Remove unused `logoutd` utility #1344

ikerexxe · 2025-08-25T08:00:17Z

Link: #999

Link: <shadow-maint#999> Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

alejandro-colomar · 2025-08-25T18:01:04Z

Are there 0 users of this program?

ikerexxe · 2025-08-26T07:16:03Z

AFAIK, neither Debian nor Fedora or openSUSE provide this binary. So, yeah, I'd say nobody out there is using this binary.

alejandro-colomar

Thanks! LGTM then.

Reviewed-by: Alejandro Colomar <alx@kernel.org>

CC: @thesamesam , @Karlson2k , just in case Gentoo has anything to say.

ikerexxe · 2025-08-27T10:03:22Z

Curious. I thought we had discussed this topic and decided to deprecate this utility and announced it in a release. I don't see any release announcement, so I'm fine with announcing the deprecation in the upcoming release and postponing the removal until the next one.

hallyn · 2025-09-10T13:37:16Z

@ikerexxe how should we announce it?

Putting it into the git log is probably the only way that I would remember to put it into release notes. So perhaps you should open a PR creating an API.md or DEPRECATIONS.md or something, put a dated note in there with a meaningful subject line on the git commit entry, and then the git shortlog will automatically put that into the release notes?

ikerexxe · 2025-09-10T14:14:25Z

@ikerexxe how should we announce it?

In the release notes.

Putting it into the git log is probably the only way that I would remember to put it into release notes. So perhaps you should open a PR creating an API.md or DEPRECATIONS.md or something, put a dated note in there with a meaningful subject line on the git commit entry, and then the git shortlog will automatically put that into the release notes?

I don't like this approach. When Alejandro opens the issue to create the new release I'll try to write this topic there.

alejandro-colomar · 2025-09-10T15:15:28Z

@ikerexxe how should we announce it?

In the release notes.

Putting it into the git log is probably the only way that I would remember to put it into release notes. So perhaps you should open a PR creating an API.md or DEPRECATIONS.md or something, put a dated note in there with a meaningful subject line on the git commit entry, and then the git shortlog will automatically put that into the release notes?

I don't like this approach. When Alejandro opens the issue to create the new release I'll try to write this topic there.

I've opened the release ticket. Feel free to add the deprecation notices there.

zeha · 2025-09-16T22:50:52Z

Should this also remove various references to (/etc/)porttime?

zeha · 2025-09-16T22:52:04Z

Should this also remove various references to (/etc/)porttime?

Doesn't seem super clear, maybe porttime and co wants to go away in a release after logoutd is removed.

ikerexxe · 2025-09-17T06:51:54Z

I wasn't aware of /etc/porttime, but from what I can see it isn't distributed in major distributions. I've added the deprecation to 4.19 Release plan (H).

What is this co that you mention? Any file I can check? If we aren't using it anywhere we should also remove it.

zeha · 2025-09-17T07:05:33Z

What is this co that you mention? Any file I can check? If we aren't using it anywhere we should also remove it.

Specifically I was refering to isttytime and port.[ch]. My understanding there is not complete, please check it.

ikerexxe · 2025-09-17T08:48:09Z

Those things that you mentioned are part of shadow's internal library and being used by other binaries apart from logoutd, so I think we'll keep using them (at least for the moment)

alejandro-colomar · 2025-12-06T12:29:39Z

This PR needs a rebase. :)

ikerexxe · 2025-12-09T09:51:47Z

Yes, but I don't think it's worth doing it before releasing 4.19. The removal will happen in 4.20 or later.

alejandro-colomar · 2025-12-09T13:46:44Z

Yes, but I don't think it's worth doing it before releasing 4.19. The removal will happen in 4.20 or later.

I'd like to merge it right after the release. That would remove it in 4.20, and we'd avoid applying any refactors to it during the development of 4.20.

