Hacker News Reader

Yes, and this guy, quoted by the article author:

"I wouldn't call that an OpenSSH bug. I would call it a systemic design flaw in PAM."

is then clearly wrong, it is an OpenSSH bug.

Well, it sort of isn't, because the OpenBSD team designed OpenSSH to not use PAM at all. PAM was patched in by some folks, and clearly they got it wrong, but I suspect the OpenSSH team doesn't see that as "part of OpenSSH".

PAM support is part of OpenSSH portable releases. http://www.openssh.com/faq.html#3.15

Reply on news.ycombinator.com