The Solaris 10 release includes the following changes to the Pluggable Authentication Module (PAM) framework:
The pam_authtok_check module now allows for strict password checking using new tunable parameters in the /etc/default/passwd file. The new parameters define:
A list of comma separated dictionary files used for checking common dictionary words in a password
The minimum differences required between a new password and an old password
The minimum number of alphabetic or nonalphabetic characters that must be used in a new password
The minimum number of uppercase or lowercase letters that must be used in a new password
The number of allowable consecutive repeating characters
The pam_unix_auth module implements account locking for local users. Account locking is enabled by the LOCK_AFTER_RETRIES parameter in /etc/security/policy.conf and the lock_after-retries key in /etc/user_attr. See the policy.conf(4) and the user_attr(4) man pages for more information.
A new binding control flag has been defined. This control flag is documented in the pam.conf(4) man page and in How PAM Stacking Works.
The pam_unix module has been removed and replaced by a set of service modules of equivalent or greater functionality. Many of these modules were introduced in the Solaris 9 release. Here is a list of the replacement modules:
pam_authtok_check
pam_authtok_get
pam_authtok_store
pam_dhkeys
pam_passwd_auth
pam_unix_account
pam_unix_auth
pam_unix_cred
pam_unix_session
The functionality of the pam_unix_auth module has been split into two modules. The pam_unix_auth module now verifies that the password is correct for the user. The new pam_unix_cred module provides functions that establish user credential information.
Additions to the pam_krb5 module have been made to manage the Kerberos credentials cache using the PAM framework.
A new pam_deny module has been added. The module can be used to deny access to services. By default, the pam_deny module is not used. For more information, see the pam_deny(5) man page.