#%PAM-1.0auth substack common-auth# List of users to deny access to Cockpit, by default root is included.auth required pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeedaccount required pam_nologin.soaccount include common-accountpassword include common-passwordsession required pam_loginuid.sosession optional pam_keyinit.so force revokesession include common-sessionauth [user_unknown=ignore success=ok] pam_oath.so usersfile=${HOME}/.pam_oath_usersfile no_usersfile_okay window=20 digits=6