# screensaver: auth account
auth       required       /usr/local/lib/security/pam_yubico.so mode=challenge-response
#auth       sufficient     pam_u2f.so
auth       optional       pam_krb5.so use_first_pass use_kcminit
auth       optional       pam_opendirectory.so use_first_pass nullok
account    required       pam_opendirectory.so
account    sufficient     pam_self.so
account    required       pam_group.so no_warn group=admin,wheel fail_safe
account    required       pam_group.so no_warn deny group=admin,wheel ruser fail_safe