login.defs(5)           File Formats and Configuration           login.defs(5)

<?><?><?>
       login.defs - <?><?><?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?>
       <?><?><?><?><?><?><?> <?><?><?><?><?><?><?>

<?><?><?><?><?><?><?><?>
       The /etc/login.defs file defines the site-specific configuration for
       the shadow password suite. This file is required. Absence of this file
       will not prevent system operation, but will probably result in
       undesirable operation.

       <?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?>
       <?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?> <?><?><?><?>;
       <?><?><?><?><?><?> <?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?>
       <?><?><?><?> <?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?>.
       <?><?><?><?><?><?> <?><?><?><?><?><?><?> <?><?>
       <?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?> <?> <?><?><?>
       <?><?><?><?><?><?><?><?>, <?><?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?>. <?><?><?><?><?><?> <?><?><?><?><?><?> <?>
       <?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?><?>.
       <?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?> <?><?>
       <?><?><?><?><?> <?><?><?><?><?> <<#>>, <?><?><?><?><?><?><?>
       <?><?><?><?><?><?> <?><?><?><?> <?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?> <?>
       <?><?><?><?><?><?>.

       Parameter values may be of four types: strings, booleans, numbers, and
       long numbers. A string is comprised of any printable characters. A
       boolean should be either the value yes or no. An undefined boolean
       parameter or one with a value other than these will be given a no
       value. Numbers (both regular and long) may be either decimal values,
       octal values (precede the value with 0) or hexadecimal values (precede
       the value with 0x). The maximum value of the regular and long numeric
       parameters is machine-dependent.

       This configuration file controls the behavior of system tools for user
       and group management. The parameters may be used by shadow-utils
       programs, PAM modules, and other system components. The actual behavior
       depends on the system configuration and which authentication mechanisms
       are enabled.

       <?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?>:

       CHFN_RESTRICT (string)
           This parameter specifies which values in the gecos field of the
           /etc/passwd file may be changed by regular users using the chfn
           program. It can be any combination of letters f, r, w, h, for Full
           name, Room number, Work phone, and Home phone, respectively. For
           backward compatibility, yes is equivalent to rwh and no is
           equivalent to frwh. If not specified, only the superuser can make
           any changes. The most restrictive setting is better achieved by not
           installing chfn SUID.

       CREATE_HOME (boolean)
           <?><?><?><?><?><?><?><?><?><?>, <?><?><?><?><?><?> <?><?>
           <?><?><?><?><?><?><?><?><?><?><?> <?><?>
           <?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?> <?><?><?> <?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?><?>.

           <?><?><?> <?><?><?><?><?><?><?><?><?><?> <?><?> <?><?><?><?><?><?>
           <?><?> <?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?><?> <?> <?><?><?><?><?>
           <?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?><?><?><?> <?><?>
           <?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?>.

       DEFAULT_HOME (boolean)
           <?><?><?><?><?><?><?><?><?><?>, <?><?><?><?><?> <?><?>
           <?><?><?><?><?> <?> <?><?><?><?><?><?><?>, <?><?><?><?>
           <?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?> cd <?>
           <?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?>. <?><?>
           <?><?><?><?><?><?><?><?><?> <<no>>.

           If set to yes, the user will login in the root (/) directory if it
           is not possible to cd to her home directory.

       ENCRYPT_METHOD (string)
           This defines the system default encryption algorithm for encrypting
           passwords (if no algorithm is specified on the command line).

           It can take one of these values: SHA256, SHA512 (default),
           YESCRYPT. See crypt(5) for recommendations.

           Note: this only affects the generation of group passwords. The
           generation of user passwords is done by PAM and subject to the PAM
           configuration. It is recommended to set this variable consistently
           with the PAM configuration.

           History: This variable is used by other programs, which may still
           default to unsafe algorithms such as DES. To avoid using unsafe
           algorithms, the variable should always be specified.

       ENV_PATH (string)
           If set, it will be used to define the PATH environment variable
           when a regular user login. The value is a colon separated list of
           paths (for example /bin:/usr/bin) and can be preceded by PATH=. The
           default value is PATH=/bin:/usr/bin.

