Index: auth-pam.c
===================================================================
RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/auth-pam.c,v
retrieving revision 1.105
diff -u -p -r1.105 auth-pam.c
--- auth-pam.c	1 Jun 2004 01:28:20 -0000	1.105
+++ auth-pam.c	1 Jun 2004 14:10:42 -0000
@@ -93,6 +93,7 @@ struct pam_ctxt {
 	int		 pam_psock;
 	int		 pam_csock;
 	int		 pam_done;
+	int		 pam_pending_resp;
 };
 
 static void sshpam_free_ctx(void *);
@@ -590,7 +591,7 @@ sshpam_query(void *ctx, char **name, cha
 		switch (type) {
 		case PAM_PROMPT_ECHO_ON:
 		case PAM_PROMPT_ECHO_OFF:
-			*num = 1;
+			ctxt->pam_pending_resp = *num = 1;
 			len = plen + strlen(msg) + 1;
 			**prompts = xrealloc(**prompts, len);
 			plen += snprintf(**prompts + plen, len, "%s", msg);
@@ -608,16 +609,27 @@ sshpam_query(void *ctx, char **name, cha
 		case PAM_SUCCESS:
 		case PAM_AUTH_ERR:
 			if (**prompts != NULL) {
-				/* drain any accumulated messages */
 				debug("PAM: %s", **prompts);
-				buffer_append(&loginmsg, **prompts,
-				    strlen(**prompts));
-				xfree(**prompts);
-				**prompts = NULL;
+				if (compat20 && type == PAM_AUTH_ERR) {
+					/* tell the user about it now */
+					ctxt->pam_pending_resp = *num = 0;
+					*info = xrealloc(*info, len);
+					strlcpy(*info, **prompts, len);
+					xfree(**prompts);
+					**prompts = NULL;
+					xfree(msg);
+					return (0);
+				} else {	
+					/* save for display later */
+					buffer_append(&loginmsg, **prompts,
+					    strlen(**prompts));
+					xfree(**prompts);
+					**prompts = NULL;
+				}
 			}
 			if (type == PAM_SUCCESS) {
 				import_environments(&buffer);
-				*num = 0;
+				ctxt->pam_pending_resp = *num = 0;
 				**echo_on = 0;
 				ctxt->pam_done = 1;
 				xfree(msg);
@@ -629,7 +641,7 @@ sshpam_query(void *ctx, char **name, cha
 			    get_remote_name_or_ip(utmp_len, options.use_dns));
 			/* FALLTHROUGH */
 		default:
-			*num = 0;
+			ctxt->pam_pending_resp = *num = 0;
 			**echo_on = 0;
 			xfree(msg);
 			ctxt->pam_done = -1;
@@ -656,10 +668,12 @@ sshpam_respond(void *ctx, u_int num, cha
 	default:
 		return (-1);
 	}
-	if (num != 1) {
-		error("PAM: expected one response, got %u", num);
+	if (num != ctxt->pam_pending_resp) {
+		error("PAM: expected %d responses, got %u",
+		    ctxt->pam_pending_resp, num);
 		return (-1);
-	}
+	} else if (num == 0)
+		return(-1);
 	buffer_init(&buffer);
 	buffer_put_cstring(&buffer, *resp);
 	if (ssh_msg_send(ctxt->pam_psock, PAM_AUTHTOK, &buffer) == -1) {
