Return PAM_AUTH_ERR when a system user. This prevents the pam module from returning success without asking for authentication credentials! diff --git a/src/pam_sshauth.c b/src/pam_sshauth.c index 939ea79..879c9e5 100644 --- a/src/pam_sshauth.c +++ b/src/pam_sshauth.c @@ -101,7 +100,7 @@ pam_sm_authenticate (pam_handle_t * pamh, int flags, int argc, } /* - * Is it a system user? Succeed. + * Is it a system user? Fail. */ pam_debug (pamh, "username %s", username); @@ -110,7 +109,7 @@ pam_sm_authenticate (pam_handle_t * pamh, int flags, int argc, { if (pwent->pw_uid < UID_MIN) { - return PAM_SUCCESS; + return PAM_AUTH_ERR; } }