       ENV_SUPATH (string)
           If set, it will be used to define the PATH environment variable
           when the superuser login. The value is a colon separated list of
           paths (for example /sbin:/bin:/usr/sbin:/usr/bin) and can be
           preceded by PATH=. The default value is
           PATH=/sbin:/bin:/usr/sbin:/usr/bin.

       FAIL_DELAY (number)
           <?><?><?><?><?><?><?><?> <?> <?><?><?><?><?><?><?><?>
           <?><?><?><?><?> <?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?> <?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?>.

       GID_MAX (number), GID_MIN (number)
           Range of group IDs used for the creation of regular groups by
           useradd, groupadd, or newusers.

           The default value for GID_MIN (resp.  GID_MAX) is 1000 (resp.
           60000).

       HOME_MODE (number)
           The mode for new home directories. If not specified, the UMASK is
           used to create the mode.

           useradd and newusers use this to set the mode of the home directory
           they create.

       HUSHLOGIN_FILE (string)
           <?><?><?><?> <?><?><?><?><?><?><?><?><?><?>, <?><?> <?><?><?><?>
           <?><?><?><?> <?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?>
           <?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?> (chatter)
           <?><?><?> <?><?><?><?><?>. <?><?><?><?> <?><?><?><?><?><?>
           <?><?><?><?><?><?> <?><?><?><?> <?> <?><?><?><?><?>, <?><?>
           <?><?><?><?><?> <?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?> (hushed) <?><?><?><?><?>,
           <?><?><?><?> <?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?><?>
           <?><?><?> <?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?>
           <?><?><?><?><?><?><?><?>. <?><?><?><?> <?><?><?><?><?><?> <?><?>
           <?><?><?><?><?><?> <?><?><?><?>, <?><?> <?><?><?><?><?>
           <?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?> (hushed)
           <?><?><?><?><?>, <?><?><?><?> <?><?><?><?>
           <?><?><?><?><?><?><?><?><?> <?> <?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?><?>.

       LASTLOG_UID_MAX (number)
           Highest user ID number for which the lastlog entries should be
           updated. As higher user IDs are usually tracked by remote user
           identity and authentication services there is no need to create a
           huge sparse lastlog file for them.

           No LASTLOG_UID_MAX option present in the configuration means that
           there is no user ID limit for writing lastlog entries.

       LOG_UNKFAIL_ENAB (boolean)
           <?><?><?><?><?><?><?><?> <?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?>
           <?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?> <?><?><?><?><?>.

           <?><?><?><?><?><?><?><?><?>:
           <?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?>
           <?><?><?><?><?><?><?><?> <?> <?><?><?><?><?><?><?><?><?> <?>
           <?><?><?><?><?><?><?><?><?><?><?><?><?>, <?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?>
           <?><?><?><?> <?><?><?><?><?><?> <?><?><?><?><?><?>
           <?><?><?><?><?><?> <?><?><?><?><?>.

       LOGIN_RETRIES (number)
           <?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?> <?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?>.

           <?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?> <?><?><?>
           <?><?><?><?><?><?><?><?> <?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?><?><?> PAM, <?><?><?> <?><?><?>
           <?><?> <?><?><?><?><?><?><?><?><?> <?> <?><?><?><?><?><?> pam_unix
           <?><?><?><?><?><?><?><?><?><?> 3 <?><?><?><?><?><?><?>.
           <?><?><?><?><?><?>, <?><?><?> <?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?>, <?><?><?><?>
           <?><?> <?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?><?><?>, <?><?><?><?><?><?><?>
           <?><?> <?><?><?><?><?><?><?><?><?> PAM_MAXTRIES.

       LOGIN_TIMEOUT (number)
           <?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?> <?>
           <?><?><?><?><?><?><?><?>, <?><?><?><?><?><?><?><?><?><?> <?><?>
           <?><?><?><?>.

       MAIL_DIR (string)
           The mail spool directory. This is needed to manipulate the mailbox
           when its corresponding user account is modified or deleted. If not
           specified, a compile-time default is used. The parameter
           CREATE_MAIL_SPOOL in /etc/default/useradd determines whether the
           mail spool should be created.

       MAIL_FILE (string)
           <?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?> <?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?>.

       The MAIL_DIR and MAIL_FILE variables are used by useradd, usermod, and
       userdel to create, move, or delete the user's mail spool.