Breaking changes: - Remove support for escaped newlines in configuration files. It never worked correctly. - Some user names and group names are too dangerous and are rejected, even with --badname. Deprecations: - groupmems(8) The program will be removed in a future release. See <shadow-maint#1343>. - logoutd(8) The program will be removed in the next release. See <shadow-maint#999>, and <shadow-maint#1344>. - Password aging The ability to periodically expire passwords is detrimental to safety, and will be removed eventually. See also: <shadow-maint#1432> <https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf> <https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver> <https://pages.nist.gov/800-63-FAQ/#q-b05> <https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry> This deprecation includes the following programs and features: expiry(1) chage(1): -I,--inactive (also the interactive version) -m,--mindays (also the interactive version) -M,--maxdays (also the interactive version) -W,--warndays (also the interactive version) passwd(1): -k,--keep-tokens -n,--mindays -x,--maxdays -i,--inactive -w,--warndays useradd(8): -f,--inactive usermod(8): -f,--inactive login.defs(5): PASS_MIN_DAYS PASS_MAX_DAYS PASS_WARN_AGE /etc/default/useradd: INACTIVE shadow(5): sp_lstchg: Restrict to just the values 0 and empty. sp_min sp_max sp_warn sp_inact Because removing all of these suddently would be too disruptive (mainly, because of contracts in regulated environments, with contracts that enforce outdated policies), we'll continue providing most of these features for a relatively long time. However, you should consider not using them, and if it doesn't depend on you, you should consider contacting whoever is responsible for it. We'll eventually and gradually remove them. Signed-off-by: Alejandro Colomar <alx@kernel.org>

Breaking changes: - Remove support for escaped newlines in configuration files. It never worked correctly. - Some user names and group names are too dangerous and are rejected, even with --badname. Future breaking changes: - SHA512 and SHA256 will be supported unconditionally in the next release. The build-time flag '--with-sha-crypt' will be removed. See <shadow-maint#1452>. Deprecations: - groupmems(8) The program will be removed in a future release. See <shadow-maint#1343>. - logoutd(8) The program will be removed in the next release. See <shadow-maint#999>, and <shadow-maint#1344>. - login.defs(5): MD_CRYPT_ENAB This feature had been deprecated for decades. It will be removed in a future release. The command-line equivalents (-m, --md5) of this feature in chpasswd(8) and chgpasswd(8) will also be removed in a future release. See <shadow-maint#1455>. - DES, MD5 These hashing algorithms have been deprecated for a long time, and support for them will be removed in a future release. - Password aging The ability to periodically expire passwords is detrimental to safety, and will be removed eventually. See also: <shadow-maint#1432> <https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf> <https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver> <https://pages.nist.gov/800-63-FAQ/#q-b05> <https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry> This deprecation includes the following programs and features: expiry(1) chage(1): -I,--inactive (also the interactive version) -m,--mindays (also the interactive version) -M,--maxdays (also the interactive version) -W,--warndays (also the interactive version) passwd(1): -k,--keep-tokens -n,--mindays -x,--maxdays -i,--inactive -w,--warndays useradd(8): -f,--inactive usermod(8): -f,--inactive login.defs(5): PASS_MIN_DAYS PASS_MAX_DAYS PASS_WARN_AGE /etc/default/useradd: INACTIVE shadow(5): sp_lstchg: Restrict to just the values 0 and empty. sp_min sp_max sp_warn sp_inact Because removing all of these suddently would be too disruptive (mainly, because of contracts in regulated environments, with contracts that enforce outdated policies), we'll continue providing most of these features for a relatively long time. However, you should consider not using them, and if it doesn't depend on you, you should consider contacting whoever is responsible for it. We'll eventually and gradually remove them. Signed-off-by: Alejandro Colomar <alx@kernel.org>

