Incorrect handling of PAM's RHOST item
This checks whether RHOST is either NULL or an empty string. However, the PAM application developer's guide states that the local host is identified by "localhost" (and an unknown caller is NULL or empty string). The check should be rewritten to include a strcmp with "localhost".