blob: b5e3914e2281a0138fead3a55ccfd2cc3cd4df9e (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
#%PAM-1.0
auth required pam_faillock.so preauth
# Optionally use requisite above if you do not want to prompt for the password
# on locked accounts.
-auth [success=2 default=ignore] pam_systemd_home.so
auth [success=1 default=bad] pam_unix.so try_first_pass nullok
auth [default=die] pam_faillock.so authfail
auth optional pam_permit.so
auth required pam_env.so
auth required pam_faillock.so authsucc
# If you drop the above call to pam_faillock.so the lock will be done also
# on non-consecutive authentication failures.
-account [success=1 default=ignore] pam_systemd_home.so
account required pam_unix.so
account optional pam_permit.so
account required pam_time.so
{% if password_policy_enabled %}
-password [success=2 default=ignore] pam_systemd_home.so
password requisite pam_pwquality.so retry=3 \
difok={{ password_policy_difok }} \
minlen={{ password_policy_minlen }} \
dcredit={{ password_policy_dcredit }} \
ucredit={{ password_policy_ucredit }} \
ocredit={{ password_policy_ocredit }} \
lcredit={{ password_policy_lcredit }} \
minclass={{ password_policy_minclass }} \
maxrepeat={{ password_policy_maxrepeat }} \
maxclassrepeat={{ password_policy_maxclassrepeat }} \
gecoscheck={{ password_policy_gecoscheck }}
{% else %}
-password [success=1 default=ignore] pam_systemd_home.so
{% endif %}
password required pam_unix.so try_first_pass \
nullok \
shadow \
minlen={{ password_policy_minlen }}
password optional pam_permit.so
-session optional pam_systemd_home.so
session required pam_limits.so
session required pam_unix.so
session optional pam_permit.so
|
