#%PAM-1.0

auth      sufficient     pam_unix.so          try_first_pass nullok
-auth     sufficient     pam_systemd_home.so
auth      [default=die]  pam_faillock.so      authfail

-account   sufficient    pam_systemd_home.so
account    sufficient    pam_unix.so
account    required      pam_deny.so

password   sufficient    pam_unix.so          try_first_pass nullok shadow
-password  sufficient    pam_systemd_home.so
password   required      pam_deny.so