With RHL 4.2, a user dialed in with AutoPPP and PAP authentication showed in a "who" display as the user who successfully logged in. With RHL 5.2, the who display shows "a_ppp" instead. This was noticed in converting a box which supports dialup using Cyclades cards. I upgraded from 4.2 to 5.2 and a number of problems cropped up, this was one.
Actually it's PAM bug. It's very unpleasant because it makes users accounting impossible on dial-in server. pppd-2.3.5 relies on the PAM modules for wtmp handling; on other hand, look at quote from pam_lastlog docs: Overview of module This session module maintains the /var/log/wtmp file. Adding an open entry when called via the pam_open_seesion() function and completing it when pam_close_session() is called. ... But this functionality is missing. So I think the right solution is adding utmp/wtmp stuff to the lastlog module according its docs, and adding following line to /etc/pam.d/ppp in the case of dial-in server: session required pam_lastlog.so Patch for pam_lastlog follows (I used it successfully last 3 months).
fixed in ppp-2.3.7-1 and later source rpms.