diff --git a/ChangeLog b/ChangeLog
index 929418433..e8fe5b4ff 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+20040623
+ - (dtucker) [auth1.c] Ensure do_pam_account is called for Protocol 1
+   connections with empty passwords.  Patch from davidwu at nbttech.com,
+   ok djm@
+
 20040622
  - (bal) [auth-passwd.c auth1.c] Clean up unused variables.
  - (dtucker) OpenBSD CVS Sync
@@ -1369,4 +1374,4 @@
    - (djm) Trim deprecated options from INSTALL. Mention UsePAM
    - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
 
-$Id: ChangeLog,v 1.3432 2004/06/22 05:06:46 dtucker Exp $
+$Id: ChangeLog,v 1.3433 2004/06/22 23:17:54 dtucker Exp $
diff --git a/auth1.c b/auth1.c
index e541935ce..ab6fd34dd 100644
--- a/auth1.c
+++ b/auth1.c
@@ -79,8 +79,13 @@ do_authloop(Authctxt *authctxt)
 	    (!options.kerberos_authentication || options.kerberos_or_local_passwd) &&
 #endif
 	    PRIVSEP(auth_password(authctxt, ""))) {
-		auth_log(authctxt, 1, "without authentication", "");
-		return;
+#ifdef USE_PAM
+		if (options.use_pam && (PRIVSEP(do_pam_account())))
+#endif
+		{
+			auth_log(authctxt, 1, "without authentication", "");
+			return;
+		}
 	}
 
 	/* Indicate that authentication is needed. */