Major cleanup & homogenization.

etc/pam.d/ftpd

@@ -5,20 +5,20 @@
 #
 
 # auth
-auth		required	pam_nologin.so	no_warn
-#auth		sufficient	pam_kerberosIV.so	no_warn
-#auth		sufficient	pam_krb5.so	no_warn
-#auth           sufficient      pam_ssh.so      no_warn try_first_pass
-auth		sufficient	pam_opie.so	no_warn no_fake_prompts
+auth		required	pam_nologin.so		no_warn
+auth		sufficient	pam_opie.so		no_warn no_fake_prompts
 auth		requisite	pam_opieaccess.so	no_warn
-auth		required	pam_unix.so	no_warn try_first_pass
+#auth		sufficient	pam_kerberosIV.so	no_warn
+#auth		sufficient	pam_krb5.so		no_warn
+#auth           sufficient      pam_ssh.so		no_warn try_first_pass
+auth		required	pam_unix.so		no_warn try_first_pass
 
 # account
-#account	required	pam_kerberosIV.so
-#account	required	pam_krb5.so
+#account 	required	pam_kerberosIV.so
+#account 	required	pam_krb5.so
 account		required	pam_unix.so
 
 # session
-#session	required	pam_kerberosIV.so
-#session	required	pam_krb5.so
-#session	required	pam_ssh.so
+#session 	required	pam_kerberosIV.so
+#session 	required	pam_krb5.so
+session		required	pam_permit.so

etc/pam.d/gdm

@@ -5,22 +5,19 @@
 #
 
 # auth
-auth		required	pam_nologin.so	no_warn
-#auth		sufficient	pam_kerberosIV.so	no_warn	try_first_pass
-#auth		sufficient	pam_krb5.so	no_warn	try_first_pass
-#auth		sufficient	pam_ssh.so	no_warn	try_first_pass
-auth		required	pam_unix.so	no_warn	try_first_pass
+auth		required	pam_nologin.so		no_warn
+#auth		sufficient	pam_kerberosIV.so	no_warn try_first_pass
+#auth		sufficient	pam_krb5.so		no_warn try_first_pass
+#auth		sufficient	pam_ssh.so		no_warn try_first_pass
+auth		required	pam_unix.so		no_warn try_first_pass
 
 # account
-#account	required	pam_kerberosIV.so
-#account	required	pam_krb5.so
+#account 	required	pam_kerberosIV.so
+#account 	required	pam_krb5.so
 account		required	pam_unix.so
 
 # session
-#session	required	pam_kerberosIV.so
-#session	required	pam_krb5.so
-#session	required	pam_ssh.so
+#session 	required	pam_kerberosIV.so
+#session 	required	pam_krb5.so
+#session 	optional	pam_ssh.so
 session		required	pam_permit.so
-
-# password
-password	required	pam_deny.so

etc/pam.d/imap

@@ -5,8 +5,8 @@
 #
 
 # auth
-#auth		required	pam_nologin.so	no_warn
-#auth		sufficient	pam_opie.so	no_warn no_fake_prompts
-#auth		requisite	pam_opieaccess.so	no_warn
-#auth		required	pam_ssh.so	no_warn try_first_pass
-#auth		required	pam_unix.so	no_warn try_first_pass
+#auth		required	pam_nologin.so		no_warn
+#auth		sufficient	pam_kerberosIV.so	no_warn try_first_pass
+#auth		sufficient	pam_krb5.so		no_warn try_first_pass
+#auth		sufficient	pam_ssh.so		no_warn try_first_pass
+auth		required	pam_unix.so		no_warn try_first_pass

etc/pam.d/kde

@@ -5,10 +5,19 @@
 #
 
 # auth
-auth		required	pam_nologin.so	no_warn
-auth		sufficient	pam_opie.so	no_warn no_fake_prompts
-auth		requisite	pam_opieaccess.so	no_warn
+auth		required	pam_nologin.so		no_warn
 #auth		sufficient	pam_kerberosIV.so	no_warn try_first_pass
-#auth		sufficient	pam_krb5.so	no_warn try_first_pass
-#auth		required	pam_ssh.so	no_warn try_first_pass
-auth		required	pam_unix.so	no_warn try_first_pass
+#auth		sufficient	pam_krb5.so		no_warn try_first_pass
+#auth		sufficient	pam_ssh.so		no_warn try_first_pass
+auth		required	pam_unix.so		no_warn try_first_pass
+
+# account
+#account 	required	pam_kerberosIV.so
+#account 	required	pam_krb5.so
+account		required	pam_unix.so
+
+# session
+#session 	required	pam_kerberosIV.so
+#session 	required	pam_krb5.so
+#session 	optional	pam_ssh.so
+session		required	pam_permit.so

