Adrian, > Yes, that's what I did in the end. Thank you. > I didn't want that solution at first because I wanted to separate the > error for bad credentials from the error for db server not running. I > managed to do that by "output buffering" the error message and > analysing the string. FYI, we're using pam_auth together with a remote NFS authentication server to validate the users of our latest intranet project. It works flawlessly. -Josh Berkus