Important: radicale user need access to /etc/shadow by e.g. chgrp radicale /etc/shadow chmod g+r the fuck and why??? pam has a setuid helper exactly to avoid this??? (yea setuid helpers suck but it's still less bad than giving random services read perms)