etc/pam.d/login

@@ -5,29 +5,29 @@
 #
 
 # auth
-auth		required	pam_nologin.so	no_warn
-auth		sufficient	pam_self.so	no_warn
-auth		sufficient	pam_opie.so	no_warn no_fake_prompts
+auth		required	pam_nologin.so		no_warn
+auth		sufficient	pam_self.so		no_warn
+auth		sufficient	pam_opie.so		no_warn no_fake_prompts
 auth		requisite	pam_opieaccess.so	no_warn
 #auth		sufficient	pam_kerberosIV.so	no_warn try_first_pass
-#auth		sufficient	pam_krb5.so	no_warn try_first_pass
-#auth		sufficient	pam_ssh.so	no_warn try_first_pass
-auth		required	pam_unix.so	no_warn try_first_pass nullok
+#auth		sufficient	pam_krb5.so		no_warn try_first_pass
+#auth		sufficient	pam_ssh.so		no_warn try_first_pass
+auth		required	pam_unix.so		no_warn try_first_pass nullok
 
 # account
-#account	required	pam_kerberosIV.so
-#account	required	pam_krb5.so
+#account 	required	pam_kerberosIV.so
+#account 	required	pam_krb5.so
 account		required	pam_login_access.so
 account		required	pam_securetty.so
 account		required	pam_unix.so
 
 # session
-#session	required	pam_kerberosIV.so
-#session	required	pam_krb5.so
-#session	required	pam_ssh.so
-session		required	pam_lastlog.so	no_fail
+#session 	required	pam_kerberosIV.so
+#session 	required	pam_krb5.so
+#session 	optional	pam_ssh.so
+session		required	pam_lastlog.so		no_fail
 
 # password
 #password	sufficient	pam_kerberosIV.so	no_warn try_first_pass
-#password	sufficient	pam_krb5.so	no_warn try_first_pass
-password	required	pam_unix.so	no_warn try_first_pass
+#password	sufficient	pam_krb5.so		no_warn try_first_pass
+password	required	pam_unix.so		no_warn try_first_pass

etc/pam.d/other

@@ -5,16 +5,25 @@
 #
 
 # auth
-auth		required	pam_nologin.so	no_warn
-auth		sufficient	pam_opie.so	no_warn no_fake_prompts
+auth		required	pam_nologin.so		no_warn
+auth		sufficient	pam_opie.so		no_warn no_fake_prompts
 auth		requisite	pam_opieaccess.so	no_warn
-auth		required	pam_unix.so	no_warn try_first_pass
+#auth		sufficient	pam_kerberosIV.so	no_warn try_first_pass
+#auth		sufficient	pam_krb5.so		no_warn try_first_pass
+#auth		sufficient	pam_ssh.so		no_warn try_first_pass
+auth		required	pam_unix.so		no_warn try_first_pass
 
 # account
+#account 	required	pam_kerberosIV.so
+#account 	required	pam_krb5.so
+account		required	pam_login_access.so
 account		required	pam_unix.so
 
 # session
-session		required	pam_lastlog.so	no_warn no_fail
+#session 	required	pam_kerberosIV.so
+#session 	required	pam_krb5.so
+#session 	optional	pam_ssh.so
+session		required	pam_permit.so
 
 # password
-password	required	pam_deny.so
+password	required	pam_permit.so

etc/pam.d/passwd

@@ -7,5 +7,5 @@
 # passwd(1) does not use the auth, account or session services.
 
