With RHL 4.2, a user dialed in with AutoPPP and PAP
authentication showed in a "who" display as the user who
successfully logged in.
With RHL 5.2, the who display shows "a_ppp" instead.
This was noticed in converting a box which supports dialup
using Cyclades cards. I upgraded from 4.2 to 5.2 and a
number of problems cropped up, this was one.
Actually it's PAM bug. It's very unpleasant because it makes
users accounting impossible on dial-in server.
pppd-2.3.5 relies on the PAM modules for wtmp handling;
on other hand, look at quote from pam_lastlog docs:
This session module maintains the /var/log/wtmp file. Adding an
entry when called via the pam_open_seesion() function and
it when pam_close_session() is called.
But this functionality is missing.
So I think the right solution is adding utmp/wtmp stuff to the lastlog
module according its docs, and adding following line to /etc/pam.d/ppp
case of dial-in server:
session required pam_lastlog.so
Patch for pam_lastlog follows (I used it successfully last 3 months).
fixed in ppp-2.3.7-1 and later source rpms.