pam/system-auth.pamd

#%PAM-1.0

auth        required      pam_env.so
auth        sufficient    pam_tcb.so shadow nullok prefix=$2a$ count=8
auth        required      pam_deny.so

account     required      pam_tcb.so shadow

password    required      pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_tcb.so shadow write_to=shadow nullok prefix=$2a$ count=8
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_tcb.so
-session    optional      pam_systemd.so