ce2648b0d2
doesn't solve the problem of root being allowed to log in, but that sort of thing is something PAM should be doing anyway.