#%PAM-1.0

auth     required                    pam_faillock.so      preauth
auth     required                    pam_shells.so
auth     requisite                   pam_nologin.so
auth     required                    pam_env.so
auth     [success=1 default=ignore]  pam_fprintd.so
auth     [default=die]               pam_faillock.so      authfail
auth     optional                    pam_permit.so
auth     required                    pam_faillock.so      authsucc

account  include                     system-local-login

password required                    pam_fprintd.so
password optional                    pam_permit.so

session  optional                    pam_keyinit.so force revoke
session  include                     system-local-login