account required pam_permit.so
-password sufficient pam_systemd_home.so
-password sufficient pam_unix.so sha512 shadow try_first_pass try_authtok
+password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok
password required pam_deny.so
-session optional pam_keyinit.so revoke
account required pam_permit.so
-password sufficient pam_systemd_home.so
-password sufficient pam_unix.so sha512 shadow try_first_pass try_authtok
+password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok
+
password required pam_deny.so
-session optional pam_keyinit.so revoke
account required pam_permit.so
<command>-password sufficient pam_systemd_home.so</command>
-password sufficient pam_unix.so sha512 shadow try_first_pass try_authtok
+password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok
password required pam_deny.so
-session optional pam_keyinit.so revoke