lms gets added to the shadow group

[sweist]

I'm using the debian package from debian.poupon.dev and I just noticed that during the installation the lms user is added to the shadow group. Can anyone explain to me why this is necessary? I couldn't find any reason in the documentation.

[epoupon]

AFAIR it is for LMS to be able to auth using PAM with local credentials. Will check if this is still necessary.

[sweist]

That would be great if it weren't necessary anymore. It just doesn't feel right to give LMS access to all passwords. Thanks for the quick reply.

[epoupon]

Ok, I tried experimenting with PAM.
When running with the provided lms.service and PAM configuration, lms does not have sufficient privileges to check passwords via /sbin/unix_chkpwd. It cannot fall back to reading /etc/shadow directly, which is why lms is added to the shadow group to grant read-only access to the password hashes.

I recognize that adding lms to shadow is not ideal, and it’s certainly not something that should be done by default.

I will remove this addition and update the documentation to clarify that the provided service and PAM files are just base examples: depending on the intended PAM authentication method, the service file may need to be adjusted to ensure proper privileges.

[sweist]

Thanks for looking into it. I think removing the shadow group permission in the default installation is the right thing to do,
especially since most users probably use the internal user management. Everyone else can read the documentation and tweak the configuration accordingly.