[pam-bwidm] minor cleanup

2 files changed, 9 insertions, 23 deletions

diff --git a/server/modules/pam-bwidm-freiburg/etc/pam.d/common-account b/server/modules/pam-bwidm-freiburg/etc/pam.d/common-account
index da270620..d8c9be5e 100644
--- a/server/modules/pam-bwidm-freiburg/etc/pam.d/common-account
+++ b/server/modules/pam-bwidm-freiburg/etc/pam.d/common-account
@@ -6,22 +6,14 @@
 # the central access policy for use on the system.  The default is to
 # only deny service to users whose accounts are expired in /etc/shadow.
 #
-# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
-# To take advantage of this, it is recommended that you configure any
-# local modules either before or after the default block, and use
-# pam-auth-update to manage selection of other modules.  See
-# pam-auth-update(8) for details.
-#
 
 # here are the per-package modules (the "Primary" block)
-account [success=3 new_authtok_reqd=done default=ignore]	pam_exec.so quiet debug /opt/openslx/scripts/pam_bwidm
-account	[success=2 new_authtok_reqd=done default=ignore]	pam_unix.so use_first_pass
-account [success=1 new_authtok_reqd=done default=ignore]	pam_sss.so use_first_pass
+account	[success=3 new_authtok_reqd=done default=ignore]	pam_unix.so
+account	[success=2 new_authtok_reqd=done default=ignore]	pam_exec.so quiet /opt/openslx/scripts/pam_bwidm
+account [success=1 new_authtok_reqd=done default=ignore]	pam_sss.so
 # here's the fallback if no module succeeds
 account	requisite			pam_deny.so
 # prime the stack with a positive return value if there isn't one already;
 # this avoids us returning an error just because nothing sets a success code
 # since the modules above will each just jump around
 account	required			pam_permit.so
-# and here are more per-package modules (the "Additional" block)
-# end of pam-auth-update config
diff --git a/server/modules/pam-bwidm-freiburg/etc/pam.d/common-auth b/server/modules/pam-bwidm-freiburg/etc/pam.d/common-auth
index dc10df3b..66185b71 100644
--- a/server/modules/pam-bwidm-freiburg/etc/pam.d/common-auth
+++ b/server/modules/pam-bwidm-freiburg/etc/pam.d/common-auth
@@ -7,23 +7,17 @@
 # (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
 # traditional Unix authentication mechanisms.
 #
-# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
-# To take advantage of this, it is recommended that you configure any
-# local modules either before or after the default block, and use
-# pam-auth-update to manage selection of other modules.  See
-# pam-auth-update(8) for details.
 
 # here are the per-package modules (the "Primary" block)
-auth	[success=4 default=ignore]	pam_exec.so quiet debug expose_authtok /opt/openslx/scripts/pam_bwidm 
-auth	[success=ok default=ignore]	pam_krb5.so minimum_uid=1000 try_first_pass
-auth	[success=2 default=ignore]	pam_unix.so try_first_pass
-auth	[success=1 default=ignore]	pam_sss.so use_first_pass
+auth	[success=6 default=ignore] pam_unix.so try_first_pass nodelay
+auth	[success=4 default=ignore] pam_exec.so quiet expose_authtok /opt/openslx/scripts/pam_bwidm
+auth	optional                   pam_krb5.so minimum_uid=1000 use_first_pass
+auth	[success=2 default=ignore] pam_sss.so use_first_pass
 # here's the fallback if no module succeeds
+auth  optional          pam_faildelay.so delay=2123123
 auth	requisite			pam_deny.so
-auth	optional			pam_script.so expose=1
+auth	optional          pam_script.so expose=1
 # prime the stack with a positive return value if there isn't one already;
 # this avoids us returning an error just because nothing sets a success code
 # since the modules above will each just jump around
 auth	required			pam_permit.so
-# and here are more per-package modules (the "Additional" block)
-# end of pam-auth-update config