       MAX_MEMBERS_PER_GROUP (number)
           Maximum members per group entry. When the maximum is reached, a new
           group entry (line) is started in /etc/group (with the same name,
           same password, and same GID).

           <?><?><?><?><?><?><?><?> <?><?> <?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?> 0, <?><?><?><?><?><?><?><?><?><?>, <?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?> <?><?>
           <?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?> <?>
           <?><?><?><?><?><?> <?><?><?>.

           <?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?>
           (<?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?>)
           <?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?> <?><?><?><?><?> <?> <?><?><?><?><?>
           <?><?><?><?><?>. <?><?><?> <?><?><?><?><?><?><?> <?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?>
           <?><?><?><?><?> NIS <?> 1024 <?><?><?><?><?><?><?>.

           <?><?><?><?> <?><?><?> <?><?><?><?><?> <?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?>, <?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?> 25.

           <?><?><?><?><?><?><?><?><?>: <?><?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?><?><?><?> <?><?>
           <?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?><?><?>
           (<?><?><?><?> <?> <?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?> Shadow). <?><?> <?><?>
           <?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?>
           <?><?><?><?><?><?><?><?><?><?>, <?><?><?><?> <?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?>
           <?><?><?><?><?><?><?>.

       NONEXISTENT (string)
           If a system account intentionally does not have a home directory
           that exists, this string can be provided in the /etc/passwd entry
           for the account to indicate this. The result is that pwck will not
           emit a spurious warning for this account.

       PASS_MAX_DAYS (number)
           <?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?>.
           <?><?><?><?> <?><?><?><?><?><?> <?><?><?><?><?><?> <?><?><?><?><?>
           <?><?><?><?><?>, <?><?> <?><?><?><?><?> <?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?>.
           <?><?><?><?> <?><?><?><?><?><?><?><?> <?><?> <?><?><?><?><?><?>,
           <?><?> <?><?><?><?><?><?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?> -1 (<?><?> <?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?>
           <?><?> <?><?><?><?><?><?><?><?><?><?><?><?>).

       PASS_WARN_AGE (number)
           The number of days warning given before a password expires. A zero
           means warning is given only upon the day of expiration, a value of
           -1 means no warning is given. If not specified, no warning will be
           provided.

       PASS_MAX_DAYS, and PASS_WARN_AGE are only used at the time of account
       creation. Any changes to these settings won't affect existing accounts.

       SHA_CRYPT_MIN_ROUNDS (number), SHA_CRYPT_MAX_ROUNDS (number)
           When ENCRYPT_METHOD is set to SHA256 or SHA512, this defines the
           number of SHA rounds used by the encryption algorithm by default
           (when the number of rounds is not specified on the command line).

           With a lot of rounds, it is more difficult to brute force the
           password. But note also that more CPU resources will be needed to
           authenticate users.

           If not specified, the libc will choose the default number of rounds
           (5000), which is orders of magnitude too low for modern hardware.

           <?><?><?><?><?><?><?><?> <?><?><?><?><?><?> <?><?><?><?><?><?> <?>
           <?><?><?><?><?><?><?><?><?> 1000-999999999.

           If only one of the SHA_CRYPT_MIN_ROUNDS or SHA_CRYPT_MAX_ROUNDS
           values is set, then this value will be used.

           If SHA_CRYPT_MIN_ROUNDS > SHA_CRYPT_MAX_ROUNDS, the highest value
           will be used.

           Note: this only affect the generation of group passwords. The
           generation of user passwords is done by PAM and subject to the PAM
           configuration. It is recommended to set this variable consistently
           with the PAM configuration.

       SUB_GID_MIN (number), SUB_GID_MAX (number), SUB_GID_COUNT (number)
           If /etc/subuid exists, the commands useradd and newusers (unless
           the user already have subordinate group IDs) allocate SUB_GID_COUNT
           unused group IDs from the range SUB_GID_MIN to SUB_GID_MAX for each
           new user.

           The default values for SUB_GID_MIN, SUB_GID_MAX, SUB_GID_COUNT are
           respectively 100000, 600100000 and 65536.

