On 2/6/25 08:55, Matthias Gerstner wrote: [...]

On the use of PAMSUCCESS ---------------------------

PAM modules that only serve utility functions but do not actually authenticate could consider not returning PAMSUCCESS but PAMIGNORE instead. This would avoid unintended successful authentication in a situation like described in this report. It seems natural to PAM module authors to return PAMSUCCESS if nothing in their module failed, however. A lot of modules work this way and changing them all would be a big effort.

-- Jacob