#%PAM-1.0
# PAM stack for the greetd/ReGreet greeter.
#
# Deployed to /etc/pam.d/greetd by greetd-regreet.sh (@HOST@ → this machine's
# hostname at install time). Mirrors the working lightdm stack: password via
# system-login plus a required FIDO/U2F touch. `nouserok` lets users without an
# enrolled key log in with their password alone.
#
# NOTE: intentionally simpler than a tuigreet multi-factor stack — no
# pam_securetty / pam_oath, which a graphical greeter's single password field
# cannot drive cleanly.
auth       include      system-login
auth       required     pam_u2f.so nouserok cue origin=pam://@HOST@ appid=pam://@HOST@
account    include      system-login
password   include      system-login
session    include      system-login