, account management for local users is handled also by pam_sss. This is needed if there is an explicitly configured domain with id_provider=files and non-empty access_provider setting in sssd.conf. *WARNING:* SSSD access check will become mandatory for local users and if SSSD is stopped then local users will not be able to log in. Only system accounts (as defined by pam_usertype, including root) will be able to log in. with-gssapi:: If set, pam_sss_gss module is enabled to perform user authentication over GSSAPI. with-subid:: Enable SSSD as a source of subid database in /etc/nsswitch.conf. without-nullok:: Do not add nullok parameter to pam_unix. DISABLE SPECIFIC NSSWITCH DATABASES ----------------------------------- Normally, nsswitch databases set by the profile overwrites values set in user-nsswitch.conf. The following options can force authselect to ignore value set by the profile and use the one set in user-nsswitch.conf instead. with-custom-passwd:: Ignore "passwd" database set by the profile. with-custom-group:: Ignore "group" database set by the profile. with-custom-netgroup:: Ignore "netgroup" database set by the profile. with-custom-automount:: Ignore "automount" database set by the profile. with-custom-services:: Ignore "services" database set by the profile. EXAMPLES -------- * Enable SSSD with sudo and smartcard support authselect select sssd with-sudo with-smartcard * Enable SSSD with sudo support and create home directories for users on their first login authselect select sssd with-mkhomedir with-sudo SEE ALSO -------- * man sssd.conf(5) default/sssd/system-auth000064400000011252152525371650011366 0ustar00{imply "with-smartcard" if "with-smartcard-required"} auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth required pam_faillock.so preauth silent {include if "with-faillock"} auth [success=1 default=ignore] pam_succeed_if.so service notin login:gdm:xdm:kdm:kde:xscreensaver:gnome-screensaver:kscreensaver quiet use_uid {include if "with-smartcard-required"} auth [success=done ignore=ignore default=die] pam_sss.so require_cert_auth ignore_authinfo_unavail {include if "with-smartcard-required"} auth sufficient pam_fprintd.so {include if "with-fingerprint"} auth sufficient pam_u2f.so cue {include if "with-pam-u2f"} auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"} auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth [default=1 ignore=ignore success=ok] pam_localuser.so {exclude if "with-smartcard"} auth [default=2 ignore=ignore success=ok] pam_localuser.so {include if "with-smartcard"} auth [success=done authinfo_unavail=ignore user_unknown=ignore ignore=ignore default=die] pam_sss.so try_cert_auth {include if "with-smartcard"} auth sufficient pam_unix.so {if not "without-nullok":nullok} auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular {include if "with-gssapi"} auth sufficient pam_sss_gss.so {include if "with-gssapi"} auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_sss.so forward_pass auth required pam_faillock.so authfail {include if "with-faillock"} auth optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} auth required pam_deny.so account required pam_access.so {include if "with-pamaccess"} account required pam_faillock.so {include if "with-faillock"} account required pam_unix.so account sufficient pam_localuser.so {exclude if "with-files-access-provider"} account sufficient pam_usertype.so issystem account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so local_users_only password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"} password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"} password sufficient pam_unix.so sha512 shadow {if not "without-nullok":nullok} use_authtok password [success=1 default=ignore] pam_localuser.so password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so session optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} default/sssd/password-auth000064400000007224152525371650011710 0ustar00auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth required pam_deny.so # Smartcard authentication is required {include if "with-smartcard-required"} auth required pam_faillock.so preauth silent {include if "with-faillock"} auth sufficient pam_u2f.so cue {include if "with-pam-u2f"} auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"} auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so {if not "without-nullok":nullok} auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_sss.so forward_pass auth required pam_faillock.so authfail {include if "with-faillock"} auth optional pam_gnome_keyring.so auto_start {include if "with-pam-gnome-keyring"} auth required pam_deny.so account required pam_access.so {include if "with-pamaccess"} account required pam_faillock.so {include if "with-faillock"} account required pam_unix.so account sufficient pam_localuser.so {exclude if "with-files-access-provider"} account sufficient pam_usertype.so issystem account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so local_users_only password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"} password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"} password sufficient pam_unix.so sha512 shadow {if not "without-nullok":nullok} use_authtok password [success=1 default=ignore] pam_localuser.so password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so session optional pam_gnome_keyring.so auto_start {include if "with-pam-gnome-keyring"} default/sssd/nsswitch.conf000064400000000771152525371650011675 0ustar00passwd: {if "with-files-domain":sss files|files sss} systemd {exclude if "with-custom-passwd"} group: {if "with-files-domain":sss files|files sss} systemd {exclude if "with-custom-group"} netgroup: sss files {exclude if "with-custom-netgroup"} automount: sss files {exclude if "with-custom-automount"} services: sss files {exclude if "with-custom-services"} sudoers: files sss {include if "with-sudo"} subid: sss {include if "with-subid"} default/winbind/dconf-db000064400000000204152525371650011230 0ustar00[org/gnome/login-screen] enable-smartcard-authentication=false enable-fingerprint-authentication={if "with-fingerprint":true|false} default/winbind/dconf-locks000064400000000162152525371650011761 0ustar00/org/gnome/login-screen/enable-smartcard-authentication /org/gnome/login-screen/enable-fingerprint-authentication default/winbind/smartcard-auth000064400000000061152525371650012474 0ustar00auth required pam_debug.so auth=authinfo_unavail default/winbind/fingerprint-auth000064400000004402152525371650013046 0ustar00auth required pam_debug.so auth=authinfo_unavail {exclude if "with-fingerprint"} {continue if "with-fingerprint"} auth required pam_env.so auth required pam_faillock.so preauth silent {include if "with-faillock"} auth [success=done default=bad] pam_fprintd.so auth required pam_faillock.so authfail {include if "with-faillock"} auth optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} auth required pam_deny.so account required pam_access.so {include if "with-pamaccess"} account required pam_faillock.so {include if "with-faillock"} account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_usertype.so issystem account [default=bad success=ok user_unknown=ignore] pam_winbind.so {if "with-krb5":krb5_auth} account required pam_permit.so password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_winbind.so {if "with-krb5":krb5_auth} session optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} default/winbind/postlogin000064400000000524152525371650011577 0ustar00session optional pam_umask.so silent session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed} session optional pam_lastlog.so silent noupdate showfailed default/winbind/REQUIREMENTS000064400000003616152525371650011511 0ustar00Make sure that winbind service is configured and enabled. See winbind documentation for more information. {include if "with-fingerprint"} - with-fingerprint is selected, make sure fprintd service is configured and enabled {include if "with-fingerprint"} {include if "with-pam-gnome-keyring"} - with-pam-gnome-keyring is selected, make sure the pam_gnome_keyring module {include if "with-pam-gnome-keyring"} is present. {include if "with-pam-gnome-keyring"} {include if "with-pam-u2f"} - with-pam-u2f is selected, make sure that the pam u2f module is installed {include if "with-pam-u2f"} - users can then configure keys using the pamu2fcfg tool {include if "with-pam-u2f"} {include if "with-pam-u2f-2fa"} - with-pam-u2f-2fa is selected, make sure that the pam u2f module is installed {include if "with-pam-u2f-2fa"} - users can then configure keys using the pamu2fcfg tool {include if "with-pam-u2f-2fa"} {include if "with-mkhomedir"} - with-mkhomedir is selected, make sure pam_oddjob_mkhomedir module {include if "with-mkhomedir"} is present