I have backported and tested the fix, RFS is #662076. Note that it still won't do anything without "auth optional pam_shield.so" at the top of common-auth, but it will block with that. Still working on upstream and then bringing in the latest from there, shouldn't be too long.
Thanks to Laurentiu for the heads-up, and my apologies for how long it took; a family emergency intervened. -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org