aggiungo una cosa: se entro come utente ppp-data che è quello di apache e è nel sgruppo shadow da cli funziona regolare ... quindi è solo da web cjhe non va ! le FAQ dei pam-auth dicono "The most likely reason for this is that you are trying to authenticate via a local shadow file and you do not have permission to do so. The PAM modules handling shadow authentication (used on Linux and Solaris) require that the application have permission to read the shadow file (makes sense, eh?). If you are running php as a cgi or as a webserver module, it is executed as your webservers user and group. By default, most Linux and Solaris systems are configured to only allow the root user to read the shadow file. The recommended way around this is to change permissions on the shadow file so that it is group readable, and chgrp the file to the a group that the webserver is in." fatto ... ma a parte che ora funziona da cli nulla è cambiato da web !

