authpf logs through syslog, but you might have to adjust /etc/syslog.conf to see all relevant messages. Add
!authpf *.* /var/log/authpf then create /var/log/authpf and SIGHUP syslogd. Then try to run authpf from an ordinary user account's shell. It will immediately terminate, but you should see an error logged in /var/log/authpf. Once logging works, repeat an ssh login as user with authpf shell, and post /var/log/authpf. Daniel
