Skip to content

Releases: shadow-maint/shadow

4.19.2

19 Jan 13:32
@alejandro-colomar alejandro-colomar
4.19.2
a7eca27

Choose a tag to compare

View all tags
4.19.2 Latest
Latest

shadow-4.19.2

Regression fixes:

  • usermod(8):
    • Revert an incorrect commit.
      See #1509
      and #1510.
Assets 6
Loading

4.19.1

18 Jan 22:08
@alejandro-colomar alejandro-colomar
4.19.1
167a6b7

Choose a tag to compare

View all tags
4.19.1

shadow-4.19.1

Regression fixes:

  • chpasswd(8):
    • Don't reject leading '!' in password hashes or a hash consisting
      of "*". These were accidentally rejected in 4.19.0.
      See #1483
      and #1486.
    • Don't reject a passwordless account ("" or "!").
      See #1483 (comment)
      and #1505.
Loading

4.19.0: Herve

30 Dec 17:09
@hallyn hallyn
4.19.0
This tag was signed with the committer’s verified signature.
hallyn Serge Hallyn
GPG key ID: 3570DA17270ACE24
Verified
Learn about vigilant mode.
d7ce7e8

Choose a tag to compare

View all tags
4.19.0: Herve

Release 4.19.0

Breaking changes:

  • Remove support for escaped newlines in configuration files.
    It never worked correctly.
    b0a7ce5 (2025-12-05; "lib/, po/: Remove fgetsx() and fputsx()")

  • Some user names and group names are too dangerous and are rejected,
    even with --badname.
    25aea74 (2025-12-25; "lib/chkname.c, src/: Strictly disallow really bad names")

Future breaking changes:

  • SHA512 and SHA256 will be supported unconditionally in the next
    release. The build-time flag '--with-sha-crypt' will be removed.
    See #1452.

Support:

  • Several years ago, there were talks about deprecating su(1) and
    login(1), back when this project was maintained as part of Debian.
    However, nothing was clearly stated, and there were doubts about the
    status of these programs. Let's clarify them now.

    Our implementations of su(1) and login(1) are fully supported, and we
    don't have any plans to remove them. They are NOT deprecated.
    See #464.

Deprecations:

  • groupmems(8)
    The program will be removed in a future release.
    See #1343.

  • logoutd(8)
    The program will be removed in the next release.
    See #999,
    and #1344.

  • DES
    This hashing algorithm has been deprecated for a long time,
    and support for it will be removed in a future release.
    See #1456

  • MD5
    This hashing algorithm has been deprecated for a long time,
    and support for it will be removed in a future release.
    See #1457

  • login.defs(5): MD_CRYPT_ENAB
    This feature had been deprecated for decades. It will be
    removed in a future release.
    The command-line equivalents (-m, --md5) of this feature in
    chpasswd(8) and chgpasswd(8) will also be removed in a future
    release.
    See #1455.

  • login.defs(5): PASS_MAX_LEN
    This feature is ignored except for DES. Once DES is removed,
    it makes no sense keeping it. It may be removed in a future
    release.

  • Password aging
    Scientific research shows that periodic password expiration
    leads to predictable password patterns, and that even in a
    theoretical scenario where that wouldn't happen the gains in
    security are mathematically negligible.
    https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf

    Modern security standards, such as NIST SP 800-63B-4 in the USA,
    prohibit periodic password expiration.
    https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver
    https://pages.nist.gov/800-63-FAQ/#q-b05
    https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry

    To align with these, we're deprecating the ability to
    periodically expire passwords. The specifics and long-term
    roadmap are currently being discussed, and we invite feedback
    from users, particularly from those in regulated environments.
    See #1432.

    This deprecation includes the following programs and features:

     expiry(1)
 chage(1):
         -I,--inactive (also the interactive version)
         -m,--mindays (also the interactive version)
         -M,--maxdays (also the interactive version)
         -W,--warndays (also the interactive version)
 passwd(1):
         -k,--keep-tokens
         -n,--mindays
         -x,--maxdays
         -i,--inactive
         -w,--warndays
 useradd(8):
         -f,--inactive
 usermod(8):
         -f,--inactive
 login.defs(5):
         PASS_MIN_DAYS
         PASS_MAX_DAYS
         PASS_WARN_AGE
 /etc/default/useradd:
         INACTIVE
 shadow(5):
         sp_lstchg: Restrict to just the values 0 and empty.
         sp_min
         sp_max
         sp_warn
         sp_inact

    We recognize that many users operate in environments with
    regulatory or contractual requirements that still mandate
    password aging. To minimize disruption, these features will
    remain functional for a significant period. However, we
    encourage administrators to review their internal policies,
    talk to their regulators if appropriate, and participate in the
    roadmap discussion linked above.

