5 kx #%PAM-1.0
5 kx # pam_securetty.so is commented out since sshd already does a good job of
5 kx # protecting itself. You may uncomment it if you like, but then you may
5 kx # need to add additional consoles to /etc/securetty if you want to allow
5 kx # root logins on them, such as: ssh, pts/0, :0, etc
5 kx #auth required pam_securetty.so
5 kx # When using pam_faillock, print a message to the user if the account is
5 kx # locked. This lets the user know what is going on, but it also potentially
5 kx # gives additional information to attackers:
5 kx #auth requisite pam_faillock.so preauth
5 kx auth include system-auth
5 kx # To set a limit on failed authentications, the pam_faillock module
5 kx # can be enabled. See pam_faillock(8) for more information.
5 kx #auth [default=die] pam_faillock.so authfail
5 kx #auth sufficient pam_faillock.so authsucc
5 kx auth include postlogin
5 kx account required pam_nologin.so
5 kx account include system-auth
5 kx password include system-auth
5 kx session include system-auth
5 kx session include postlogin
5 kx session required pam_loginuid.so