Jarom=EDr Dolecek <jdolecek@netbsd.org> writes:

> * it's easy to provide e.g. Linux PAM-compatible authentication API,
>   if need be

It's easy to provide something pam-subset-compatible. Since a real
pam-module runs in the calling process' context, it can modify that
context in ways that bsd auth can never emulate, for good or bad.

/Johan