auth substack smartcard-auth auth required pam_succeed_if.so user != root quiet auth include postlogin account required pam_nologin.so account include smartcard-auth password include smartcard-auth session required pam_selinux.so close session required pam_loginuid.so session optional pam_console.so session required pam_selinux.so open session optional pam_keyinit.so force revoke session required pam_namespace.so session include smartcard-auth session include postlogin