# PAM configuration for Cockpit with 2FA
# Managed by KNELIAC (roles/security_2fa) — do not edit by hand.
auth requisite pam_nologin.so
auth required pam_env.so
auth required pam_faillock.so preauth
auth sufficient pam_unix.so try_first_pass
auth required pam_google_authenticator.so nullok
auth required pam_faillock.so authfail
auth required pam_deny.so

account required pam_nologin.so
account include system-auth
account required pam_faillock.so

session required pam_selinux.so close
session required pam_loginuid.so
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_selinux.so open
session optional pam_motd.so