#%PAM-1.0

auth       required                    pam_faillock.so      preauth
# Optionally use requisite above if you do not want to prompt for the password
# on locked accounts.
-auth      [success=2 default=ignore]  pam_systemd_home.so
auth       [success=1 default=bad]     pam_unix.so          try_first_pass nullok
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc
# If you drop the above call to pam_faillock.so the lock will be done also
# on non-consecutive authentication failures.

-account   [success=1 default=ignore]  pam_systemd_home.so
account    required                    pam_unix.so
account    optional                    pam_permit.so
account    required                    pam_time.so

{% if password_policy_enabled %}
-password  [success=2 default=ignore]  pam_systemd_home.so
password   requisite                   pam_pwquality.so     retry=3 \
                                                            difok={{ password_policy_difok }} \
                                                            minlen={{ password_policy_minlen }} \
                                                            dcredit={{ password_policy_dcredit }} \
                                                            ucredit={{ password_policy_ucredit }} \
                                                            ocredit={{ password_policy_ocredit }} \
                                                            lcredit={{ password_policy_lcredit }} \
                                                            minclass={{ password_policy_minclass }} \
                                                            maxrepeat={{ password_policy_maxrepeat }} \
                                                            maxclassrepeat={{ password_policy_maxclassrepeat }} \
                                                            gecoscheck={{ password_policy_gecoscheck }}
{% else %}
-password  [success=1 default=ignore]  pam_systemd_home.so
{% endif %}
password   required                    pam_unix.so          try_first_pass \
                                                            nullok \
                                                            shadow \
                                                            minlen={{ password_policy_minlen }}
password   optional                    pam_permit.so

-session   optional                    pam_systemd_home.so
session    required                    pam_limits.so
session    required                    pam_unix.so
session    optional                    pam_permit.so