Loading

herve rc1

07 Dec 16:55
@hallyn hallyn
4.19.0-rc1
This tag was signed with the committer’s verified signature.
hallyn Serge Hallyn
GPG key ID: 3570DA17270ACE24
Verified
Learn about vigilant mode.
5a5b776

Choose a tag to compare

View all tags
herve rc1 Pre-release
Pre-release

What's Changed

New Contributors

Full Changelog: 4.18.0...4.19.0-rc1

Contributors

terceiro, AndersBlomdell, and 10 other contributors
Loading

4.18.0: Gorgonzola

24 Jun 20:40
@hallyn hallyn
4.18.0
This tag was signed with the committer’s verified signature.
hallyn Serge Hallyn
GPG key ID: 3570DA17270ACE24
Verified
Learn about vigilant mode.
045652a

Choose a tag to compare

View all tags
4.18.0: Gorgonzola

What's Changed

New Contributors

Full Changelog: 4.17.4...4.18.0

Contributors

zeha, hallyn, and 6 other contributors
Loading

4.18.0-rc2

23 Jun 17:41
@hallyn hallyn
4.18.0-rc2
This tag was signed with the committer’s verified signature.
hallyn Serge Hallyn
GPG key ID: 3570DA17270ACE24
Verified
Learn about vigilant mode.
8c3aa0c

Choose a tag to compare

View all tags
4.18.0-rc2 Pre-release
Pre-release

This is a pre-release for last minute testing. 4.18.0-rc1 appeared to go smoothly, so I expect no issues. We expect to release 4.18.0 tomorrow.

What's Changed

New Contributors

Full Changelog: 4.17.4...4.18.0-rc2

Contributors

zeha, hallyn, and 6 other contributors
Loading

Pre-release 4.18.0-rc1

08 Jun 18:29
@hallyn hallyn
4.18.0-rc1
This tag was signed with the committer’s verified signature.
hallyn Serge Hallyn
GPG key ID: 3570DA17270ACE24
Verified
Learn about vigilant mode.
a1a7f52

Choose a tag to compare

View all tags
Pre-release 4.18.0-rc1 Pre-release
Pre-release

This is a pre-release for testing by distributions. New release to follow later this month.

Loading

Release 4.17.4

19 Mar 19:12
@hallyn hallyn
4.17.4
This tag was signed with the committer’s verified signature.
hallyn Serge Hallyn
GPG key ID: 3570DA17270ACE24
Verified
Learn about vigilant mode.
b23a582

Choose a tag to compare

View all tags
Release 4.17.4 
Changes since 4.17.3:

Alejandro Colomar (12):
      Revert "lib/, src/: Use local time for human-readable dates"
      lib/getdate.y: Ignore time-zone information and use UTC
      src/chfn.c: Partially revert "lib/, src/: Use strsep(3) instead of its pattern"
      src/chfn.c: Use stpsep() instead of its pattern
      src/chfn.c: Add local variable to refer to the separated field
      src/chfn.c: copy_field(): Rename local variable
      lib/commonio.c: Rely on the POSIX.1-2008 behavior of realpath(3)
      lib/fs/readlink/: readlinknul(): Use ssize_t to simplify
      autogen.sh: Promote -Wsign-compare to an error
      lib/sizeof.h: ssizeof(): Add signed variant of sizeof
      src/lastlog.c: Use ssizeof() to avoid a -Wsign-compare diagnostic
      tests/unit/test_xasprintf.c: Fix sign-mismatch diagnostic

Chris Hofstaedtler (2):
      configure.ac: stop checking for utmp location
      configure.ac: be deterministic about passwd location

Iker Pedrosa (3):
      lib/, src/: update audit messages
      lib/: audit function for groups
      src/: update group audit messages

Michael Vetter (1):
      doc/: Remove list of distributions

Serge Hallyn (1):
      release 4.17.4
Loading

4.17.3

24 Feb 14:16
@hallyn hallyn
4.17.3
This tag was signed with the committer’s verified signature.
hallyn Serge Hallyn
GPG key ID: 3570DA17270ACE24
Verified
Learn about vigilant mode.
d3fa0ba

Choose a tag to compare

View all tags
4.17.3

4.17.2 was accidentally created as an unsigned tag. 4.17.3 is created from current master branch with a signed tag.

Loading

4.17.2

11 Jan 16:00
@hallyn hallyn
4.17.2
6a2ab3d

Choose a tag to compare

View all tags
4.17.2

What's Changed

New Contributors

  • @scottdotweb made their first contribution in #1164

Full Changelog: 4.17.1...4.17.2

Contributors

zeha, kanavin, and 2 other contributors
Loading