 # password
-#password	requisite	pam_passwdqc.so	enforce=users
-password	required	pam_unix.so	no_warn try_first_pass
+#password	requisite	pam_passwdqc.so		enforce=users
+password	required	pam_unix.so		no_warn try_first_pass

etc/pam.d/pop3

@@ -5,8 +5,8 @@
 #
 
 # auth
-#auth		required	pam_nologin.so	no_warn
-#auth		sufficient	pam_opie.so	no_warn no_fake_prompts
-#auth		requisite	pam_opieaccess.so	no_warn
-#auth		required	pam_ssh.so	no_warn try_first_pass
-#auth		required	pam_unix.so	no_warn try_first_pass
+#auth		required	pam_nologin.so		no_warn
+#auth		sufficient	pam_kerberosIV.so	no_warn try_first_pass
+#auth		sufficient	pam_krb5.so		no_warn try_first_pass
+#auth		sufficient	pam_ssh.so		no_warn try_first_pass
+auth		required	pam_unix.so		no_warn try_first_pass

etc/pam.d/rexecd

@@ -5,12 +5,15 @@
 #
 
 # auth
-auth		required	pam_nologin.so	no_warn
-auth		required	pam_unix.so	no_warn use_first_pass
+auth		required	pam_nologin.so		no_warn
+auth		required	pam_unix.so		no_warn use_first_pass
 
 # account
-account		required	pam_unix.so	no_warn
-account		required	pam_ftpusers.so	no_warn disallow
+account		required	pam_ftpusers.so		no_warn disallow
+account		required	pam_unix.so		no_warn
 
 # session
-session		required	pam_permit.so	no_warn
+session		required	pam_permit.so
+
+# password
+password	required	pam_deny.so

etc/pam.d/rsh

@@ -5,8 +5,14 @@
 #
 
 # auth
-auth		required	pam_nologin.so	no_warn
-auth		required	pam_rhosts.so	no_warn
+auth		required	pam_nologin.so		no_warn
+auth		required	pam_rhosts.so		no_warn
 
 # account
 account		required	pam_unix.so
+
+# session
+session		required	pam_permit.so
+
+# password
+password	required	pam_deny.so

etc/pam.d/sshd

@@ -5,19 +5,27 @@
 #
 
 # auth
-auth		required	pam_nologin.so	no_warn
-auth		sufficient	pam_opie.so	no_warn no_fake_prompts
-auth		required	pam_opieaccess.so	no_warn
-#auth		sufficient	pam_krb5.so	no_warn try_first_pass
-auth		required	pam_unix.so	no_warn try_first_pass
+auth		required	pam_nologin.so		no_warn
+auth		sufficient	pam_opie.so		no_warn no_fake_prompts
+auth		requisite	pam_opieaccess.so	no_warn
+#auth		sufficient	pam_kerberosIV.so	no_warn try_first_pass
+#auth		sufficient	pam_krb5.so		no_warn try_first_pass
+#auth		sufficient	pam_ssh.so		no_warn try_first_pass
+auth		required	pam_unix.so		no_warn try_first_pass
 
 # account
+#account 	required	pam_kerberosIV.so
+#account 	required	pam_krb5.so
 account		required	pam_login_access.so
-#account		required	pam_krb5.so
 account		required	pam_unix.so
 
 # session
+#session 	required	pam_kerberosIV.so
+#session 	required	pam_krb5.so
+#session 	optional	pam_ssh.so
 session		required	pam_permit.so
 
 # password
-password	required	pam_permit.so
+#password	sufficient	pam_kerberosIV.so	no_warn try_first_pass
+#password	sufficient	pam_krb5.so		no_warn try_first_pass
+password	required	pam_unix.so		no_warn try_first_pass

etc/pam.d/su

@@ -5,49 +5,22 @@
 #
 
 # auth
-auth		sufficient	pam_rootok.so	no_warn
-auth		sufficient	pam_self.so	no_warn
-auth		requisite	pam_group.so	no_warn root_only fail_safe
-#auth		sufficient	pam_kerberosIV.so	no_warn
-#auth		sufficient	pam_krb5.so	no_warn try_first_pass auth_as_self
-auth		sufficient	pam_opie.so	no_warn no_fake_prompts
+auth		sufficient	pam_rootok.so		no_warn
+auth		sufficient	pam_self.so		no_warn
+auth		requisite	pam_group.so		no_warn root_only fail_safe
+auth		sufficient	pam_opie.so		no_warn no_fake_prompts
 auth		requisite	pam_opieaccess.so	no_warn
-#auth		required	pam_ssh.so	no_warn try_first_pass
-auth		required	pam_unix.so	no_warn try_first_pass nullok
+#auth		sufficient	pam_kerberosIV.so	no_warn
+#auth		sufficient	pam_krb5.so		no_warn try_first_pass auth_as_self
+#auth		required	pam_ssh.so		no_warn try_first_pass
+auth		required	pam_unix.so		no_warn try_first_pass nullok
 
