#%PAM-1.0
auth            required        pam_env.so
auth            required        pam_permit.so

account         required        pam_nologin.so
account         required        pam_unix.so

password        required        pam_deny.so

session         required        pam_loginuid.so
-session        optional        pam_systemd.so
session         optional        pam_keyinit.so force revoke