openssh/sshd.pam

#%PAM-1.0
auth	   required	pam_sepermit.so
auth       substack     password-auth
auth       include      postlogin
# Used with polkit to reauthorize users in remote sessions
-auth      optional     pam_reauthorize.so prepare
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth
session    include      postlogin
# Used with polkit to reauthorize users in remote sessions
-session   optional     pam_reauthorize.so prepare
- upgrade to new upstream (#441066) - prevent initscript from killing itself on halt with upstart (#438449) - initscript status should show that the daemon is running only when the main daemon is still alive (#430882) 2008-04-07 20:14:31 +00:00			`#%PAM-1.0`
- remove obsolete --with-rsh (#478298) - add pam_sepermit to allow blocking confined users in permissive mode (#471746) - move system-auth after pam_selinux in the session stack 2009-01-15 10:52:07 +00:00			`auth required pam_sepermit.so`
Add postlogin to pam. (#718807) 2011-07-14 13:15:29 +00:00			`auth substack password-auth`
Add postlogin to pam. (#718807) 2011-07-14 11:46:20 +00:00			`auth include postlogin`
Add pam_reauthorize.so to sshd.pam (#1115977) 2014-07-03 11:58:57 +00:00			`# Used with polkit to reauthorize users in remote sessions`
			`-auth optional pam_reauthorize.so prepare`
- upgrade to new upstream (#441066) - prevent initscript from killing itself on halt with upstart (#438449) - initscript status should show that the daemon is running only when the main daemon is still alive (#430882) 2008-04-07 20:14:31 +00:00			`account required pam_nologin.so`
Changed pam stack to password-auth 2009-09-16 08:12:30 +00:00			`account include password-auth`
			`password include password-auth`
- add LANGUAGE to accepted/sent environment variables (#443231) - use pam_selinux to obtain the user context instead of doing it itself - unbreak server keep alive settings (patch from upstream) - small addition to scp manpage 2008-05-19 16:53:29 +00:00			`# pam_selinux.so close should be the first session rule`
			`session required pam_selinux.so close`
- upgrade to new upstream (#441066) - prevent initscript from killing itself on halt with upstart (#438449) - initscript status should show that the daemon is running only when the main daemon is still alive (#430882) 2008-04-07 20:14:31 +00:00			`session required pam_loginuid.so`
- add LANGUAGE to accepted/sent environment variables (#443231) - use pam_selinux to obtain the user context instead of doing it itself - unbreak server keep alive settings (patch from upstream) - small addition to scp manpage 2008-05-19 16:53:29 +00:00			`# pam_selinux.so open should only be followed by sessions to be executed in the user context`
			`session required pam_selinux.so open env_params`
			`session optional pam_keyinit.so force revoke`
Changed pam stack to password-auth 2009-09-16 08:12:30 +00:00			`session include password-auth`
Add postlogin to pam. (#718807) 2011-07-14 11:46:20 +00:00			`session include postlogin`
Add pam_reauthorize.so to sshd.pam (#1115977) 2014-07-03 11:58:57 +00:00			`# Used with polkit to reauthorize users in remote sessions`
			`-session optional pam_reauthorize.so prepare`