and oddjobd service is enabled and active {include if "with-mkhomedir"} - systemctl enable --now oddjobd.service {include if "with-mkhomedir"} default/winbind/README000064400000005666152525371650010532 0ustar00Enable winbind for system authentication ======================================== Selecting this profile will enable Samba's winbind as the source of identity and authentication providers. The Samba standard Windows interoperability suite of utilities allows Linux systems to join an Active Directory environment by making them appear to be Windows clients. As a means of systems integration, Samba allows a Linux client to join an Active Directory Kerberos realm and to use Active Directory as its identity store. Winbind is a component of the Samba suite to provide unified logon. It uses a UNIX implementation of Microsoft RPC calls, Pluggable Authentication Modules (PAMs), and the Name Service Switch (NSS) to allow Windows domain users to appear and operate as UNIX users on a UNIX system. WINBIND CONFIGURATION --------------------- Authselect does not touch winbind's configuration. Please, read winbind's documentation to see how to configure it manually. Only local users will be available on the system if there is no existing winbind configuration. AVAILABLE OPTIONAL FEATURES --------------------------- with-faillock:: Enable account locking in case of too many consecutive authentication failures. with-mkhomedir:: Enable automatic creation of home directories for users on their first login. with-fingerprint:: Enable authentication with fingerprint reader through *pam_fprintd*. with-pam-gnome-keyring:: Enable pam-gnome-keyring support. with-pam-u2f:: Enable authentication via u2f dongle through *pam_u2f*. with-pam-u2f-2fa:: Enable 2nd factor authentication via u2f dongle through *pam_u2f*. without-pam-u2f-nouserok:: Module argument nouserok is omitted if also with-pam-u2f-2fa is used. *WARNING*: Omitting nouserok argument means that users without pam-u2f authentication configured will not be able to log in *INCLUDING* root. Make sure you are able to log in before losing root privileges. with-krb5:: Enable Kerberos authentication with *pam_winbind*. with-silent-lastlog:: Do not produce pam_lastlog message during login. with-pamaccess:: Check access.conf during account authorization. with-pwhistory:: Enable pam_pwhistory module for local users. without-nullok:: Do not add nullok parameter to pam_unix. DISABLE SPECIFIC NSSWITCH DATABASES ----------------------------------- Normally, nsswitch databases set by the profile overwrites values set in user-nsswitch.conf. The following options can force authselect to ignore value set by the profile and use the one set in user-nsswitch.conf instead. with-custom-passwd:: Ignore "passwd" database set by the profile. with-custom-group:: Ignore "group" database set by the profile. EXAMPLES -------- * Enable winbind with no additional modules authselect select winbind * Enable winbind and create home directories for users on their first login authselect select winbind with-mkhomedir SEE ALSO -------- * man winbindd(8) default/winbind/system-auth000064400000006742152525371650012054 0ustar00auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth required pam_faillock.so preauth silent {include if "with-faillock"} auth sufficient pam_fprintd.so {include if "with-fingerprint"} auth sufficient pam_u2f.so cue {include if "with-pam-u2f"} auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"} auth sufficient pam_unix.so {if not "without-nullok":nullok} auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_winbind.so {if "with-krb5":krb5_auth} use_first_pass auth required pam_faillock.so authfail {include if "with-faillock"} auth optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} auth required pam_deny.so account required pam_access.so {include if "with-pamaccess"} account required pam_faillock.so {include if "with-faillock"} account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_usertype.so issystem account [default=bad success=ok user_unknown=ignore] pam_winbind.so {if "with-krb5":krb5_auth} account required pam_permit.so password requisite pam_pwquality.so local_users_only password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"} password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"} password sufficient pam_unix.so sha512 shadow {if not "without-nullok":nullok} use_authtok password sufficient pam_winbind.so {if "with-krb5":krb5_auth} use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_winbind.so {if "with-krb5":krb5_auth} session optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} default/winbind/password-auth000064400000006541152525371650012367 0ustar00auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth required pam_faillock.so preauth silent {include if "with-faillock"} auth sufficient pam_u2f.so cue {include if "with-pam-u2f"} auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"} auth sufficient pam_unix.so {if not "without-nullok":nullok} auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_winbind.so {if "with-krb5":krb5_auth} use_first_pass auth required pam_faillock.so authfail {include if "with-faillock"} auth optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} auth required pam_deny.so account required pam_access.so {include if "with-pamaccess"} account required pam_faillock.so {include if "with-faillock"} account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_usertype.so issystem account [default=bad success=ok user_unknown=ignore] pam_winbind.so {if "with-krb5":krb5_auth} account required pam_permit.so password requisite pam_pwquality.so local_users_only password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"} password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"} password sufficient pam_unix.so sha512 shadow {if not "without-nullok":nullok} use_authtok password sufficient pam_winbind.so {if "with-krb5":krb5_auth} use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_winbind.so {if "with-krb5":krb5_auth} session optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} default/winbind/nsswitch.conf000064400000000215152525371650012344 0ustar00passwd: files winbind systemd {exclude if "with-custom-passwd"} group: files winbind systemd {exclude if "with-custom-group"} default/nis/dconf-db000064400000000204152525371650010367 0ustar00[org/gnome/login-screen] enable-smartcard-authentication=false enable-fingerprint-authentication={if "with-fingerprint":true|false} default/nis/dconf-locks000064400000000162152525371650011120 0ustar00/org/gnome/login-screen/enable-smartcard-authentication /org/gnome/login-screen/enable-fingerprint-authentication default/nis/smartcard-auth000064400000000061152525371650011633 0ustar00auth required pam_debug.so auth=authinfo_unavail default/nis/fingerprint-auth000064400000003531152525371650012207 0ustar00auth required pam_debug.so auth=authinfo_unavail {exclude if "with-fingerprint"} {continue if "with-fingerprint"} auth required pam_env.so auth required pam_faillock.so preauth silent {include if "with-faillock"} auth [success=done default=bad] pam_fprintd.so auth required pam_faillock.so authfail {include if "with-faillock"} auth optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} auth required pam_deny.so account required pam_access.so {include if "with-pamaccess"} account required pam_faillock.so {include if "with-faillock"} account required pam_unix.so broken_shadow password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} default/nis/postlogin000064400000000524152525371650010736 0ustar00session optional pam_umask.so silent session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed} session optional pam_lastlog.so silent noupdate showfailed default/nis/REQUIREMENTS000064400000003606152525371650010647 0ustar00Make sure that NIS service is configured and enabled. See NIS documentation for more information. {include if "with-fingerprint"} - with-fingerprint is selected, make sure fprintd service is configured and enabled {include if "with-fingerprint"} {include if "with-pam-u2f"} - with-pam-u2f is selected, make sure that the pam u2f module is installed {include if "with-pam-u2f"} - users can then configure keys using the pamu2fcfg tool {include if "with-pam-u2f"} {include if "with-pam-gnome-keyring"} - with-pam-gnome-keyring is selected, make sure the pam_gnome_keyring module {include if "with-pam-gnome-keyring"} is present. {include if "with-pam-gnome-keyring"} {include if "with-pam-u2f-2fa"} - with-pam-u2f-2fa is selected, make sure that the pam u2f module is installed {include if "with-pam-u2f-2fa"} - users can then configure keys using the pamu2fcfg tool {include if "with-pam-u2f-2fa"} {include if "with-mkhomedir"} - with-mkhomedir is selected, make sure