Thank you, denta.
Just to clarify regarding the authpf login class -- it overrides the userid shell and motd settings:
Code:
#
# Authpf accounts get a special motd and shell
# authpf:\
:welcome=/etc/motd.authpf:\
:shell=/usr/sbin/authpf:\
:tc=default:
I didn't care about the motd setting, since I didn't use the file, but the authenticating userids needs to have the correct shell. Using the class ensures it; the override means that the jggimi-authpf userid never gets to use the ksh shell as defined in /etc/*passwd -- the adduser(8) script won't set the correct shell but it does permit choosing the correct class.