blob: c1d77dbdcb04798ad569a28ed7a9159a4f30b36f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
#%PAM-1.0
#
# Most of these PAM modules have man pages included, like
# pam_unix(8) for example.
#
##################
# Authentication #
##################
#
auth required pam_env.so
auth optional pam_group.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
auth optional pam_gnome_keyring.so
##################
# Account checks #
##################
#
# Only root can login if file /etc/nologin exists.
# This is equivalent to NOLOGINS_FILE on login.defs
#
account required pam_nologin.so
#
# Enable restrictions by time, specified in /etc/security/time.conf
# This is equivalent to PORTTIME_CHECKS_ENAB on login.defs
#
account required pam_time.so
account required pam_unix.so
account sufficient pam_succeed_if.so uid < 100 quiet
account required pam_permit.so
#############################
# Password quality checking #
#############################
#
# Please note that unless cracklib and libpwquality are installed, setting
# passwords will not work unless the lines for the pam_pwquality module are
# commented out and the line for the traditional no-quality-check password
# changing is uncommented.
#
# The pam_pwquality module will check the quality of a user-supplied password
# against the dictionary installed for cracklib. Other tests are (or may be)
# done as well - see: man pam_pwquality
#
# Default password quality checking with pam_pwquality. If you don't want
# password quality checking, comment out these two lines and uncomment the
# traditional password handling line below.
password requisite pam_pwquality.so minlen=6 retry=3
password sufficient pam_unix.so nullok sha512 shadow minlen=6 try_first_pass use_authtok
# Traditional password handling without pam_pwquality password checking.
# Commented out by default to use the two pam_pwquality lines above.
#password sufficient pam_unix.so nullok sha512 shadow minlen=6
# ATTENTION: always keep this line for pam_deny.so:
password required pam_deny.so
#########################
# Session Configuration #
#########################
#
# This applies the limits specified in /etc/security/limits.conf
#
session required pam_limits.so
session required pam_unix.so
#session required pam_lastlog.so showfailed
#session optional pam_mail.so standard
session optional pam_gnome_keyring.so auto_start
|
