#%PAM-1.0

auth       required                              pam_faillock.so      preauth
# Optionally use requisite above if you do not want to prompt for the password
# on locked accounts.
auth       [success=2 new_authtok_reqd=2 default=ignore]  pam_unix.so          try_first_pass nullok
-auth      [success=1 new_authtok_reqd=1 default=ignore]  pam_systemd_home.so
auth       [default=die]                         pam_faillock.so      authfail
auth       optional                              pam_permit.so
auth       required                              pam_env.so
auth       required                              pam_faillock.so      authsucc
# If you drop the above call to pam_faillock.so the lock will be done also
# on non-consecutive authentication failures.

account    [success=1 new_authtok_reqd=1 default=ignore]  pam_unix.so
-account   required                              pam_systemd_home.so
account    optional                              pam_permit.so
account    required                              pam_time.so

password   [success=1 new_authtok_reqd=1 default=ignore]  pam_unix.so          try_first_pass nullok shadow
-password  required                              pam_systemd_home.so
password   optional                              pam_permit.so

session    required                              pam_limits.so
session    required                              pam_unix.so
session    optional                              pam_permit.so