It seems the last update of /etc/login.defs enables LOG_UNKFAIL_ENAB, which can lead to passwords gathered in the error log. I, for one, enter the password in place of the login name every now and then. Defies the one-way hashing of passwords as well as the concept of shadow passwords (having passwords storage in one place and one place only, separated from everything else). This should never be the distro default. The relevant manpage snippet for reference: LOG_UNKFAIL_ENAB (boolean) If yes then unknown usernames will be included when a login failure is recorded. Note that this is a potential security risk; a common login failure mode is transposition of the user name and password, thus this mode will often cause passwords to accumulate in the failure logs. If this option is disabled then unknown usernames will be suppressed in login failure messages.
It's newly included in the config, but it's explicitly disabled. My bad: > LOG_UNKFAIL_ENAB no
