#%PAM-1.0
auth     required pam_deny.so
account  required pam_deny.so
password required pam_deny.so
session  required pam_deny.so

~]# ls /usr/lib64/security/
pam_access.so   pam_cracklib.so  pam_env.so        pam_filter     pam_issue.so    pam_listfile.so   pam_mkhomedir.so  pam_permit.so      pam_rhosts.so          pam_selinux.so   pam_succeed_if.so  pam_timestamp.so  pam_unix_auth.so     pam_userdb.so
pam_cap.so      pam_debug.so     pam_exec.so       pam_filter.so  pam_keyinit.so  pam_localuser.so  pam_motd.so       pam_postgresok.so  pam_rootok.so          pam_sepermit.so  pam_systemd.so     pam_tty_audit.so  pam_unix_passwd.so   pam_warn.so
pam_chroot.so   pam_deny.so      pam_faildelay.so  pam_ftp.so     pam_lastlog.so  pam_loginuid.so   pam_namespace.so  pam_pwhistory.so   pam_securetty.so       pam_shells.so    pam_tally2.so      pam_umask.so      pam_unix_session.so  pam_wheel.so
pam_console.so  pam_echo.so      pam_faillock.so   pam_group.so   pam_limits.so   pam_mail.so       pam_nologin.so    pam_pwquality.so   pam_selinux_permit.so  pam_stress.so    pam_time.so        pam_unix_acct.so  pam_unix.so          pam_xauth.so

~]# ls /usr/lib/x86_64-linux-gnu/security/
pam_access.so  pam_echo.so        pam_faildelay.so  pam_ftp.so            pam_issue.so    pam_listfile.so   pam_mkhomedir.so  pam_permit.so     pam_securetty.so  pam_stress.so      pam_tally.so      pam_umask.so   pam_wheel.so
pam_cap.so     pam_env.so         pam_faillock.so   pam_gdm.so            pam_keyinit.so  pam_localuser.so  pam_motd.so       pam_pwhistory.so  pam_selinux.so    pam_succeed_if.so  pam_time.so       pam_unix.so    pam_xauth.so
pam_debug.so   pam_exec.so        pam_filter.so     pam_gnome_keyring.so  pam_lastlog.so  pam_loginuid.so   pam_namespace.so  pam_rhosts.so     pam_sepermit.so   pam_systemd.so     pam_timestamp.so  pam_userdb.so
pam_deny.so    pam_extrausers.so  pam_fprintd.so    pam_group.so          pam_limits.so   pam_mail.so       pam_nologin.so    pam_rootok.so     pam_shells.so     pam_tally2.so      pam_tty_audit.so  pam_warn.so

auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth required pam_deny.so

account required pam_unix.so
account sufficient pam_localuser.so
# 如果用户 ID 小于 1000，直接退出，不再进行验证
account sufficient pam_succeed_if.so uid < 1000 quiet
account required pam_permit.so

password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok

password required pam_deny.so

session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so

# PAM configuration for the Secure Shell service
# Standard Un*x authentication
@include common-auth

# Disallow non-root logins when /etc/nologin exists
account required pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account required pam_access.so

# Standard Un*x authorization
@include common-account

# SELinux needs to be the first session rule. This ensures that any
# lingering context has been cleared. Without this it is possible that a
# module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close

# Set the loginuid process attribute
session required pam_loginuid.so

# Create a new session keyring
session optional pam_keyinit.so force revoke

# Standard Un*x session setup and teardown
@include common-session

# 登录成功后打印当天消息。
# 这包括来自 /run/motd.dynamic 的动态生成部分和来自 /etc/motd 的静态部分。
# 注释这两行，将会禁用登录后的消息提示功能
session optional pam_motd.so motd=/run/motd.dynamic
session optional pam_motd.so noupdate

# Print the status of the user's mailbox upon successful login
session optional pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf
session required pam_limits.so

# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
session required pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
session required pam_env.so user_readenv=1 envfile=/etc/default/locale

# SELinux needs to intervene at login time to ensure that the process starts
# in the proper default security context. Only sessions which are intended
# to run in the user's context should be run after this.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open

# Standard Un*x password updating
@include common-password

# %PAM-1.0
# 最多连续三认认证登录都出错时，60秒后解锁，root用户也可以被锁定，root用户15秒后解锁。
auth required pam_tally2.so deny=3 unlock_time=60 even_deny_root root_unlock_time=15

# 限制用户不能更改为之前使用的历史密码
password required pam_pwhistory.so use_authtok remember=6 retry=3