I’ve steered clear of PAM for dovecot authentication.
For that matter, I’ve always steered clear of PAM in general. My first
distro was Slackware, which didn’t have it.
And up until last week, I had at least one dovecot running on Arch.
I suppose I got lucky and my hesitance protected me.
FWIW if someone really wants to learn Unix, I recommend Slackware.
It’s a solid old-school design, and you’ll learn principles using it.
AUGH! Can we just find a better system than PAM for authentication? It is absolutely full of these traps that leave your system wide open.
Well, the actual trap in this case was an actual bug which could have occurred with any authentication system, which just happened to be exposed by a specific faulty configuration.