Breaking changes: - Remove support for escaped newlines in configuration files. It never worked correctly. - Some user names and group names are too dangerous and are rejected, even with --badname. Future breaking changes: - SHA512 and SHA256 will be supported unconditionally in the next release. The build-time flag '--with-sha-crypt' will be removed. See <shadow-maint#1452>. Deprecations: - groupmems(8) The program will be removed in a future release. See <shadow-maint#1343>. - logoutd(8) The program will be removed in the next release. See <shadow-maint#999>, and <shadow-maint#1344>. - login.defs(5): MD_CRYPT_ENAB This feature had been deprecated for decades. It will be removed in a future release. The command-line equivalents (-m, --md5) of this feature in chpasswd(8) and chgpasswd(8) will also be removed in a future release. See <shadow-maint#1455>. - DES This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1456> - MD5 This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1457> - Password aging The ability to periodically expire passwords is detrimental to safety, and will be removed eventually. See also: <shadow-maint#1432> <https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf> <https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver> <https://pages.nist.gov/800-63-FAQ/#q-b05> <https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry> This deprecation includes the following programs and features: expiry(1) chage(1): -I,--inactive (also the interactive version) -m,--mindays (also the interactive version) -M,--maxdays (also the interactive version) -W,--warndays (also the interactive version) passwd(1): -k,--keep-tokens -n,--mindays -x,--maxdays -i,--inactive -w,--warndays useradd(8): -f,--inactive usermod(8): -f,--inactive login.defs(5): PASS_MIN_DAYS PASS_MAX_DAYS PASS_WARN_AGE /etc/default/useradd: INACTIVE shadow(5): sp_lstchg: Restrict to just the values 0 and empty. sp_min sp_max sp_warn sp_inact Because removing all of these suddently would be too disruptive (mainly, because of contracts in regulated environments, with contracts that enforce outdated policies), we'll continue providing most of these features for a relatively long time. However, you should consider not using them, and if it doesn't depend on you, you should consider contacting whoever is responsible for it. We'll eventually and gradually remove them. Signed-off-by: Alejandro Colomar <alx@kernel.org>

Breaking changes: - Remove support for escaped newlines in configuration files. It never worked correctly. - Some user names and group names are too dangerous and are rejected, even with --badname. Future breaking changes: - SHA512 and SHA256 will be supported unconditionally in the next release. The build-time flag '--with-sha-crypt' will be removed. See <shadow-maint#1452>. Deprecations: - groupmems(8) The program will be removed in a future release. See <shadow-maint#1343>. - logoutd(8) The program will be removed in the next release. See <shadow-maint#999>, and <shadow-maint#1344>. - login.defs(5): MD_CRYPT_ENAB This feature had been deprecated for decades. It will be removed in a future release. The command-line equivalents (-m, --md5) of this feature in chpasswd(8) and chgpasswd(8) will also be removed in a future release. See <shadow-maint#1455>. - DES This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1456> - MD5 This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1457> - Password aging Security research shows that periodic password expiration leads to predictable password patterns, and that even in a theoretical scenario where that wouldn't happen the gains in security are mathematically negligible. <https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf> Modern security standards, such as NIST SP 800-63B-4 in the USA, prohibit periodic password expiration. <https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver> <https://pages.nist.gov/800-63-FAQ/#q-b05> <https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry> To align with these, we're deprecating the ability to periodically expire passwords. The specifics and long-term roadmap are currently being discussed, and we invite feedback from users, particularly from those in regulated environments. See <shadow-maint#1432>. This deprecation includes the following programs and features: expiry(1) chage(1): -I,--inactive (also the interactive version) -m,--mindays (also the interactive version) -M,--maxdays (also the interactive version) -W,--warndays (also the interactive version) passwd(1): -k,--keep-tokens -n,--mindays -x,--maxdays -i,--inactive -w,--warndays useradd(8): -f,--inactive usermod(8): -f,--inactive login.defs(5): PASS_MIN_DAYS PASS_MAX_DAYS PASS_WARN_AGE /etc/default/useradd: INACTIVE shadow(5): sp_lstchg: Restrict to just the values 0 and empty. sp_min sp_max sp_warn sp_inact We recognize that many users operate in environments with regulatory or contractual requirements that still mandate password aging. To minimize disruption, these features will remain functional for a significant period. However, we encourage administrators to review their internal policies, talk to their regulators if appropriate, and participate in the roadmap discussion linked above. Co-authored-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>

