# OpenMediaVault authentication (headless, self-contained).
# Isolated from the desktop common-auth/common-account stacks: those contain
# pam_unix with pwquality (rejects the default 'openmediavault' password) and
# Kylin desktop modules (pam_biometric, pam_kysec) that break headless auth.

auth        required        pam_faillock.so preauth silent audit deny=3 unlock_time=0
auth        [success=1 default=ignore]  pam_unix.so nullok_secure try_first_pass
auth        requisite       pam_deny.so
auth        required        pam_permit.so

account     required        pam_faillock.so
account     required        pam_unix.so

session     required        pam_unix.so
