#%PAM-1.0

auth       [success=2 new_authtok_reqd=2 default=ignore]  pam_unix.so          try_first_pass nullok
-auth      [success=1 new_authtok_reqd=1 default=ignore]  pam_systemd_home.so
auth       required                    pam_deny.so
auth       optional                    pam_permit.so
auth       required                    pam_env.so

account    [success=2 new_authtok_reqd=2 default=ignore] pam_unix.so
-account   [success=1 new_authtok_reqd=1 default=ignore] pam_systemd_home.so
account    required pam_deny.so
account    optional                    pam_permit.so
account    required                    pam_time.so

password   [success=2 new_authtok_reqd=2 default=ignore]  pam_unix.so          try_first_pass nullok shadow
-password  [success=1 new_authtok_reqd=1 default=ignore]  pam_systemd_home.so
password    required pam_deny.so
password   optional                    pam_permit.so

session    required                    pam_limits.so
session    required                    pam_unix.so
session    optional                    pam_permit.so