27 lines
1.3 KiB
Plaintext
27 lines
1.3 KiB
Plaintext
#%PAM-1.0
|
|
# PAM stack for the greetd/ReGreet greeter.
|
|
#
|
|
# Deployed to /etc/pam.d/greetd by greetd-regreet.sh (@HOST@ → this machine's
|
|
# hostname at install time). Password first, then a single required FIDO/U2F
|
|
# touch — the same order hyprlock uses. `nouserok` lets users without an
|
|
# enrolled key log in with their password alone.
|
|
#
|
|
# The `auth` phase is spelled out (pam_shells/pam_nologin/system-auth) instead
|
|
# of `include system-login`, because this host's /etc/pam.d/system-login itself
|
|
# leads with an unconditional `pam_u2f.so` line ahead of the password stack. A
|
|
# plain `include` would pull that in, then this file's own pam_u2f line would
|
|
# run again — prompting for FIDO, then password, then FIDO a second time.
|
|
# Spelling the auth phase out here reproduces system-login's auth stack minus
|
|
# that stray line, so FIDO is asked for exactly once, after the password.
|
|
#
|
|
# NOTE: intentionally simpler than a tuigreet multi-factor stack — no
|
|
# pam_securetty / pam_oath, which a graphical greeter's single password field
|
|
# cannot drive cleanly.
|
|
auth required pam_shells.so
|
|
auth requisite pam_nologin.so
|
|
auth include system-auth
|
|
auth required pam_u2f.so nouserok cue origin=pam://@HOST@ appid=pam://@HOST@
|
|
account include system-login
|
|
password include system-login
|
|
session include system-login
|