       SUB_GID_DETERMINISTIC (boolean)
           If set to yes, the commands useradd, usermod, and newusers will
           calculate subordinate GID ranges deterministically based on the
           user's UID instead of searching for the next free range. The
           formula used is:

                     start = SUB_GID_MIN + ((UID - UID_MIN) * SUB_GID_COUNT)
                     end   = start + SUB_GID_COUNT - 1


           This ensures the same UID always receives the same subordinate GID
           range on every system, making it suitable for environments with
           centralized user management (LDAP, NIS, etc.) or synchronized UIDs
           across systems.

           If SUB_GID_DETERMINISTIC is enabled, you can use usermod
           --add-subgids -S to produce deterministic subgids.

           WARNING: Because UID_MIN is used to calculate the ranges, any
           change of UID_MIN will change the ranges calculated.  SUB_GID_COUNT
           is used to calculate the ranges, any change of SUB_GID_COUNT will
           change the ranges calculated. Users with identities less than
           UID_MIN are incompatible with SUB_GID_DETERMINISTIC, but can still
           be set manually.

           WARNING: Do not mix deterministic and linear (default) allocation
           on the same system or across systems sharing /etc/subgid via
           network storage (NFS, etc.). Mixing allocation methods  will cause
           subordinate ID range conflicts and overlaps .

           The default value for SUB_GID_DETERMINISTIC is no.

   Range Calculation Examples
       With default configuration (UID_MIN=1000, SUB_GID_MIN=100000,
       SUB_GID_COUNT=65536):

       +-----+----------------+-----------------+
       |UID  | Calculation    | Subordinate GID |
       |     |                | Range           |
       +-----+----------------+-----------------+
       |1000 | 100000 +       | 100000-165535   |
       |     | ((1000-1000) * |                 |
       |     | 65536)         |                 |
       +-----+----------------+-----------------+
       |1001 | 100000 +       | 165536-231071   |
       |     | ((1001-1000) * |                 |
       |     | 65536)         |                 |
       +-----+----------------+-----------------+
       |1002 | 100000 +       | 231072-296607   |
       |     | ((1002-1000) * |                 |
       |     | 65536)         |                 |
       +-----+----------------+-----------------+
       |1100 | 100000 +       | 6653600-6719135 |
       |     | ((1100-1000) * |                 |
       |     | 65536)         |                 |
       +-----+----------------+-----------------+

   Subordinate ID Space Planning
       When planning subordinate ID allocation, calculate the maximum number
       of users the space can accommodate:

                 capacity = (SUB_GID_MAX - SUB_GID_MIN) / SUB_GID_COUNT


       With default values: (600100000 - 100000) / 65536 ~~ 9155 users.

       For high-density environments with many users and smaller allocations:

                   SUB_GID_COUNT  4096
                   SUB_GID_MIN    100000
                   SUB_GID_MAX    10000000


       This gives: (10000000 - 100000) / 4096 ~~ 2417 users.

       UNSAFE_SUB_GID_DETERMINISTIC_WRAP (boolean)
            WARNING: SECURITY RISK - MAY CAUSE RANGE OVERLAPS AND PRIVILEGE
           ESCALATION!

           Only effective when SUB_GID_DETERMINISTIC is set to yes.

           When set to yes (WRAP MODE), allows the deterministic range
           calculation to wrap around using modulo arithmetic when a UID would
           overflow the configured subordinate ID space. The subordinate ID
           space is treated as a ring buffer.

           WARNING: Range overlaps can lead to container escapes and privilege
           escalation. For example, with SUB_GID_MIN=100000,
           SUB_GID_MAX=200000, SUB_GID_COUNT=65536, User A (UID 1000) gets
           range [100000, 165535] and User B (UID 1001) wraps and overlaps
           with User A. User B's container can now access files from User A's
           containers.

           Use only in development, testing, or tightly constrained lab
           environments.

           When set to no (default), any arithmetic overflow or range
           exceeding SUB_GID_MAX is a hard error. This guarantees
           non-overlapping, monotonic allocation.

           The default value for UNSAFE_SUB_GID_DETERMINISTIC_WRAP is no.

       SUB_GID_STORE_BY_UID (boolean)
           If set to yes, subordinate group ID entries in /etc/subgid are
           stored using the numeric user ID rather than the username. The
           default value is no.

       SUB_UID_MIN (number), SUB_UID_MAX (number), SUB_UID_COUNT (number)
           If /etc/subuid exists, the commands useradd and newusers (unless
           the user already have subordinate user IDs) allocate SUB_UID_COUNT
           unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each
           new user.

