- (dtucker) [auth1.c] Ensure do_pam_account is called for Protocol 1

   connections with empty passwords.  Patch from davidwu at nbttech.com,
   ok djm@

1 files changed, 7 insertions, 2 deletions

diff --git a/auth1.c b/auth1.c
index e541935c..ab6fd34d 100644
--- a/auth1.c
+++ b/auth1.c
@@ -79,8 +79,13 @@ do_authloop(Authctxt *authctxt)
 	    (!options.kerberos_authentication || options.kerberos_or_local_passwd) &&
 #endif
 	    PRIVSEP(auth_password(authctxt, ""))) {
-		auth_log(authctxt, 1, "without authentication", "");
-		return;
+#ifdef USE_PAM
+		if (options.use_pam && (PRIVSEP(do_pam_account())))
+#endif
+		{
+			auth_log(authctxt, 1, "without authentication", "");
+			return;
+		}
 	}
 
 	/* Indicate that authentication is needed. */