Breaking changes: - Remove support for escaped newlines in configuration files. It never worked correctly. b0a7ce5 (2025-12-05; "lib/, po/: Remove fgetsx() and fputsx()") - Some user names and group names are too dangerous and are rejected, even with --badname. 25aea74 (2025-12-25; "lib/chkname.c, src/: Strictly disallow really bad names") Future breaking changes: - SHA512 and SHA256 will be supported unconditionally in the next release. The build-time flag '--with-sha-crypt' will be removed. See <shadow-maint#1452>. Deprecations: - groupmems(8) The program will be removed in a future release. See <shadow-maint#1343>. - logoutd(8) The program will be removed in the next release. See <shadow-maint#999>, and <shadow-maint#1344>. - login.defs(5): MD_CRYPT_ENAB This feature had been deprecated for decades. It will be removed in a future release. The command-line equivalents (-m, --md5) of this feature in chpasswd(8) and chgpasswd(8) will also be removed in a future release. See <shadow-maint#1455>. - DES This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1456> - MD5 This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1457> - Password aging Security research shows that periodic password expiration leads to predictable password patterns, and that even in a theoretical scenario where that wouldn't happen the gains in security are mathematically negligible. <https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf> Modern security standards, such as NIST SP 800-63B-4 in the USA, prohibit periodic password expiration. <https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver> <https://pages.nist.gov/800-63-FAQ/#q-b05> <https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry> To align with these, we're deprecating the ability to periodically expire passwords. The specifics and long-term roadmap are currently being discussed, and we invite feedback from users, particularly from those in regulated environments. See <shadow-maint#1432>. This deprecation includes the following programs and features: expiry(1) chage(1): -I,--inactive (also the interactive version) -m,--mindays (also the interactive version) -M,--maxdays (also the interactive version) -W,--warndays (also the interactive version) passwd(1): -k,--keep-tokens -n,--mindays -x,--maxdays -i,--inactive -w,--warndays useradd(8): -f,--inactive usermod(8): -f,--inactive login.defs(5): PASS_MIN_DAYS PASS_MAX_DAYS PASS_WARN_AGE /etc/default/useradd: INACTIVE shadow(5): sp_lstchg: Restrict to just the values 0 and empty. sp_min sp_max sp_warn sp_inact We recognize that many users operate in environments with regulatory or contractual requirements that still mandate password aging. To minimize disruption, these features will remain functional for a significant period. However, we encourage administrators to review their internal policies, talk to their regulators if appropriate, and participate in the roadmap discussion linked above. Co-authored-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>

Breaking changes: - Remove support for escaped newlines in configuration files. It never worked correctly. b0a7ce5 (2025-12-05; "lib/, po/: Remove fgetsx() and fputsx()") - Some user names and group names are too dangerous and are rejected, even with --badname. 25aea74 (2025-12-25; "lib/chkname.c, src/: Strictly disallow really bad names") Future breaking changes: - SHA512 and SHA256 will be supported unconditionally in the next release. The build-time flag '--with-sha-crypt' will be removed. See <shadow-maint#1452>. Deprecations: - groupmems(8) The program will be removed in a future release. See <shadow-maint#1343>. - logoutd(8) The program will be removed in the next release. See <shadow-maint#999>, and <shadow-maint#1344>. - DES This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1456> - MD5 This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1457> - login.defs(5): MD_CRYPT_ENAB This feature had been deprecated for decades. It will be removed in a future release. The command-line equivalents (-m, --md5) of this feature in chpasswd(8) and chgpasswd(8) will also be removed in a future release. See <shadow-maint#1455>. - login.defs(5): PASS_MAX_LEN This feature is ignored except for DES. Once DES is removed, it makes no sense keeping it. It may be removed in a future release. - Password aging Security research shows that periodic password expiration leads to predictable password patterns, and that even in a theoretical scenario where that wouldn't happen the gains in security are mathematically negligible. <https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf> Modern security standards, such as NIST SP 800-63B-4 in the USA, prohibit periodic password expiration. <https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver> <https://pages.nist.gov/800-63-FAQ/#q-b05> <https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry> To align with these, we're deprecating the ability to periodically expire passwords. The specifics and long-term roadmap are currently being discussed, and we invite feedback from users, particularly from those in regulated environments. See <shadow-maint#1432>. This deprecation includes the following programs and features: expiry(1) chage(1): -I,--inactive (also the interactive version) -m,--mindays (also the interactive version) -M,--maxdays (also the interactive version) -W,--warndays (also the interactive version) passwd(1): -k,--keep-tokens -n,--mindays -x,--maxdays -i,--inactive -w,--warndays useradd(8): -f,--inactive usermod(8): -f,--inactive login.defs(5): PASS_MIN_DAYS PASS_MAX_DAYS PASS_WARN_AGE /etc/default/useradd: INACTIVE shadow(5): sp_lstchg: Restrict to just the values 0 and empty. sp_min sp_max sp_warn sp_inact We recognize that many users operate in environments with regulatory or contractual requirements that still mandate password aging. To minimize disruption, these features will remain functional for a significant period. However, we encourage administrators to review their internal policies, talk to their regulators if appropriate, and participate in the roadmap discussion linked above. Co-authored-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>

