Dmitry Belyavskiy 9dff9c
diff -up openssh-8.0p1/auth-pam.c.preserve-pam-errors openssh-8.0p1/auth-pam.c
Dmitry Belyavskiy 9dff9c
--- openssh-8.0p1/auth-pam.c.preserve-pam-errors	2021-03-31 17:03:15.618592347 +0200
Dmitry Belyavskiy 9dff9c
+++ openssh-8.0p1/auth-pam.c	2021-03-31 17:06:58.115220014 +0200
Dmitry Belyavskiy 9dff9c
@@ -511,7 +511,11 @@ sshpam_thread(void *ctxtp)
Dmitry Belyavskiy 9dff9c
 		goto auth_fail;
Dmitry Belyavskiy 9dff9c
 
Dmitry Belyavskiy 9dff9c
 	if (!do_pam_account()) {
Dmitry Belyavskiy 9dff9c
-		sshpam_err = PAM_ACCT_EXPIRED;
Dmitry Belyavskiy 9dff9c
+		/* Preserve PAM_PERM_DENIED and PAM_USER_UNKNOWN.
Dmitry Belyavskiy 9dff9c
+		 * Backward compatibility for other errors. */
Dmitry Belyavskiy 9dff9c
+		if (sshpam_err != PAM_PERM_DENIED
Dmitry Belyavskiy 9dff9c
+			&& sshpam_err != PAM_USER_UNKNOWN)
Dmitry Belyavskiy 9dff9c
+			sshpam_err = PAM_ACCT_EXPIRED;
Dmitry Belyavskiy 9dff9c
 		goto auth_fail;
Dmitry Belyavskiy 9dff9c
 	}
Dmitry Belyavskiy 9dff9c
 	if (sshpam_authctxt->force_pwchange) {
Dmitry Belyavskiy 9dff9c
@@ -568,8 +572,10 @@ sshpam_thread(void *ctxtp)
Dmitry Belyavskiy 9dff9c
 	    pam_strerror(sshpam_handle, sshpam_err))) != 0)
Dmitry Belyavskiy 9dff9c
 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
Dmitry Belyavskiy 9dff9c
 	/* XXX - can't do much about an error here */
Dmitry Belyavskiy 9dff9c
-	if (sshpam_err == PAM_ACCT_EXPIRED)
Dmitry Belyavskiy 9dff9c
-		ssh_msg_send(ctxt->pam_csock, PAM_ACCT_EXPIRED, buffer);
Dmitry Belyavskiy 9dff9c
+	if (sshpam_err == PAM_PERM_DENIED
Dmitry Belyavskiy 9dff9c
+		|| sshpam_err == PAM_USER_UNKNOWN
Dmitry Belyavskiy 9dff9c
+		|| sshpam_err == PAM_ACCT_EXPIRED)
Dmitry Belyavskiy 9dff9c
+		ssh_msg_send(ctxt->pam_csock, sshpam_err, buffer);
Dmitry Belyavskiy 9dff9c
 	else if (sshpam_maxtries_reached)
Dmitry Belyavskiy 9dff9c
 		ssh_msg_send(ctxt->pam_csock, PAM_MAXTRIES, buffer);
Dmitry Belyavskiy 9dff9c
 	else
Dmitry Belyavskiy 9dff9c
@@ -856,10 +862,12 @@ sshpam_query(void *ctx, char **name, cha
Dmitry Belyavskiy 9dff9c
 			plen++;
Dmitry Belyavskiy 9dff9c
 			free(msg);
Dmitry Belyavskiy 9dff9c
 			break;
Dmitry Belyavskiy 9dff9c
+		case PAM_USER_UNKNOWN:
Dmitry Belyavskiy 9dff9c
+		case PAM_PERM_DENIED:
Dmitry Belyavskiy 9dff9c
 		case PAM_ACCT_EXPIRED:
Dmitry Belyavskiy 9dff9c
+			sshpam_account_status = 0;
Dmitry Belyavskiy 9dff9c
+			/* FALLTHROUGH */
Dmitry Belyavskiy 9dff9c
 		case PAM_MAXTRIES:
Dmitry Belyavskiy 9dff9c
-			if (type == PAM_ACCT_EXPIRED)
Dmitry Belyavskiy 9dff9c
-				sshpam_account_status = 0;
Dmitry Belyavskiy 9dff9c
 			if (type == PAM_MAXTRIES)
Dmitry Belyavskiy 9dff9c
 				sshpam_set_maxtries_reached(1);
Dmitry Belyavskiy 9dff9c
 			/* FALLTHROUGH */