pam bug fix and enhancement update

Updated pam packages that fix several bugs and add an enhancement are now
available.

Pluggable Authentication Modules (PAM) provide a system whereby
administrators can set up authentication policies, without having to
recompile programs that handle authentication.

These updated packages fix the following bugs:

* the pam_time module always failed when tty was not set by the calling
service. For example, it was not possible to use the pam_time module with
the vsftpd service. In these updated packages, pam_time sets tty to '""'
when it is not set by the service, which resolves this issue.

* on 64-bit architectures, incorrect data was read from lastlog, causing
ctime to return "NULL". This resulted in the pam_lastlog module causing
a segmentation fault. In these updated packages, the correct data is read
from lastlog, which resolves this issue.

* when tty was not set by the calling service, the pam_access module did
not match the "LOCAL" keyword in "/etc/security/access.conf". In these
situations, access was denied, instead of permitted.

* "security/pam_appl.h" did not define "PAM_AUTHTOK_RECOVERY_ERR".

As well, glibc now allows SHA-256 and SHA-512 password hashes. As such,
pam has been updated to support the SHA-256 and SHA-512 hashes in
"/etc/passwd" and "/etc/shadow".

Users of pam are advised to upgrade to these updated packages, which
resolve these issues and add this enhancement.

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

308651 - pam_stack.so service=system-auth behaving differently compared to explicit setting of configuration
371391 - Including <security/pam_appl.h> should define PAM_AUTHTOK_RECOVERY_ERR

access, hash, password, sha256, sha512, time, tty