           The default values for SUB_UID_MIN, SUB_UID_MAX, SUB_UID_COUNT are
           respectively 100000, 600100000 and 65536.

       SUB_UID_DETERMINISTIC (boolean)
           If set to yes, the commands useradd, usermod, and newusers will
           calculate subordinate UID ranges deterministically based on the
           user's UID instead of searching for the next free range. The
           formula used is:

                     start = SUB_UID_MIN + ((UID - UID_MIN) * SUB_UID_COUNT)
                     end   = start + SUB_UID_COUNT - 1


           This ensures the same UID always receives the same subordinate UID
           range on every system, making it suitable for environments with
           centralized user management (LDAP, NIS, etc.) or synchronized UIDs
           across systems.

           If SUB_UID_DETERMINISTIC is enabled, you can use usermod
           --add-subuids -S to produce deterministic subuids.

           WARNING: Because UID_MIN is used to calculate the ranges, any
           change of UID_MIN will change the ranges calculated.  SUB_UID_COUNT
           is used to calculate the ranges, any change of SUB_UID_COUNT will
           change the ranges calculated. Users with identities less than
           UID_MIN are incompatible with SUB_UID_DETERMINISTIC, but can still
           be set manually.

           WARNING: Do not mix deterministic and linear (default) allocation
           on the same system or across systems sharing /etc/subuid via
           network storage (NFS, etc.). Mixing allocation methods  will cause
           subordinate ID range conflicts and overlaps .

           The default value for SUB_UID_DETERMINISTIC is no.

   Range Calculation Examples
       With default configuration (UID_MIN=1000, SUB_UID_MIN=100000,
       SUB_UID_COUNT=65536):

       +-----+----------------+-----------------+
       |UID  | Calculation    | Subordinate UID |
       |     |                | Range           |
       +-----+----------------+-----------------+
       |1000 | 100000 +       | 100000-165535   |
       |     | ((1000-1000) * |                 |
       |     | 65536)         |                 |
       +-----+----------------+-----------------+
       |1001 | 100000 +       | 165536-231071   |
       |     | ((1001-1000) * |                 |
       |     | 65536)         |                 |
       +-----+----------------+-----------------+
       |1002 | 100000 +       | 231072-296607   |
       |     | ((1002-1000) * |                 |
       |     | 65536)         |                 |
       +-----+----------------+-----------------+
       |1100 | 100000 +       | 6653600-6719135 |
       |     | ((1100-1000) * |                 |
       |     | 65536)         |                 |
       +-----+----------------+-----------------+

   Subordinate ID Space Planning
       When planning subordinate ID allocation, calculate the maximum number
       of users the space can accommodate:

                 capacity = (SUB_UID_MAX - SUB_UID_MIN) / SUB_UID_COUNT


       With default values: (600100000 - 100000) / 65536 ~~ 9155 users.

       For high-density environments with many users and smaller allocations:

                   SUB_UID_COUNT  4096
                   SUB_UID_MIN    100000
                   SUB_UID_MAX    10000000


       This gives: (10000000 - 100000) / 4096 ~~ 2417 users.

       UNSAFE_SUB_UID_DETERMINISTIC_WRAP (boolean)
            WARNING: SECURITY RISK - MAY CAUSE RANGE OVERLAPS AND PRIVILEGE
           ESCALATION!

           Only effective when SUB_UID_DETERMINISTIC is set to yes.

           When set to yes (WRAP MODE), allows the deterministic range
           calculation to wrap around using modulo arithmetic when a UID would
           overflow the configured subordinate ID space. The subordinate ID
           space is treated as a ring buffer.

           WARNING: Range overlaps can lead to container escapes and privilege
           escalation. For example, with SUB_UID_MIN=100000,
           SUB_UID_MAX=200000, SUB_UID_COUNT=65536, User A (UID 1000) gets
           range [100000, 165535] and User B (UID 1001) wraps and overlaps
           with User A. User B's container can now access files from User A's
           containers.

           Use only in development, testing, or tightly constrained lab
           environments.

           When set to no (default), any arithmetic overflow or range
           exceeding SUB_UID_MAX is a hard error. This guarantees
           non-overlapping, monotonic allocation.

