Use proper method to calculate the path to Python interpreter

salt/auth/pam.py

@@ -223,12 +223,29 @@ def authenticate(username, password):
 
     ``password``: the password in plain text
     """
+
+    def __find_pyexe():
+        """
+        Provides the path to the Python interpreter to use.
+
+        First option: the system's Python 3 interpreter
+        If not found, it fallback to use the running Python interpreter (sys.executable)
+
+        This can be overwritten via "auth.pam.python" configuration parameter.
+        """
+        if __opts__.get("auth.pam.python"):
+            return __opts__.get("auth.pam.python")
+        elif os.path.exists("/usr/bin/python3"):
+            return "/usr/bin/python3"
+        else:
+            return sys.executable
+
     env = os.environ.copy()
     env["SALT_PAM_USERNAME"] = username
     env["SALT_PAM_PASSWORD"] = password
     env["SALT_PAM_SERVICE"] = __opts__.get("auth.pam.service", "login")
     env["SALT_PAM_ENCODING"] = __salt_system_encoding__
-    pyexe = pathlib.Path(__opts__.get("auth.pam.python", sys.executable)).resolve()
+    pyexe = pathlib.Path(__find_pyexe()).resolve()
     pyfile = pathlib.Path(__file__).resolve()
     if not pyexe.exists():
         log.error("Error 'auth.pam.python' config value does not exist: %s", pyexe)

tests/pytests/unit/auth/test_pam.py

@@ -57,6 +57,8 @@ class Ret:
         "salt.auth.pam.subprocess.run", return_value=Ret
     ) as run_mock, tempfile.NamedTemporaryFile() as f, patch(
         "salt.auth.pam.sys.executable", f.name
+    ), patch(
+        "os.path.exists", return_value=False
     ):
         assert salt.auth.pam.auth(
             username="fnord", password="fnord", service="login", encoding="utf-8"