#%PAM-1.0
auth       required    pam_env.so
auth       required    pam_succeed_if.so user != root quiet
auth       sufficient  pam_succeed_if.so user ingroup nopasswdlogin
auth       substack    system-auth
account    required    pam_nologin.so
account    include     system-auth
password   include     system-auth
session    optional    pam_keyinit.so force revoke
session    required    pam_loginuid.so
session    include     system-auth
session    optional    pam_console.so