#%PAM-1.0
auth      include   system-remote-login
account   include   system-remote-login
# List of users to deny access to Cockpit, by default root is included.
account   required  pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
password  include   system-remote-login
session   include   system-remote-login