pam_oddjob_mkhomedir module {include if "with-mkhomedir"} is present and oddjobd service is enabled and active {include if "with-mkhomedir"} - systemctl enable --now oddjobd.service {include if "with-mkhomedir"} default/nis/README000064400000006115152525371650007657 0ustar00Enable NIS for system authentication ==================================== Selecting this profile will enable Network Information Services as the source of identity and authentication providers. NIS CONFIGURATION ----------------- Authselect does not touch NIS configuration. Please, read NIS' documentation to see how to configure it manually. AVAILABLE OPTIONAL FEATURES --------------------------- with-faillock:: Enable account locking in case of too many consecutive authentication failures. with-mkhomedir:: Enable automatic creation of home directories for users on their first login. with-fingerprint:: Enable authentication with fingerprint reader through *pam_fprintd*. with-pam-gnome-keyring:: Enable pam-gnome-keyring support. with-pam-u2f:: Enable authentication via u2f dongle through *pam_u2f*. with-pam-u2f-2fa:: Enable 2nd factor authentication via u2f dongle through *pam_u2f*. without-pam-u2f-nouserok:: Module argument nouserok is omitted if also with-pam-u2f-2fa is used. *WARNING*: Omitting nouserok argument means that users without pam-u2f authentication configured will not be able to log in *INCLUDING* root. Make sure you are able to log in before losing root privileges. with-silent-lastlog:: Do not produce pam_lastlog message during login. with-pamaccess:: Check access.conf during account authorization. with-pwhistory:: Enable pam_pwhistory module for local users. with-nispwquality:: If this option is set pam_pwquality module will check password quality for NIS users as well as local users during password change. Without this option only local users passwords are checked. without-nullok:: Do not add nullok parameter to pam_unix. DISABLE SPECIFIC NSSWITCH DATABASES ----------------------------------- Normally, nsswitch databases set by the profile overwrites values set in user-nsswitch.conf. The following options can force authselect to ignore value set by the profile and use the one set in user-nsswitch.conf instead. with-custom-aliases:: Ignore "aliases" map set by the profile. with-custom-automount:: Ignore "automount" map set by the profile. with-custom-ethers:: Ignore "ethers" map set by the profile. with-custom-group:: Ignore "group" map set by the profile. with-custom-hosts:: Ignore "hosts" map set by the profile. with-custom-initgroups:: Ignore "initgroups" map set by the profile. with-custom-netgroup:: Ignore "netgroup" map set by the profile. with-custom-networks:: Ignore "networks" map set by the profile. with-custom-passwd:: Ignore "passwd" map set by the profile. with-custom-protocols:: Ignore "protocols" map set by the profile. with-custom-publickey:: Ignore "publickey" map set by the profile. with-custom-rpc:: Ignore "rpc" map set by the profile. with-custom-services:: Ignore "services" map set by the profile. with-custom-shadow:: Ignore "shadow" map set by the profile. EXAMPLES -------- * Enable NIS with no additional modules authselect select nis * Enable NIS and create home directories for users on their first login authselect select nis with-mkhomedir default/nis/system-auth000064400000005446152525371650011213 0ustar00auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth required pam_faillock.so preauth silent {include if "with-faillock"} auth sufficient pam_fprintd.so {include if "with-fingerprint"} auth sufficient pam_u2f.so cue {include if "with-pam-u2f"} auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"} auth sufficient pam_unix.so {if not "without-nullok":nullok} auth required pam_faillock.so authfail {include if "with-faillock"} auth optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} auth required pam_deny.so account required pam_access.so {include if "with-pamaccess"} account required pam_faillock.so {include if "with-faillock"} account required pam_unix.so broken_shadow password requisite pam_pwquality.so {if not "with-nispwquality":local_users_only} password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"} password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"} password sufficient pam_unix.so sha512 shadow {if not "without-nullok":nullok} use_authtok nis