# # /etc/pam.d/common-auth - authentication settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authentication modules that define # the central authentication scheme for use on the system # (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the # traditional Unix authentication mechanisms. # # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # here are the per-package modules (the "Primary" block) auth [success=1 default=ignore] pam_exec.so quiet /usr/lib/core/lockout-not-enabled.sh auth requisite pam_faillock.so preauth auth [success=4 authinfo_unavail=ignore default=bad] pam_extrausers.so nodelay nullok try_first_pass auth [success=3 default=ignore] pam_unix.so nullok try_first_pass auth [success=1 default=ignore] pam_exec.so quiet /usr/lib/core/lockout-not-enabled.sh auth [default=ignore] pam_faillock.so authfail # here's the fallback if no module succeeds auth requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around auth required pam_permit.so # and here are more per-package modules (the "Additional" block) auth [success=1 default=ignore] pam_exec.so quiet /usr/lib/core/lockout-not-enabled.sh auth sufficient pam_faillock.so authsucc # end of pam-auth-update config