systemd/factory/etc/pam.d/system-auth

# This file is part of systemd.

auth     sufficient pam_unix.so nullok try_first_pass
auth     required   pam_deny.so

account  required   pam_nologin.so
account  sufficient pam_unix.so
account  required   pam_permit.so

password sufficient pam_unix.so nullok sha512 shadow try_first_pass try_authtok
password required   pam_deny.so

-session optional   pam_loginuid.so
-session optional   pam_systemd.so
session  sufficient pam_unix.so
login: update systemd-user PAM configuration file 2014-07-29 13:01:51 +02:00			`# This file is part of systemd.`

			`auth sufficient pam_unix.so nullok try_first_pass`
factory: tighten PAM configuration Apparently PAM reacts differently on different systems (?) and if no authoritative matching module is found might either succeed/fail, depending on the system. Let's lock this down explicitly, by hooking in pam_deny.so. Of course, these PAM files are just examples, and no distro in its right mind would ship these unmodified, but let's default to something safe. Fixes: #12950 2019-07-12 12:17:12 +02:00			`auth required pam_deny.so`
login: update systemd-user PAM configuration file 2014-07-29 13:01:51 +02:00
			`account required pam_nologin.so`
			`account sufficient pam_unix.so`
factory: tighten PAM configuration Apparently PAM reacts differently on different systems (?) and if no authoritative matching module is found might either succeed/fail, depending on the system. Let's lock this down explicitly, by hooking in pam_deny.so. Of course, these PAM files are just examples, and no distro in its right mind would ship these unmodified, but let's default to something safe. Fixes: #12950 2019-07-12 12:17:12 +02:00			`account required pam_permit.so`
login: update systemd-user PAM configuration file 2014-07-29 13:01:51 +02:00
			`password sufficient pam_unix.so nullok sha512 shadow try_first_pass try_authtok`
factory: tighten PAM configuration Apparently PAM reacts differently on different systems (?) and if no authoritative matching module is found might either succeed/fail, depending on the system. Let's lock this down explicitly, by hooking in pam_deny.so. Of course, these PAM files are just examples, and no distro in its right mind would ship these unmodified, but let's default to something safe. Fixes: #12950 2019-07-12 12:17:12 +02:00			`password required pam_deny.so`
login: update systemd-user PAM configuration file 2014-07-29 13:01:51 +02:00
			`-session optional pam_loginuid.so`
			`-session optional pam_systemd.so`
			`session sufficient pam_unix.so`