[dpkirchner]

It was pretty easy to get someone's password by tailing /var/log/messages and waiting to see a auth failure followed by a success with a totally different username (i.e. not what looks like an entry correcting a typo). That only worked on shared hosting environments, of course.