auth substack fingerprint-auth auth required pam_succeed_if.so user != root quiet account required pam_nologin.so account include fingerprint-auth password include fingerprint-auth session required pam_selinux.so close session required pam_loginuid.so session optional pam_console.so session required pam_selinux.so open session optional pam_keyinit.so force revoke session required pam_namespace.so session include fingerprint-auth