#%PAM-1.0

auth      required  pam_faillock.so       preauth
# Optionally use requisite above if you do not want to prompt for the password
# on locked accounts.
auth      substack  system-auth-substack
auth      required  pam_env.so

account   required  pam_faillock.so       authsucc
# If you drop the above call to pam_faillock.so the lock will be done also
# on non-consecutive authentication failures.
account   substack  system-auth-substack
account   required  pam_time.so

password  substack  system-auth-substack

session   required  pam_limits.so
-session  optional  pam_systemd_home.so
session   required  pam_unix.so