forked from cockpit/cockpit
95f291257b
It requires a pam_oath in a version that implements the no_usersfile_okay argument. Provisionally using 2.6.11.12 as a version to indicate it, the patch is not yet merged upstream, but this is likely a version upstream will not assign. Patch: https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/42 Upstream: https://github.com/openSUSE/cockpit/pull/27
12 lines
541 B
Plaintext
12 lines
541 B
Plaintext
#%PAM-1.0
|
|
auth substack common-auth
|
|
# List of users to deny access to Cockpit, by default root is included.
|
|
auth required pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
|
|
account required pam_nologin.so
|
|
account include common-account
|
|
password include common-password
|
|
session required pam_loginuid.so
|
|
session optional pam_keyinit.so force revoke
|
|
session include common-session
|
|
auth [user_unknown=ignore success=ok] pam_oath.so usersfile=${HOME}/.pam_oath_usersfile no_usersfile_okay window=20 digits=6
|