Using custom shells for IMAP or HTTP auth must have been the parallel reality where checkpassword(1) never existed. I certainly never ran into this behavior in

Using custom shells for IMAP or HTTP auth must have been the parallel reality where checkpassword(1) never existed. I certainly never ran into this behavior in the wild and would have strenuously objected had I done so. Setting custom shells is fine for providing tunneled services over ssh tunnels or the like (many git hosts use this functionality) but using them for access control just meant your only safety net was whether the program's author was really good at preventing string overflows. This was never a good idea.