Changes to PAM for the Solaris 10 Release

The Solaris 10 release includes the following changes to the Pluggable Authentication Module (PAM) framework:

• The pam_authtok_check module now allows for strict password checking using new tunable parameters in the /etc/default/passwd file. The new parameters define:

  • A list of comma separated dictionary files used for checking common dictionary words in a password

  • The minimum differences required between a new password and an old password

  • The minimum number of alphabetic or nonalphabetic characters that must be used in a new password

  • The minimum number of uppercase or lowercase letters that must be used in a new password

  • The number of allowable consecutive repeating characters

• The pam_unix_auth module implements account locking for local users. Account locking is enabled by the LOCK_AFTER_RETRIES parameter in /etc/security/policy.conf and the lock_after-retries key in /etc/user_attr. See the policy.conf(4) and the user_attr(4) man pages for more information.

• A new binding control flag has been defined. This control flag is documented in the pam.conf(4) man page and in How PAM Stacking Works.

• The pam_unix module has been removed and replaced by a set of service modules of equivalent or greater functionality. Many of these modules were introduced in the Solaris 9 release. Here is a list of the replacement modules:

  • pam_authtok_check

  • pam_authtok_get

  • pam_authtok_store

  • pam_dhkeys

  • pam_passwd_auth

  • pam_unix_account

  • pam_unix_auth

  • pam_unix_cred

  • pam_unix_session

• The functionality of the pam_unix_auth module has been split into two modules. The pam_unix_auth module now verifies that the password is correct for the user. The new pam_unix_cred module provides functions that establish user credential information.

• Additions to the pam_krb5 module have been made to manage the Kerberos credentials cache using the PAM framework.

• A new pam_deny module has been added. The module can be used to deny access to services. By default, the pam_deny module is not used. For more information, see the pam_deny(5) man page.