Greetings,
I'm in the process of configuring a Solaris 2.6 SPARCstation 5. The only real experience I have in doing this is from configuring Solaris 8, which seemed to go a lot more smoothly. One of the problems I have is implementing the PAMs module pam_history.so.1. The configuration file for PAMs (/etc/pam.conf) looks much different in Solaris 2.6 than Solaris 8, the thing that jumps out the most is the fact that the modules call out absolute paths.
The problem I am having is that the token "stacking" feature does not seem to work at ALL on this version of PAMS. It doesn't complain when I use the stacking options, but they just don't seem to work:
other password requisite /usr/lib/security/pam_history.so.1 history=10
other password required /usr/lib/security/pam_unix.so.1 try_first_pass
What happens when I try to change the password is first I get a prompt for the password, again to verify, then if it passes I get ANOTHER password prompt, then another verify. In other words, they can cheat the password history rules if they just use the same password on the 2nd-go-around.
I've even tried copying the entire /usr/lib/security folder from Solaris 8 and poking it in, and using the Solaris 8 /etc/pam.conf file, but trying to change a password with that just fails miserably, not even getting to the first prompt.
Does anyone have any suggestions for getting the PAMS stacking to work? Or maybe a different approach on implementing password history?