i guess we also ship with PAM password change remaining disabled. have not seen any feedback on solar's patch (which is in the tree but remains #if 0 in auth-pam.c).