auth [success=done ignore=ignore default=bad] pam_selinux_permit.so auth substack password-auth -auth optional pam_gnome_keyring.so -auth optional pam_ssh.so use_first_pass keyfiles=id_ed25519,id_ecdsa,id_dsa,id_rsa -auth optional pam_kwallet5.so #-auth optional pam_exec.so expose_authtok /usr/local/bin/gpg-pam-exec auth include postlogin account required pam_nologin.so account include password-auth password include password-auth session required pam_selinux.so close session required pam_loginuid.so session optional pam_console.so -session optional pam_ck_connector.so session required pam_selinux.so open session optional pam_keyinit.so force revoke session required pam_namespace.so session include password-auth -session optional pam_gnome_keyring.so auto_start -session optional pam_kwallet5.so -session optional pam_ssh.so use_first_pass session include postlogin