Fix login delay, spurious auth.log entry, and PermitRootLogin information

leakage due to PAM issues with upstream's recent security update (thanks,
Darren Tucker; closes: #99168, #192207, #193546).

1 files changed, 1 insertions, 1 deletions

diff --git a/auth1.c b/auth1.c
index c273f2fb6..b7e10abd0 100644
--- a/auth1.c
+++ b/auth1.c
@@ -80,7 +80,7 @@ do_authloop(Authctxt *authctxt)
             authctxt->valid ? "" : "illegal user ", authctxt->user);
 
         /* If the user has no password, accept authentication immediately. */
-        if (options.password_authentication &&
+        if (options.password_authentication && options.permit_empty_passwd &&
 #if defined(KRB4) || defined(KRB5)
             (!options.kerberos_authentication || options.kerberos_or_local_passwd) &&
 #endif