 # account
-#account	required	pam_kerberosIV.so
-#account	required	pam_krb5.so
+#account 	required	pam_kerberosIV.so
+#account 	required	pam_krb5.so
 account		required	pam_unix.so
 
 # session
-#session	required	pam_kerberosIV.so
-#session	required	pam_krb5.so
-#session	required	pam_ssh.so
-
-# password
-password	required	pam_permit.so
-
-
-# If you want a "WHEELSU"-type su(1), then comment out the
-# above, and uncomment the entries below.
-## auth
-#auth		sufficient	pam_rootok.so	no_warn
-##auth		sufficient	pam_kerberosIV.so	no_warn
-##auth		sufficient	pam_krb5.so	no_warn
-#auth		required	pam_opie.so	no_warn auth_as_self no_fake_prompts
-#auth		required	pam_unix.so	no_warn try_first_pass auth_as_self
-
-## account
-##account	required	pam_kerberosIV.so
-##account	required	pam_krb5.so
-#account	required	pam_unix.so
-
-## session
-##session	required	pam_kerberosIV.so
-##session	required	pam_krb5.so
-##session	required	pam_ssh.so
-#session	required	pam_unix.so
-
-## password
-#password	required	pam_permit.so
+#session 	required	pam_kerberosIV.so
+#session 	required	pam_krb5.so
+#session 	optional	pam_ssh.so

etc/pam.d/telnetd

@@ -5,10 +5,27 @@
 #
 
 # auth
-auth		required	pam_nologin.so	no_warn
-auth		sufficient	pam_opie.so	no_warn no_fake_prompts
-auth		required	pam_opieaccess.so	no_warn
-auth		required	pam_unix.so	no_warn try_first_pass
+auth		required	pam_nologin.so		no_warn
+auth		sufficient	pam_opie.so		no_warn no_fake_prompts
+auth		requisite	pam_opieaccess.so	no_warn
+#auth		sufficient	pam_kerberosIV.so	no_warn try_first_pass
+#auth		sufficient	pam_krb5.so		no_warn try_first_pass
+#auth		sufficient	pam_ssh.so		no_warn try_first_pass
+auth		required	pam_unix.so		no_warn try_first_pass
 
 # account
+#account 	required	pam_kerberosIV.so
+#account 	required	pam_krb5.so
+account		required	pam_login_access.so
 account		required	pam_unix.so
+
+# session
+#session 	required	pam_kerberosIV.so
+#session 	required	pam_krb5.so
+#session 	optional	pam_ssh.so
+session		required	pam_lastlog.so		no_fail
+
+# password
+#password	sufficient	pam_kerberosIV.so	no_warn try_first_pass
+#password	sufficient	pam_krb5.so		no_warn try_first_pass
+password	required	pam_unix.so		no_warn try_first_pass

etc/pam.d/xdm

@@ -5,22 +5,19 @@
 #
 
 # auth
-auth		required	pam_nologin.so	no_warn
+auth		required	pam_nologin.so		no_warn
 #auth		sufficient	pam_kerberosIV.so	no_warn try_first_pass
-#auth		sufficient	pam_krb5.so	no_warn try_first_pass
-#auth		sufficient	pam_ssh.so	no_warn try_first_pass
-auth		required	pam_unix.so	no_warn try_first_pass
+#auth		sufficient	pam_krb5.so		no_warn try_first_pass
+#auth		sufficient	pam_ssh.so		no_warn try_first_pass
+auth		required	pam_unix.so		no_warn try_first_pass
 
 # account
-#account	required	pam_kerberosIV.so
-#account	required	pam_krb5.so
+#account 	required	pam_kerberosIV.so
+#account 	required	pam_krb5.so
 account		required	pam_unix.so
 
 # session
-#session	required	pam_kerberosIV.so
-#session	required	pam_krb5.so
-#session	required	pam_ssh.so
+#session 	required	pam_kerberosIV.so
+#session 	required	pam_krb5.so
+#session 	required	pam_ssh.so
 session		required	pam_permit.so
-
-# password
-password	required	pam_deny.so