1# 2# CDDL HEADER START 3# 4# The contents of this file are subject to the terms of the 5# Common Development and Distribution License (the "License"). 6# You may not use this file except in compliance with the License. 7# 8# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9# or http://www.opensolaris.org/os/licensing. 10# See the License for the specific language governing permissions 11# and limitations under the License. 12# 13# When distributing Covered Code, include this CDDL HEADER in each 14# file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15# If applicable, add the following below this CDDL HEADER, with the 16# fields enclosed by brackets "[]" replaced with your own identifying 17# information: Portions Copyright [yyyy] [name of copyright owner] 18# 19# CDDL HEADER END 20# 21# 22# Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23# Use is subject to license terms. 24# 25# /etc/security/policy.conf 26# 27# security policy configuration for user attributes. see policy.conf(4) 28# 29AUTHS_GRANTED=solaris.device.cdrw 30PROFS_GRANTED=Basic Solaris User 31CONSOLE_USER=Console User 32 33# crypt(3c) Algorithms Configuration 34# 35# CRYPT_ALGORITHMS_ALLOW specifies the algorithms that are allowed to 36# be used for new passwords. This is enforced only in crypt_gensalt(3c). 37# 38CRYPT_ALGORITHMS_ALLOW=1,2a,md5,5,6 39 40# To deprecate use of the traditional unix algorithm, uncomment below 41# and change CRYPT_DEFAULT= to another algorithm. For example, 42# CRYPT_DEFAULT=1 for BSD/Linux MD5. 43# 44#CRYPT_ALGORITHMS_DEPRECATE=__unix__ 45 46# The Solaris default is the traditional UNIX algorithm. This is not 47# listed in crypt.conf(4) since it is internal to libc. The reserved 48# name __unix__ is used to refer to it. 49# 50CRYPT_DEFAULT=__unix__ 51# 52# These settings determine the default privileges users have. If not set, 53# the default privileges are taken from the inherited set. 54# There are two different settings; PRIV_DEFAULT determines the default 55# set on login; PRIV_LIMIT defines the Limit set on login. 56# Individual users can have privileges assigned or taken away through 57# user_attr. Privileges can also be assigned to profiles in which case 58# the users with those profiles can use those privileges through pfexec(1). 59# For maximum future compatibility, the specifications should 60# always include "basic" or "all"; privileges should then be removed using 61# the negation. E.g., PRIV_LIMIT=all,!sys_linkdir takes away only the 62# sys_linkdir privilege, regardless of future additional privileges. 63# Similarly, PRIV_DEFAULT=basic,!file_link_any takes away only the 64# file_link_any privilege from the basic privilege set; only that notation 65# is immune from a future addition of currently unprivileged operations to 66# the basic privilege set. 67# NOTE: removing privileges from the the Limit set requires EXTREME care 68# as any set-uid root program may suddenly fail because it lacks certain 69# privilege(s). 70# 71#PRIV_DEFAULT=basic 72#PRIV_LIMIT=all 73# 74# LOCK_AFTER_RETRIES specifies the default account locking policy for local 75# user accounts (passwd(4)/shadow(4)). The default may be overridden by 76# a user's user_attr(4) "lock_after_retries" value. 77# YES enables local account locking, NO disables local account locking. 78# The default value is NO. 79# 80#LOCK_AFTER_RETRIES=NO 81