Serial console login fails with correct credentials: pam_opnsense.so missing authtok_prompt in /etc/pam.d/login

## Summary Serial console login (via getty on a serial tty) silently rejects correct credentials. SSH login with the same credentials works fine. The root cause is an inconsistency in PAM configuration between the `login` and `sshd` services. ## Version information - **Current version where bug exists:** 26.1.6_2 (amd64) - **Last version where bug did not exist:** Unknown — we came to OPNsense fresh on this hardware and cannot confirm when this was introduced. ## Root cause `/etc/pam.d/login` uses `include system`, which calls `pam_opnsense.so` without the `authtok_prompt=Password:` parameter: ``` # /etc/pam.d/system (included by login) auth sufficient pam_opnsense.so ← no authtok_prompt parameter ``` `/etc/pam.d/sshd` (generated by OPNsense's template system) calls it correctly: ``` # /etc/pam.d/sshd auth sufficient pam_opnsense.so authtok_prompt=Password: ← has the parameter ``` Without `authtok_prompt=Password:`, `pam_opnsense.so` does not correctly prompt for or receive the password token when called from the `login` service, causing authentication to fail regardless of the credentials supplied. ## Steps to reproduce 1. Enable serial console on OPNsense 2. Connect via serial and wait for login prompt 3. Enter correct root (or admin) credentials 4. Observe: `Login incorrect` — credentials are rejected despite being correct 5. SSH with the same credentials → succeeds ## Suggested fix OPNsense's template system generates `/etc/pam.d/sshd` via `OPNsense/Auth/sshd.pam`. The same approach should be applied to `login` — add a `login.pam` template to `/usr/local/opnsense/service/templates/OPNsense/Auth/` with `authtok_prompt=Password:` explicitly set on `pam_opnsense.so`. ## Workaround Add a `login.pam` template to the OPNsense Auth template system: ```sh cat > /usr/local/opnsense/service/templates/OPNsense/Auth/login.pam << 'EOF' auth sufficient pam_opnsense.so authtok_prompt=Password: auth required pam_unix.so no_warn try_first_pass auth optional pam_group.so no_warn group=wheel root_only fail_safe ruser auth optional pam_lastlog.so no_warn account required pam_nologin.so account required pam_opnsense.so account required pam_unix.so account required pam_login_access.so password required pam_opnsense.so password required pam_unix.so no_warn try_first_pass session required pam_lastlog.so no_warn session optional pam_motd.so session optional pam_mail.so no_warn quiet EOF echo 'login.pam:/etc/pam.d/login' >> /usr/local/opnsense/service/templates/OPNsense/Auth/+TARGETS configctl template reload OPNsense/Auth ```