pam_exec environment data is not a safe channel for secrets

The article warns that pam_exec, a PAM module that runs external commands during authentication stages, exposes PAM items as environment variables that can be influenced by clients or service configuration. Scripts that parse these values as shell fragments, log them insecurely, or use them in command lines may introduce vulnerabilities. The expose_authtok option is especially risky because it passes the authentication token to the called command, which could leak credentials if the command is writable or insecure. The author recommends administrator-owned helpers, fixed executables, protected logs, and dedicated file descriptors or protected temporary files for secrets. Thorough testing of failure paths is also advised, since the PAM control flags determine whether errors accidentally allow authentication.