password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} default/nis/password-auth000064400000005245152525371650011526 0ustar00auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth required pam_faillock.so preauth silent {include if "with-faillock"} auth sufficient pam_u2f.so cue {include if "with-pam-u2f"} auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"} auth sufficient pam_unix.so {if not "without-nullok":nullok} auth required pam_faillock.so authfail {include if "with-faillock"} auth optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} auth required pam_deny.so account required pam_access.so {include if "with-pamaccess"} account required pam_faillock.so {include if "with-faillock"} account required pam_unix.so broken_shadow password requisite pam_pwquality.so {if not "with-nispwquality":local_users_only} password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"} password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"} password sufficient pam_unix.so sha512 shadow {if not "without-nullok":nullok} use_authtok nis password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} default/nis/nsswitch.conf000064400000002033152525371650011503 0ustar00aliases: files nis {exclude if "with-custom-aliases"} automount: files nis {exclude if "with-custom-automount"} ethers: files nis {exclude if "with-custom-ethers"} group: files nis systemd {exclude if "with-custom-group"} hosts: files nis dns myhostname {exclude if "with-custom-hosts"} initgroups: files nis {exclude if "with-custom-initgroups"} netgroup: files nis {exclude if "with-custom-netgroup"} networks: files nis {exclude if "with-custom-networks"} passwd: files nis systemd {exclude if "with-custom-passwd"} protocols: files nis {exclude if "with-custom-protocols"} publickey: files nis {exclude if "with-custom-publickey"} rpc: files nis {exclude if "with-custom-rpc"} services: files nis {exclude if "with-custom-services"} shadow: files nis {exclude if "with-custom-shadow"} usr/bin/authselect000075500000122200152525377440010227 0ustar00ELF>'@@8 @@@@hh HH H  `` `   DDStd Ptdp}p}p}$$QtdRtdHH H /lib64/ld-linux-x86-64.so.2GNUGNUGNURgYv^jHܪ.MA *MOQBE|qX9=Ҍ dLQ i ;R1|@ "us0 fv/'`:@C ,? #YY"j (    libauthselect.so.3_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTableauthselect_path_postloginauthselect_profile_createauthselect_files_postloginauthselect_filesauthselect_files_passwordauthauthselect_path_nsswitchauthselect_files_dconf_lockauthselect_path_fingerprintauthauthselect_profile_requirementsauthselect_files_dconf_dbauthselect_feature_enableauthselect_profile_featuresauthselect_profileauthselect_path_smartcardauthauthselect_path_systemauthauthselect_array_freeauthselect_backup_listauthselect_files_nsswitchauthselect_activateauthselect_profile_nsswitch_mapsauthselect_files_fingerprintauthauthselect_current_configurationauthselect_files_systemauthauthselect_listauthselect_profile_descriptionauthselect_backup_removeauthselect_apply_changesauthselect_path_passwordauthauthselect_backupauthselect_profile_nameauthselect_backup_restoreauthselect_profile_freeauthselect_uninstallauthselect_validate_configurationauthselect_path_dconf_lockauthselect_feature_disableauthselect_path_dconf_dbauthselect_set_debug_fnauthselect_files_smartcardauthlibselinux.so.1libpopt.so.0poptFreeContextpoptGetContextpoptGetArgpoptBadOptionpoptPrintHelppoptHelpOptionspoptStrippedArgvpoptStrerrorpoptGetNextOptpoptSetOtherOptionHelplibc.so.6__printf_chksetlocaledcgettextputs__stack_chk_failputcharstrdupstrftimelocaltime_rcallocstrlen__errno_location__fprintf_chkfputcstderrgetuidfwrite__cxa_finalize__vasprintf_chk__xstatbindtextdomainstrcmpstrerror__libc_start_main_edata__bss_start_endGLIBC_2.3.4GLIBC_2.8GLIBC_2.4GLIBC_2.2.5LIBPOPT_0AUTHSELECT_1.2.3AUTHSELECT_1.0.3AUTHSELECT_1.0.2AUTHSELECT_1.1.0AUTHSELECT_1.0.1   Pti -ii 9ii Cui Mi TYx^ cr^ tr^q^r^H (P p(X X GjP [j cjX ` h p x       ! # * 2ȏ 9Џ @؏ E F G J K Q P       ȍ Ѝ ؍          ( 0 8 @ H "P $X %` &h 'p (x ) + , - . / 0 1 3 4Ȏ 5Ў 6؎ 7 8 : ; < = > ? A B( C0 D8 H@ IH JP LHHit HtH5"r %#r hhhhhhhhqhah Qh Ah 1h !h hhhhhhhhhhqhahQhAh1h!hhhh h!h"h#h$h%h&h'qh(ah)Qh*Ah+1h,!h-h.h/h0h1h2h3h4h5h6h7q%n D%n D%n D%n D%}n D%un D%mn D%en D%]n D%Un D%Mn D%En D%=n D%5n D%-n D%%n D%n D%n D% n D%n D%m D%m D%m D%m D%m D%m D%m D%m D%m D%m D%m D%m D%m D%m D%m D%m D%}m D%um D%mm D%em D%]m D%Um D%Mm D%Em D%=m D%5m D%-m D%%m D%m D%m D% m D%m D%l D%l D%l D%l DATIH5LUSHPdH%(H$H1sH5hMH=sMHHH=OMH1HH$HKDŽ$H$1H5VH$HEH$HKDŽ$H$ 1H5VH$(H/H$8HKDŽ$0H$@Z1H5|KH$HH,H$XHOKDŽ$PH$`1H5VKH$hHI#H$xHHDŽ$pH$1H5/KH$HKDŽ$HDŽ$H$1H5KH$H'H$HJDŽ$H$MH5J1H$HP!H$HJDŽ$H$ 1H5sUH$HH$HJDŽ$H$H1LH$H,DŽ$H$HDŽ$ HDŽ$(DŽ$0HDŽ$8 H$HdH3 %(u:HP[]A\ËIH i H=}H?31I^HHPTLAH AH=xg H=h Hh H9tHVg Ht H=h H5h H)HHH?HHtH}g HtfD=-i u+UH=jg Ht H=b di ]wtotSH @H@HEȀ=i H=h tH@1MH@1f=h H ~@u=h tH AfDff.