git-diff

@@ -1124,6 +1131,7 @@ maybe chmod 0644 'pam.d/runuser-l'
 maybe chmod 0644 'pam.d/setup'
 maybe chmod 0644 'pam.d/smartcard-auth-ac'
 maybe chmod 0644 'pam.d/sshd'
+maybe chmod 0644 'pam.d/sssd-shadowutils'
 maybe chmod 0644 'pam.d/su'
 maybe chmod 0644 'pam.d/su-l'
 maybe chmod 0644 'pam.d/sudo'

 maybe chmod 0700 'sssd'
+maybe chmod 0711 'sssd/conf.d'
 maybe chmod 0600 'sssd/sssd.conf'

diff --git a/pam.d/sssd-shadowutils b/pam.d/sssd-shadowutils
new file mode 100644
index 0000000..626c7d0
--- /dev/null
+++ b/pam.d/sssd-shadowutils
@@ -0,0 +1,6 @@
+#%PAM-1.0
+auth        [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass
+auth        required      pam_deny.so
+
+account     required      pam_unix.so
+account     required      pam_permit.so

diff --git a/pam.d/systemd-user b/pam.d/systemd-user
index 0ebc415..2725df9 100644
--- a/pam.d/systemd-user
+++ b/pam.d/systemd-user
@@ -6,4 +6,5 @@ account  include system-auth

 session  required pam_selinux.so close
 session  required pam_selinux.so nottys open
+session  required pam_loginuid.so
 session  include system-auth