Breaking changes: - Remove support for escaped newlines in configuration files. It never worked correctly. b0a7ce5 (2025-12-05; "lib/, po/: Remove fgetsx() and fputsx()") - Some user names and group names are too dangerous and are rejected, even with --badname. 25aea74 (2025-12-25; "lib/chkname.c, src/: Strictly disallow really bad names") Future breaking changes: - SHA512 and SHA256 will be supported unconditionally in the next release. The build-time flag '--with-sha-crypt' will be removed. See <shadow-maint#1452>. Deprecations: - groupmems(8) The program will be removed in a future release. See <shadow-maint#1343>. - logoutd(8) The program will be removed in the next release. See <shadow-maint#999>, and <shadow-maint#1344>. - DES This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1456> - MD5 This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1457> - login.defs(5): MD_CRYPT_ENAB This feature had been deprecated for decades. It will be removed in a future release. The command-line equivalents (-m, --md5) of this feature in chpasswd(8) and chgpasswd(8) will also be removed in a future release. See <shadow-maint#1455>. - login.defs(5): PASS_MAX_LEN This feature is ignored except for DES. Once DES is removed, it makes no sense keeping it. It may be removed in a future release. - Password aging Scientific research shows that periodic password expiration leads to predictable password patterns, and that even in a theoretical scenario where that wouldn't happen the gains in security are mathematically negligible. <https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf> Modern security standards, such as NIST SP 800-63B-4 in the USA, prohibit periodic password expiration. <https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver> <https://pages.nist.gov/800-63-FAQ/#q-b05> <https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry> To align with these, we're deprecating the ability to periodically expire passwords. The specifics and long-term roadmap are currently being discussed, and we invite feedback from users, particularly from those in regulated environments. See <shadow-maint#1432>. This deprecation includes the following programs and features: expiry(1) chage(1): -I,--inactive (also the interactive version) -m,--mindays (also the interactive version) -M,--maxdays (also the interactive version) -W,--warndays (also the interactive version) passwd(1): -k,--keep-tokens -n,--mindays -x,--maxdays -i,--inactive -w,--warndays useradd(8): -f,--inactive usermod(8): -f,--inactive login.defs(5): PASS_MIN_DAYS PASS_MAX_DAYS PASS_WARN_AGE /etc/default/useradd: INACTIVE shadow(5): sp_lstchg: Restrict to just the values 0 and empty. sp_min sp_max sp_warn sp_inact We recognize that many users operate in environments with regulatory or contractual requirements that still mandate password aging. To minimize disruption, these features will remain functional for a significant period. However, we encourage administrators to review their internal policies, talk to their regulators if appropriate, and participate in the roadmap discussion linked above. Co-authored-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>

