On Fri, 2011-04-29 at 10:55 -0400, Jonathan Siegle wrote:

Is it possible to allow master users to be authenticated against PAM? Something like:

passdb { driver = pam master = yes }

If PAM authentication succeeds, the user is a master user with this config.

and then have a userdb which qualifies what accounts are master accounts but doesn't have passwords?

Do you mean you would want both master and non-master users be authenticated from a single PAM passdb? That won't work, you need separate passdbs. You could probably configure two different PAM services and use them both..