Newer Ubuntu is seeing authentication failures in auth.log

This issue came to life when we used both the Vault SSH Helper and Fail2Ban in testing. With Fail2Ban we got IP bans due to authentication failures caused by PAM.
See the below excerpt from auth.log upon a successful login with the OTP.

`Dec 8 21:45:50 ubuntu2 sshd[2511]: pam_unix(sshd:auth): unrecognized option [not_set_pass]
Dec 8 21:45:50 ubuntu2 sshd[2511]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=X.X.X.X user=ubuntu
Dec 8 21:45:50 ubuntu2 sshd[2509]: Accepted keyboard-interactive/pam for ubuntu from X.X.X.X port 42762 ssh2
Dec 8 21:45:50 ubuntu2 sshd[2509]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Dec 8 21:45:50 ubuntu2 systemd-logind[673]: New session 5 of user ubuntu.`

After communication with HashiCorp support we found the solution is a change in the recommended settings in the /etc/pam.d/sshd file:
Change from:
`auth requisite pam_exec.so quiet expose_authtok log=/tmp/vaultssh.log /usr/local/bin/vault-ssh-helper -config=/etc/vault-ssh-helper.d/config.hcl`

To:
`auth sufficient pam_exec.so quiet expose_authtok log=/tmp/vaultssh.log /usr/local/bin/vault-ssh-helper -config=/etc/vault-ssh-helper.d/config.hcl`

That will remove the authentication failure from the auth.log and as such, Fail2Ban and other similar tools shouldn't IP ban successful logins due to the interaction.

Start by locating the documentation that describes the recommended /etc/pam.d/sshd configuration for the Vault SSH Helper. Update the example to reflect the reported PAM setting, then verify that successful OTP logins no longer produce authentication failures in auth.log that could trigger Fail2Ban.

Written by the indexing model from the issue text.