Help needed - setting password policies for different types of accounts

Question

Hello,
We have a situation where we have different types of users created on a solaris server. We have regular users, admins, functional accounts and device accounts. Of course solaris does not differentiate between regular user and other types, i think. The default password policy applies to all the users on the server. I want to configure different policy for different types of user accounts. Is it possible? The difference between the accounts on our side is
Regular user accounts - 8 digit numbers ( 00667265) - expire password every 90 days
Functional accounts - 8 digits starting with F ( F0253466) - do not expire, but password length must be 10-12 and complex
Device Accounts - 8 digits starting with Z ( Z2367249) - do not expire, but password length must be 12 and complex - like upper case, lower case, number, special chars etc.
Is it possible to set up different password policies, is so how?

Answer 1

The password expiration policy is pretty easy, it can be set on a per account basis when the account is created. I'm not aware of a simple way to define a complexity policy for groups of accounts but the policy is enforced using pam, so you should be able to write a pam module which would enforce your complexity policy. The pam manual page would be a reasonable starting point for learning about pam.