auth     required  pam_tally.so onerr=succeed file=/var/log/faillog
auth     required  pam_shells.so
auth     requisite pam_nologin.so
auth     required  pam_env.so
auth     required  pam_pkcs11.so wait_for_card card_only
auth     optional  pam_permit.so

account  include   system-local-login

password required  pam_pkcs11.so
password optional  pam_permit.so

session  optional  pam_keyinit.so force revoke
session  include   system-local-login