Merge from HEAD:

  Make sure that there's a delay in PAM keyboard-interactive authentication
  when PermitRootLogin is not set to yes and the correct root password is
  entered (closes: #248747).

1 files changed, 3 insertions, 1 deletions

diff --git a/auth-pam.c b/auth-pam.c
index ec3b74951..9be57dacd 100644
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -645,7 +645,9 @@ sshpam_respond(void *ctx, u_int num, char **resp)
                 return (-1);
         }
         buffer_init(&buffer);
-        if (sshpam_authctxt->valid)
+        if (sshpam_authctxt->valid &&
+            (sshpam_authctxt->pw->pw_uid != 0 ||
+             options.permit_root_login == PERMIT_YES))
                 buffer_put_cstring(&buffer, *resp);
         else
                 buffer_put_cstring(&buffer, badpw);