freebsd-src/etc/pam.d/xdm

#
# $FreeBSD$
#
# PAM configuration for the "xdm" service
#

# auth
auth		required	pam_nologin.so		no_warn
#auth		sufficient	pam_krb5.so		no_warn try_first_pass
#auth		sufficient	pam_ssh.so		no_warn try_first_pass
auth		required	pam_unix.so		no_warn try_first_pass

# account
#account 	required	pam_krb5.so
account		required	pam_unix.so

# session
#session 	required	pam_ssh.so		want_agent
session		required	pam_lastlog.so		no_fail

# password
password	required	pam_deny.so
pam.d-style configuration, auto-generated from pam.conf. Sponsored by: DARPA, NAI Labs 2001-12-05 21:06:21 +00:00			`#`
			`# $FreeBSD$`
			`#`
			`# PAM configuration for the "xdm" service`
			`#`

			`# auth`
Major cleanup & homogenization. 2003-02-10 00:50:03 +00:00			`auth required pam_nologin.so no_warn`
			`#auth sufficient pam_krb5.so no_warn try_first_pass`
			`#auth sufficient pam_ssh.so no_warn try_first_pass`
			`auth required pam_unix.so no_warn try_first_pass`
pam.d-style configuration, auto-generated from pam.conf. Sponsored by: DARPA, NAI Labs 2001-12-05 21:06:21 +00:00
			`# account`
Major cleanup & homogenization. 2003-02-10 00:50:03 +00:00			`#account required pam_krb5.so`
Awright, egg on my face. I should have taken more time with this. The conversion script generated the wrong format, so the configuration files didn't actually work. Good thing I hadn't thrown the switch yet... Sponsored by: DARPA, NAI Labs (but the f***ups are all mine) 2001-12-05 21:26:00 +00:00			`account required pam_unix.so`
pam.d-style configuration, auto-generated from pam.conf. Sponsored by: DARPA, NAI Labs 2001-12-05 21:06:21 +00:00
			`# session`
Add the want_agent option to the commented-out "session" pam_ssh entry. 2003-02-16 13:02:03 +00:00			`#session required pam_ssh.so want_agent`
X logins should be recorded in lastlog / wtmp / utmp. I have no idea why this wasn't there already... it makes much more sense this way. MFC after: 2 weeks 2005-04-28 07:59:09 +00:00			`session required pam_lastlog.so no_fail`
the default password policy for xdm should be pam_deny, since it is incapable of holding a meaningful conversation. 2004-02-20 21:59:51 +00:00
			`# password`
			`password required pam_deny.so`