#%PAM-1.0
auth		[success=1 service_err=reset default=ignore]	pam_krb5.so ccache=/tmp/krb5cc_%u
auth		[success=2 default=1]	pam_ccreds.so action=validate use_first_pass
auth		[default=1]	pam_ccreds.so action=store use_first_pass
auth		required	pam_deny.so
auth		required	pam_permit.so
account		include	system-auth-krb5-only
password	include	system-auth-krb5-only
session		include	system-auth-krb5-only
