#%PAM-1.0
# PAM stack for the greetd/ReGreet greeter.
#
# Deployed to /etc/pam.d/greetd by greetd-regreet.sh (@HOST@ → this machine's
# hostname at install time). Password first, then a single required FIDO/U2F
# touch — the same order hyprlock uses. `nouserok` lets users without an
# enrolled key log in with their password alone.
#
# The `auth` phase is spelled out (pam_shells/pam_nologin/system-auth) instead
# of `include system-login`, because this host's /etc/pam.d/system-login itself
# leads with an unconditional `pam_u2f.so` line ahead of the password stack. A
# plain `include` would pull that in, then this file's own pam_u2f line would
# run again — prompting for FIDO, then password, then FIDO a second time.
# Spelling the auth phase out here reproduces system-login's auth stack minus
# that stray line, so FIDO is asked for exactly once, after the password.
#
# NOTE: intentionally simpler than a tuigreet multi-factor stack — no
# pam_securetty / pam_oath, which a graphical greeter's single password field
# cannot drive cleanly.
auth       required     pam_shells.so
auth       requisite    pam_nologin.so
auth       include      system-auth
auth       required     pam_u2f.so nouserok cue origin=pam://@HOST@ appid=pam://@HOST@
account    include      system-login
password   include      system-login
session    include      system-login