           The default value for UNSAFE_SUB_UID_DETERMINISTIC_WRAP is no.

       SUB_UID_STORE_BY_UID (boolean)
           If set to yes, subordinate user ID entries in /etc/subuid are
           stored using the numeric user ID rather than the username. The
           default value is no.

       SYS_GID_MAX (number), SYS_GID_MIN (number)
           Range of group IDs used for the creation of system groups by
           useradd, groupadd, or newusers.

           The default value for SYS_GID_MIN (resp.  SYS_GID_MAX) is 101
           (resp.  GID_MIN-1).

       SYS_UID_MAX (number), SYS_UID_MIN (number)
           Range of user IDs used for the creation of system users by useradd
           or newusers.

           The default value for SYS_UID_MIN (resp.  SYS_UID_MAX) is 101
           (resp.  UID_MIN-1).

       SYSLOG_SG_ENAB (boolean)
           Enable "syslog" logging of sg activity.

       TTYGROUP (string), TTYPERM (number)
           The terminal permissions: the login tty will be owned by the
           TTYGROUP group, and the permissions will be set to TTYPERM.

           TTYGROUP can be either the name of a group or a numeric group
           identifier.

           If TTYGROUP is not defined, then the group ownership of the
           terminal is set to the user's primary group. If TTYPERM is not
           defined, then the permissions are set to 0600.

           If you have a write program which is "setgid" to a special group
           which owns the terminals, define TTYGROUP to the group number and
           TTYPERM to 0620. Otherwise leave TTYGROUP commented out and assign
           TTYPERM to either 622 or 600.

       UID_MAX (number), UID_MIN (number)
           Range of user IDs used for the creation of regular users by useradd
           or newusers.

           The default value for UID_MIN (resp.  UID_MAX) is 1000 (resp.
           60000).

       UMASK (number)
           <?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?><?>
           <?><?><?> <?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?>.
           <?><?><?><?> <?><?> <?><?><?><?><?><?><?>, <?><?> <?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?><?><?><?> <?> 022.

           useradd and newusers use this mask to set the mode of the home
           directory they create if HOME_MODE is not set.

           It is also used by pam_umask as the default umask value.

       USERDEL_CMD (string)
           <?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?>,
           <?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?><?><?>
           <?><?><?> <?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?>. <?><?><?> <?><?><?><?><?><?>
           <?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?><?>
           at/cron/<?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?>
           (<?><?><?><?><?><?><?><?><?><?> <?> <?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?>).

           <?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?>
           <?><?><?> <?><?><?><?><?><?><?><?><?><?> <?><?>
           <?><?><?><?><?><?><?><?><?><?><?>.

           Here is an example script, which removes the user's cron, at and
           print jobs:

               #! /bin/sh

               # Check for the required argument.
               if [ $# != 1 ]; then
                    echo "Usage: $0 username"
                    exit 1
               fi

               # Remove cron jobs.
               crontab -r -u $1

               # Remove at jobs.
               # Note that it will remove any jobs owned by the same UID,
               # even if it was shared by a different username.
               AT_SPOOL_DIR=/var/spool/cron/atjobs
               find $AT_SPOOL_DIR -name "[^.]*" -type f -user $1 -delete \;

               # Remove print jobs.
               lprm $1

               # All done.
               exit 0



       USERGROUPS_ENAB (boolean)
           If set to yes, userdel will remove the user's group if it contains
           no more members, and useradd will create by default a group with
           the name of the user.

       YESCRYPT_COST_FACTOR (number)
           When ENCRYPT_METHOD is set to YESCRYPT, this defines the cost
           factor used by the encryption algorithm by default (when the cost
           factor is not specified on the command line).

           With a high cost factor, it is more difficult to brute force the
           password. But note also that more CPU resources will be needed to
           authenticate users.

           The value must be inside the 1-11 range.

           Note: this only affect the generation of group passwords. The
           generation of user passwords is done by PAM and subject to the PAM
           configuration. It is recommended to set this variable consistently
           with the PAM configuration.