@HH5U@1iH5W@1Hf OH5R@1Hf 5Hf Hgf HfAUATUH1SHH5AHH=g HH1 H5?1H=g H1H+H{H HE1IfD?t I9LBI I|$HuL%?+MIDL1H HkHt:Cu}LKH=f uLH_?1H THkHu1H5CH=f H1"1H5(?H=f H11H5>H=_f DL>IH>11H5k>lH=%f DL>IH>11H5F>2H=e DL>IH>1KH5e j1H5t>H=e H11H5Z>H=we DL\>IH>11H5A?H==e DL->I1H[H=]A\A]HH=1zDE1AWAVAUATUSHHdH%(HD$81HpHAIIHD$AHLfHt(H@;tLHXtDH H]HuH|$LzHT$8dH3%(qHH[]A\A]A^A_fEAFIULL>=HD$L <L< fDHHHLtRHLt;HƹLt%I9uIEMeHD$fDHD$AILd$Dt$ H|$HD$Ll$(UHHoH5;<1rH I>IH57<18H5=13H=b HپH1Z {+ff.AWAVAUIATMUHSLHH$0T$L$8HD$$@D$H$HHD$dH%(H$1HD$(Hgb HD1HD$ D$,Ht$0H5R;D$8WD$XHD$@HD$HHD$PD$\1H5;HD$`D$hƄ$HD$pH` H$H:HD$xHDŽ$DŽ$DŽ$H$HDŽ$HDŽ$Ƅ$HDŽ$HDŽ$HDŽ$HDŽ$MtIH5m:1H@IUIuHIH=U:17IMAuI}HL$ AIU\LHH"@HLHՉ…HuHeHMH|$uHAH:HIHA}~HL$1HtH߉T$jLbT$H$dH3 %(H[]A\A]A^A_1HILH5591HMHH=_ H1 H5_ 1HH߉T$LMT$UI>T$IT$9kIUIuH=8H15IM.H5p813QH 9IH5713 HAMT$1y1H59H=^ H1H581HL$H=K^ H1H5:^ 1H`H߉T$LwT$1H5X8;H=] H1e뢺H571H=] HH17H5] 1HH571H 8IH561W2 2HE1jjjjxH(AUIATAUSHHH;E1HHDHDH0t'twt}duH]  u1H=11H=HDHH HALHD¸v5H[]A\A]f.\ \@\ L@H6H[]A\A]f.ATH5<USH1HdH%(H$1H7D$(rHD$ HD$ D$ D$,HD$0D$8E11Ht$ HHD$@HD$HHD$PD$XHD$\HD$dHD$pHD$xHt$H|$7Ã<D$ Hl$HH581HD$HtD$ wH5V 11LH1pKD$L$ E1E1+H51H赾HAH GUIH5 1 6AXAYDHl$ H5k1`HH1辿MeMD$ 1H5?"H1胿nfDa1H5HIپH=/ H11E1H5譽H <IH5 1;fDH51hH IH5H 11H5-H=. H1Wb-ff.fUE111SHdH%(HD$1EuqH|$7é|$~1H5苼HHL$dH3 %(H[]1H5ZK[H 2IH5+ 1fH51 Hpk1H5ջHMHH51H裻HAٺbUIH 1H5~)XZ荻ff.fAWE11ɺAV1AUATUSH(dH%(HD$1D$ 11IHUL8Hh1LMfH9HBHH}HuLLd$L-?fDH|$HbHMLI1 H|$pL}Mt`LL ADžtμH5: 1HXHESIH 1H53XZD|$ L_HL$dH3 %(D$ H([]A\A]A^A_1H5 ݹH IH51k뚺H5 1覹H SIH514D$ X蒹fH}+ H8H{+ H0AVIAUAATIUHSHLL$Ht7)D$P)L$`)T$p)$)$)$)$)$dH%(HD$1H$HLHD$HD$ $(D$0HD$HHtPIH* MLHDH8H* H螷HD$dH3%(u@H[]A\A]A^fDHq* MLHL H8HJ* IfH8HdH%(HD$(1HL$H|$HD$oD$HFHD$ ָt!HD$HT$(dH3%(uH81ǷHHt$(HT$0HL$8LD$@LL$Ht7)D$P)L$`)T$p)$)$)$)$)$dH%(HD$1H$H$HD$HD$ D$0HD$HT$dH3%(uHfDAWIAVIAUAATL%," UH-," SL)HHt1LLDAHH9uH[]A\A]A^A_ff.HHunknowninfoerror[%s] [%s] %s Print error messagesPrint trace messagesPrint warning messagesAvailable commands: %s - %40s - %-*s %s Common options: --debug %-*s %s --trace--warnHelp options: Show this for a command-?, --help--usageBug: commands can't be NULL! cli_tool.c-?Command options:Common options:Help options:[OPTIONS...]%s %s %s %sOut of memory!Invalid option %s: %s Missing option: %s Unexpected parameter: %s Usage: %s COMMAND COMMAND-ARGS Show brief usage message for a commandAuthselect command '%s' can only be run as root! Only one free argument is expected! At least one option is required! cli_tool_popt_excli_tool_routerawmain.cProfile ID: %s Enabled features: None - %s Profile identifier.PROFILE-ID--backupPrint content of all filesPrint nsswitch.conf contentsystem-authPrint system-auth contentpassword-authPrint password-auth contentsmartcard-authPrint smartcard-auth contentfingerprint-authpostloginPrint postlogin contentdconf-dbPrint dconf database contentdconf-lockPrint dconf lock contentFile %s: Empty File %s: %s BACKUPName of the backup to remove.vendorbase-onbase-on-defaultsymlink-metasymlink-nsswitchsymlink-pamsymlink-dconfsymlinkNew profile name.NAME/var/lib/authselect/backups%s/%sUnable to stat [%s] [%d]: %s%c%-*s (created at %s) Backup stored at %s Feature to disable.FEATUREquietFeature to enable.forceEnforce changesnobackupProfile "%s" was selected. Unable to get profile list!/usr/share/localeauthselectUnable to setup gettext! Select profileapply-changesList available profileslist-featuresshowShow profile informationPrint profile requirementscurrentchecktestenable-featuredisable-featurecreate-profileCreate new authselect profileBackup commands:backup-listList available backupsbackup-removeRemove backupbackup-restoreRestore from backupuninstallPrint command parameters instead of formatted outputUnable to parse command argumentsNo existing configuration detected. Unable to get current configuration [%d]: %sPrint fingerprint-auth contentUnable to get generated content [%d]: %sUnable to get profile information [%d]: %sUnable to read profile requirements!No requirements are specified.Unable to get profile features [%d]: %sUnable to uninstall authselect