Breaking changes: - Remove support for escaped newlines in configuration files. It never worked correctly. b0a7ce5 (2025-12-05; "lib/, po/: Remove fgetsx() and fputsx()") - Some user names and group names are too dangerous and are rejected, even with --badname. 25aea74 (2025-12-25; "lib/chkname.c, src/: Strictly disallow really bad names") Future breaking changes: - SHA512 and SHA256 will be supported unconditionally in the next release. The build-time flag '--with-sha-crypt' will be removed. See <shadow-maint#1452>. Support: - Several years ago, there were talks about deprecating su(1) and login(1), back when this project was maintained as part of Debian. However, nothing was clearly stated, and there was doubt about the status of these programs. Let's clarify them now. Our implementations pf su(1) and login(1) are fully supported, and we don't have any plans to remove them. They are NOT deprecated. Deprecations: - groupmems(8) The program will be removed in a future release. See <shadow-maint#1343>. - logoutd(8) The program will be removed in the next release. See <shadow-maint#999>, and <shadow-maint#1344>. - DES This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1456> - MD5 This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1457> - login.defs(5): MD_CRYPT_ENAB This feature had been deprecated for decades. It will be removed in a future release. The command-line equivalents (-m, --md5) of this feature in chpasswd(8) and chgpasswd(8) will also be removed in a future release. See <shadow-maint#1455>. - login.defs(5): PASS_MAX_LEN This feature is ignored except for DES. Once DES is removed, it makes no sense keeping it. It may be removed in a future release. - Password aging Scientific research shows that periodic password expiration leads to predictable password patterns, and that even in a theoretical scenario where that wouldn't happen the gains in security are mathematically negligible. <https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf> Modern security standards, such as NIST SP 800-63B-4 in the USA, prohibit periodic password expiration. <https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver> <https://pages.nist.gov/800-63-FAQ/#q-b05> <https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry> To align with these, we're deprecating the ability to periodically expire passwords. The specifics and long-term roadmap are currently being discussed, and we invite feedback from users, particularly from those in regulated environments. See <shadow-maint#1432>. This deprecation includes the following programs and features: expiry(1) chage(1): -I,--inactive (also the interactive version) -m,--mindays (also the interactive version) -M,--maxdays (also the interactive version) -W,--warndays (also the interactive version) passwd(1): -k,--keep-tokens -n,--mindays -x,--maxdays -i,--inactive -w,--warndays useradd(8): -f,--inactive usermod(8): -f,--inactive login.defs(5): PASS_MIN_DAYS PASS_MAX_DAYS PASS_WARN_AGE /etc/default/useradd: INACTIVE shadow(5): sp_lstchg: Restrict to just the values 0 and empty. sp_min sp_max sp_warn sp_inact We recognize that many users operate in environments with regulatory or contractual requirements that still mandate password aging. To minimize disruption, these features will remain functional for a significant period. However, we encourage administrators to review their internal policies, talk to their regulators if appropriate, and participate in the roadmap discussion linked above. Co-authored-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>

Breaking changes: - Remove support for escaped newlines in configuration files. It never worked correctly. b0a7ce5 (2025-12-05; "lib/, po/: Remove fgetsx() and fputsx()") - Some user names and group names are too dangerous and are rejected, even with --badname. 25aea74 (2025-12-25; "lib/chkname.c, src/: Strictly disallow really bad names") Future breaking changes: - SHA512 and SHA256 will be supported unconditionally in the next release. The build-time flag '--with-sha-crypt' will be removed. See <shadow-maint#1452>. Support: - Several years ago, there were talks about deprecating su(1) and login(1), back when this project was maintained as part of Debian. However, nothing was clearly stated, and there was doubt about the status of these programs. Let's clarify them now. Our implementations pf su(1) and login(1) are fully supported, and we don't have any plans to remove them. They are NOT deprecated. See <shadow-maint#464>. Deprecations: - groupmems(8) The program will be removed in a future release. See <shadow-maint#1343>. - logoutd(8) The program will be removed in the next release. See <shadow-maint#999>, and <shadow-maint#1344>. - DES This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1456> - MD5 This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1457> - login.defs(5): MD_CRYPT_ENAB This feature had been deprecated for decades. It will be removed in a future release. The command-line equivalents (-m, --md5) of this feature in chpasswd(8) and chgpasswd(8) will also be removed in a future release. See <shadow-maint#1455>. - login.defs(5): PASS_MAX_LEN This feature is ignored except for DES. Once DES is removed, it makes no sense keeping it. It may be removed in a future release. - Password aging Scientific research shows that periodic password expiration leads to predictable password patterns, and that even in a theoretical scenario where that wouldn't happen the gains in security are mathematically negligible. <https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf> Modern security standards, such as NIST SP 800-63B-4 in the USA, prohibit periodic password expiration. <https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver> <https://pages.nist.gov/800-63-FAQ/#q-b05> <https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry> To align with these, we're deprecating the ability to periodically expire passwords. The specifics and long-term roadmap are currently being discussed, and we invite feedback from users, particularly from those in regulated environments. See <shadow-maint#1432>. This deprecation includes the following programs and features: expiry(1) chage(1): -I,--inactive (also the interactive version) -m,--mindays (also the interactive version) -M,--maxdays (also the interactive version) -W,--warndays (also the interactive version) passwd(1): -k,--keep-tokens -n,--mindays -x,--maxdays -i,--inactive -w,--warndays useradd(8): -f,--inactive usermod(8): -f,--inactive login.defs(5): PASS_MIN_DAYS PASS_MAX_DAYS PASS_WARN_AGE /etc/default/useradd: INACTIVE shadow(5): sp_lstchg: Restrict to just the values 0 and empty. sp_min sp_max sp_warn sp_inact We recognize that many users operate in environments with regulatory or contractual requirements that still mandate password aging. To minimize disruption, these features will remain functional for a significant period. However, we encourage administrators to review their internal policies, talk to their regulators if appropriate, and participate in the roadmap discussion linked above. Co-authored-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>

