Stacking Problem in pam.conf on Solaris 10 ?

Question

Hi all,
I have pam.conf with enteries for
# Default definition for Password management
# Used when service name is not explicitly mentioned for password management
*other password required pam_dhkeys.so.1*
*other password requisite pam_authtok_get.so.1*
*other password requisite pam_authtok_check.so.1*
*other password required pam_authtok_store.so.1*
As per my understanding the
(I) SPI pam_authtok_get.so.1 is used to get the user credentials from password DB.
(II) SPI pam_authtok_check.so.1* is used to check if the new password supplied is satisfying the password policy on the OS ( by reading values from /etc/default/passwd )
(III) SPI pam_authtok_store.so.1* is used to store the newly entered password to password db.
Please correct me if I am wrong anywhere.
Now I have a requirement thar an application has to be wriiten which will just check that the entered password satisfies the password policies of the OS or not, but it should not update the password DB(should not store the password)
I make the following enteries in my pam.conf
osPasswdCheck password required pam_dhkeys.so.1
osPasswdCheck password requisite pam_authtok_get.so.1
osPasswdCheck password requisite pam_authtok_check.so.1
I removed the entry for pam_authtok_store.so.1 as I dont want to store the but when I run my application it always give error 20 authentication manipulation error.
please refer (/usr/include/security/pam_appl.h)
I have done all the formalities w.r.t writing a PAM Conversation funtion and the application is returning success when I add the pam_authtok_store.so.1 into the SPI
Please anyone can help me out.Is there is anyother way with which I can use my application just to check password (w.r.t. OS policy) .
I will be really thankful if anybody can provide me with working PAM Modules stack for achieving it.
Thanks in advcance.
Regards,
Rahul.
but I dont want to store it.

Answer 1

Why not just keep the "pam_authtok_store.so.1" line in your pam.conf file and set it to a level of "requisite" or lower? I haven't tried it myself yet, but I've found that in the past when editing this file, completely removing a line rather than giving the PAM stack what it would expect to see with that line being there in some way can also cause problems.