[HaBo]

EXAMPLES
       Add the following line to /etc/pam.d/login to lock the account after
       too many failed logins. The number of allowed fails is specified by
       /var/log/faillog and needs to be set with pam_tally or faillog(8)
       before.

           auth     required       pam_securetty.so
           auth     required       pam_tally.so per_user
           auth     required       pam_env.so
           auth     required       pam_unix.so
           auth     required       pam_nologin.so
           account  required       pam_unix.so
           password required       pam_unix.so
           session  required       pam_limits.so
           session  required       pam_unix.so
           session  required       pam_lastlog.so nowtmp
           session  optional      pam_mail.so standard

# here are the per-package modules (the "Primary" block)
auth	sufficient	pam_thinkfinger.so
auth	[success=1 default=ignore]	pam_unix.so try_first_pass nullok_secure
# here's the fallback if no module succeeds
auth	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth	required			pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth	optional			pam_smbpass.so migrate
# end of pam-auth-update config

# here are the per-package modules (the "Primary" block)
auth 	required	pam_tally.so	onerr=fail deny=3 magic_root no_reset
auth	sufficient	pam_thinkfinger.so
auth	[success=1 default=ignore]	pam_unix.so try_first_pass nullok_secure
# here's the fallback if no module succeeds
auth	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth	required			pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth	optional			pam_smbpass.so migrate
# end of pam-auth-update config

# here are the per-package modules (the "Primary" block)
account required pam_tally.so onerr=fail magic_root no_reset
account	[success=1 new_authtok_reqd=done default=ignore]	pam_unix.so 
# here's the fallback if no module succeeds
account	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account	required			pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config

auth 	required	pam_tally.so onerr=fail deny=5