Breaking changes: - Remove support for escaped newlines in configuration files. It never worked correctly. b0a7ce5 (2025-12-05; "lib/, po/: Remove fgetsx() and fputsx()") - Some user names and group names are too dangerous and are rejected, even with --badname. 25aea74 (2025-12-25; "lib/chkname.c, src/: Strictly disallow really bad names") Future breaking changes: - SHA512 and SHA256 will be supported unconditionally in the next release. The build-time flag '--with-sha-crypt' will be removed. See <shadow-maint#1452>. Support: - Several years ago, there were talks about deprecating su(1) and login(1), back when this project was maintained as part of Debian. However, nothing was clearly stated, and there were doubts about the status of these programs. Let's clarify them now. Our implementations of su(1) and login(1) are fully supported, and we don't have any plans to remove them. They are NOT deprecated. See <shadow-maint#464>. Deprecations: - groupmems(8) The program will be removed in a future release. See <shadow-maint#1343>. - logoutd(8) The program will be removed in the next release. See <shadow-maint#999>, and <shadow-maint#1344>. - DES This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1456> - MD5 This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See <shadow-maint#1457> - login.defs(5): MD_CRYPT_ENAB This feature had been deprecated for decades. It will be removed in a future release. The command-line equivalents (-m, --md5) of this feature in chpasswd(8) and chgpasswd(8) will also be removed in a future release. See <shadow-maint#1455>. - login.defs(5): PASS_MAX_LEN This feature is ignored except for DES. Once DES is removed, it makes no sense keeping it. It may be removed in a future release. - Password aging Scientific research shows that periodic password expiration leads to predictable password patterns, and that even in a theoretical scenario where that wouldn't happen the gains in security are mathematically negligible. <https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf> Modern security standards, such as NIST SP 800-63B-4 in the USA, prohibit periodic password expiration. <https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver> <https://pages.nist.gov/800-63-FAQ/#q-b05> <https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry> To align with these, we're deprecating the ability to periodically expire passwords. The specifics and long-term roadmap are currently being discussed, and we invite feedback from users, particularly from those in regulated environments. See <shadow-maint#1432>. This deprecation includes the following programs and features: expiry(1) chage(1): -I,--inactive (also the interactive version) -m,--mindays (also the interactive version) -M,--maxdays (also the interactive version) -W,--warndays (also the interactive version) passwd(1): -k,--keep-tokens -n,--mindays -x,--maxdays -i,--inactive -w,--warndays useradd(8): -f,--inactive usermod(8): -f,--inactive login.defs(5): PASS_MIN_DAYS PASS_MAX_DAYS PASS_WARN_AGE /etc/default/useradd: INACTIVE shadow(5): sp_lstchg: Restrict to just the values 0 and empty. sp_min sp_max sp_warn sp_inact We recognize that many users operate in environments with regulatory or contractual requirements that still mandate password aging. To minimize disruption, these features will remain functional for a significant period. However, we encourage administrators to review their internal policies, talk to their regulators if appropriate, and participate in the roadmap discussion linked above. Co-authored-by: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar · 2025-12-31T23:41:57Z

If you rebase, I'll merge. :)

alejandro-colomar · 2026-01-01T01:47:22Z

Cc: @sem-gh, @thalman, @firasuke, @dkwo, @jubalh , @floppym , @vapier , @dvzrv, @nobodino, @q66

Does anyone oppose to this? I'd like to make sure this is okay to everyone.

dvzrv · 2026-01-01T12:25:11Z

Fine by me. We don't ship it on Arch Linux.

firasuke · 2026-01-01T13:31:11Z

Cc: @sem-gh, @thalman, @firasuke, @dkwo, @jubalh , @floppym , @vapier , @dvzrv

Does anyone oppose to this? I'd like to make sure this is okay to everyone.