<?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?><?>
       <?><?><?><?><?><?> <?><?><?><?><?><?><?><?> <?><?><?><?><?>
       <?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?> <?> <?><?>
       <?><?><?><?><?><?><?><?><?><?> <?><?> <?><?><?><?><?><?> <?><?><?>
       <?><?><?><?><?><?> <?> <?><?><?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?>.

       chfn
           CHFN_RESTRICT

       chgpasswd
           ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP SHA_CRYPT_MAX_ROUNDS
           SHA_CRYPT_MIN_ROUNDS YESCRYPT_COST_FACTOR

       chpasswd
           SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS YESCRYPT_COST_FACTOR

       gpasswd
           ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP SHA_CRYPT_MAX_ROUNDS
           SHA_CRYPT_MIN_ROUNDS YESCRYPT_COST_FACTOR

       groupadd
           GID_MAX GID_MIN MAX_MEMBERS_PER_GROUP SYS_GID_MAX SYS_GID_MIN

       groupdel
           MAX_MEMBERS_PER_GROUP

       groupmod
           MAX_MEMBERS_PER_GROUP

       grpck
           MAX_MEMBERS_PER_GROUP

       grpconv
           MAX_MEMBERS_PER_GROUP

       grpunconv
           MAX_MEMBERS_PER_GROUP

       lastlog
           LASTLOG_UID_MAX

       newgrp / sg
           SYSLOG_SG_ENAB

       newusers
           ENCRYPT_METHOD GID_MAX GID_MIN MAX_MEMBERS_PER_GROUP HOME_MODE
           PASS_MAX_DAYS PASS_WARN_AGE SHA_CRYPT_MAX_ROUNDS
           SHA_CRYPT_MIN_ROUNDS SUB_GID_COUNT SUB_GID_MAX SUB_GID_MIN
           SUB_GID_DETERMINISTIC SUB_GID_STORE_BY_UID SUB_UID_COUNT
           SUB_UID_MAX SUB_UID_MIN SUB_UID_DETERMINISTIC SUB_UID_STORE_BY_UID
           SYS_GID_MAX SYS_GID_MIN SYS_UID_MAX SYS_UID_MIN UID_MAX UID_MIN
           UMASK UNSAFE_SUB_GID_DETERMINISTIC_WRAP
           UNSAFE_SUB_UID_DETERMINISTIC_WRAP YESCRYPT_COST_FACTOR

       pwck
           PASS_MAX_DAYS PASS_WARN_AGE

       pwconv
           PASS_MAX_DAYS PASS_WARN_AGE

       useradd
           CREATE_HOME GID_MAX GID_MIN HOME_MODE LASTLOG_UID_MAX MAIL_DIR
           MAX_MEMBERS_PER_GROUP PASS_MAX_DAYS PASS_WARN_AGE SUB_GID_COUNT
           SUB_GID_MAX SUB_GID_MIN SUB_GID_DETERMINISTIC SUB_GID_STORE_BY_UID
           SUB_UID_COUNT SUB_UID_MAX SUB_UID_MIN SUB_UID_DETERMINISTIC
           SUB_UID_STORE_BY_UID SYS_GID_MAX SYS_GID_MIN SYS_UID_MAX
           SYS_UID_MIN UID_MAX UID_MIN UMASK UNSAFE_SUB_GID_DETERMINISTIC_WRAP
           UNSAFE_SUB_UID_DETERMINISTIC_WRAP

       userdel
           MAIL_DIR MAIL_FILE MAX_MEMBERS_PER_GROUP USERDEL_CMD
           USERGROUPS_ENAB

       usermod
           LASTLOG_UID_MAX MAIL_DIR MAIL_FILE MAX_MEMBERS_PER_GROUP
           SUB_GID_COUNT SUB_GID_MAX SUB_GID_MIN SUB_GID_DETERMINISTIC
           SUB_UID_COUNT SUB_UID_MAX SUB_UID_MIN SUB_UID_DETERMINISTIC
           UNSAFE_SUB_GID_DETERMINISTIC_WRAP UNSAFE_SUB_UID_DETERMINISTIC_WRAP

<?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?>
       Much of the functionality that used to be provided by the shadow
       password suite is now handled by PAM. Thus, /etc/login.defs is no
       longer used by passwd(1), or less used by login(1), and su(1). Please
       refer to the corresponding PAM configuration files instead.

<?><?><?><?><?><?><?><?> <?><?><?><?><?>
       login(1), passwd(1), su(1), passwd(5), shadow(5), pam(8).

shadow-utils 4.20.0               07/30/2026                     login.defs(5)