configuration [%d]: %s Name of the backup to restore from.Unable to restore backup [%s] [%d]: %s Unable to remove backup [%s] [%d]: %s Create new profile as a vendor profile instead of a custom profileID of a profile that should be used as a base for the new profileBase new profile on a default profile even if vendor profile with the same name existsSymlink meta files from the base profile instead of copying themSymlink nsswitch files from the base profile instead of copying themSymlink pam files from the base profile instead of copying themSymlink dconf files from the base profile instead of copying themSymlink specific file (can be set multiple times)Unable to create new profile [%d]: %s New profile was created at %s Print backup names without any formatting and additional informationUnable to list available backups!Unable to backup current configuration! Backup system files before activating profile (generate unique name)Backup system files before activating profileUnable to disable feature [%d]: %s Do not print profile requirementsUnable to backup current configuration [%d]: %s Unable to enable feature [%d]: %s Changes were successfully applied. Some unexpected changes to the configuration were detected. Use 'select' command instead. Unable to apply changes [%d]: %s Do not backup system files when --force is setUnable to obtain nsswitch maps! Some unexpected changes to the configuration were detected. Use --force parameter if you want to overwrite these changes. Unable to activate profile [%d]: %s The following nsswitch maps are overwritten by the profile: Unable to test current configuration [%d]: %sCurrent configuration is not valid. It was probably modified outside authselect.Current configuration is valid.System was not configured with authselect.Regenerate configuration for currently selected commandList available profile featuresGet identifier of currently selected profileCheck if the current configuration is validPrint changes that would be otherwise writtenEnable feature in currently selected profileDisable feature in currently selected profileUninstall authselect configurationactivateapply_changeslistlist_featuresshowrequirementscurrentcheckparse_profile_optionstestenabledisablecreatebackup_listbackup_removebackup_restoredebug: Unable to construct message!;$#Xl`@PPPpL`X@T`,pph0pL |p P  8 zRx /D$4FJ w?:*3$"\t<^DY8FGA F(N0 (F HBBH HHFBB B(A0A8D 8A0A(B BBBC L(hFBB E(D0D8J 8A0A(B BBBD x<HEB B(B0IL8FED A(G0 (A ABBK n(A ABBDLFMA Lw  AABE !I^AX4BBG B(D0D8NPcXK`OhFpIP 8A0A(B BBBG \4CFNB B(A0A8G 8A0A(B BBBA 1I^A<$lFCC D@k  AABA qHJPcHA@D0TXEMI@WHKPNXF`I@] AAG aHIPcHA@XxlFMA I@WHKPNXF`I@  AABF aHIP^HA@iHIP^HA@0aEAD O CAC |CA@,*FMA I0W8K@NHFPI0v  AABJ @L*FMA I0W8K@NHFPI0v  AABJ PEPIkERFILFdAb AAF \FNB B(A0A8L9 8A0A(B BBBG KdA0DBGA D0E  AABI @xYEMLERFIT AAF hFMA LERFI:  AABE aI`BKcA,(EML AAF \XCFNB B(A0A8L 8A0A(B BBBH KbB4EHI0 AAD 8I@^8A0TFLD B(A0A8D`hIp^hA`i 8A0A(B BBBI 8H]FKH G  AABA P@\'FEE D(D0G 0A(A BBBG HyH@` H K A DPeFEE E(H0H8G@n8A0A(B BBB\x(p(X Yi @ xiH P o0 h   @H ooxooo` p 0@P`p 0@P`p 0@P`pGj d[j tcj wGA$3a1@'GA*p"uiGA$annobin gcc 8.5.0 20210514GA$running gcc 8.5.0 20210514GA*GA! GA*FORTIFYGA+GLIBCXX_ASSERTIONSGA*cf_protectionGA+omit_frame_pointerGA+stack_clashGA!stack_realign GA$3p1113p"gGA$plugin name: annobin GA*GOW*GA*p"u5GA$3a1(i GA$3p11135hGA*GA$annobin gcc 8.5.0 20210514GA$plugin name: annobinGA$running gcc 8.5.0 20210514GA*GA! GA*FORTIFYGA+GLIBCXX_ASSERTIONS GA*GOW*GA*cf_protectionGA+omit_frame_pointerGA+stack_clashGA!stack_realignGA*5nfGA*pfuiGA*gh GA$3p1094iuiGA$plugin name: gcc-annobin GA*GOW* GA*FORTIFY(9hGA+GLIBCXX_ASSERTIONS GA*FORTIFY5uiGA+GLIBCXX_ASSERTIONSauthselect-1.2.6-2.el8.x86_64.debug0 7zXZִF!t/]?Eh=ڊ2N`(^ <u]sBVԼuM3#~$DrmF9m +M\OFAEɈ+kmWY:e;X*gq(\rHbU޻PS_AS±PS̞r@oQT_0޶UŰ~ڔ+Fr@,tQe’#sNLF/zq)D 3 $T$_5gWos #hJvRt'0/4H1w ,L\f-en"ër&CfQ5{a } "Ok@ .B9&(H-Ykٙp8Jꛭ~R> Œ!rg*Oԇ;w;g{ܪGio>3֯7SNi}_jQN_jXJz4{δ0Rv#@ԠpR9-RKp ]X}ID`-_μF ]^Hفt\?JSL:0 ']#sQsm]y ܧy+qo$kž (P7yRj<{T?fl 4LdpqIx!~XQ.ÒJRB.q  'vfgYZ.shstrtab.interp.note.gnu.property.note.ABI-tag.note.gnu.build-id.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.sec.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.data.rel.ro.dynamic.got.data.bss.gnu.build.attributes.gnu_debuglink.gnu_debugdata  & 4$Go008Q hhY  aonoxx}HHB@@@``p"p"Gxixi ii p}p}$~~pH HP PX X` `    ( `l L(/t|>user-nsswitch-created000064400000000000152525734240010711 0ustar00