Fine by me.

Shouldn't sulogin be removed as well? util-linux provides a relatively "better" version, and shadow's version gets built either way but is not installed (#1082).

alejandro-colomar · 2026-01-01T14:15:15Z

Cc: @sem-gh, @thalman, @firasuke, @dkwo, @jubalh , @floppym , @vapier , @dvzrv
Does anyone oppose to this? I'd like to make sure this is okay to everyone.

Fine by me.

Thanks!

Shouldn't sulogin be removed as well? util-linux provides a relatively "better" version, and shadow's version gets built either way but is not installed (#1082).

That would be off-topic here. And in the thread you linked, there seem to be users of the program, so I'd prefer to keep it.

vapier · 2026-01-01T15:43:36Z

makes sense to drop logoutd since it's old & generally unused

q66 · 2026-01-01T17:32:18Z

lgtm

zeha · 2026-01-01T18:03:49Z

lgtm

ikerexxe force-pushed the remove-logoutd branch 2 times, most recently from 8e939db to c8f8aed Compare August 25, 2025 08:36

ikerexxe marked this pull request as ready for review August 25, 2025 08:45

Remove unused logoutd utility

a0de791

Link: <shadow-maint#999> Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>

ikerexxe force-pushed the remove-logoutd branch from c8f8aed to a0de791 Compare August 25, 2025 09:12

alejandro-colomar approved these changes Aug 26, 2025

View reviewed changes

alejandro-colomar marked this pull request as draft December 6, 2025 12:29

alejandro-colomar assigned ikerexxe Dec 11, 2025

alejandro-colomar mentioned this pull request Dec 26, 2025

4.20 Release plan (I) - 2026-03 #1451

Open

alejandro-colomar marked this pull request as ready for review December 31, 2025 23:41

alejandro-colomar added the deprecation/removal label Jan 1, 2026

Remove unused logoutd utility #1344

Are you sure you want to change the base?

Remove unused logoutd utility #1344

Uh oh!

Conversation

ikerexxe commented Aug 25, 2025

Uh oh!

alejandro-colomar commented Aug 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ikerexxe commented Aug 26, 2025

Uh oh!

alejandro-colomar left a comment

Choose a reason for hiding this comment

Uh oh!

ikerexxe commented Aug 27, 2025

Uh oh!

hallyn commented Sep 10, 2025

Uh oh!

ikerexxe commented Sep 10, 2025

Uh oh!

alejandro-colomar commented Sep 10, 2025

Uh oh!

zeha commented Sep 16, 2025

Uh oh!

zeha commented Sep 16, 2025

Uh oh!

ikerexxe commented Sep 17, 2025

Uh oh!

zeha commented Sep 17, 2025

Uh oh!

ikerexxe commented Sep 17, 2025

Uh oh!

alejandro-colomar commented Dec 6, 2025

Uh oh!

ikerexxe commented Dec 9, 2025

Uh oh!

alejandro-colomar commented Dec 9, 2025

Uh oh!

alejandro-colomar commented Dec 31, 2025

Uh oh!

alejandro-colomar commented Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dvzrv commented Jan 1, 2026

Uh oh!

firasuke commented Jan 1, 2026

Uh oh!

alejandro-colomar commented Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vapier commented Jan 1, 2026

Uh oh!

q66 commented Jan 1, 2026

Uh oh!

zeha commented Jan 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Remove unused `logoutd` utility #1344

Remove unused `logoutd` utility #1344

alejandro-colomar commented Aug 25, 2025 •

edited

Loading

alejandro-colomar commented Jan 1, 2026 •

edited

Loading

alejandro-colomar commented Jan 1, 2026 •

edited

Loading