Surviving the SSHpocolypse (github.com)

Maybe I'm missing something, but why would you patch SSH instead of just using something like pam_mysql and nscd?

It's not clear from the post if they're still using a custom patch. It looks like the fairly new option AuthorizedKeysCommand could save them some work, since you can plug in an arbitrary external script that way.