#%PAM-1.0
auth		[success=1 service_err=reset default=ignore]	pam_krb5.so ccache=/tmp/krb5cc_%u
auth		[success=2 default=1]	pam_ccreds.so action=validate use_first_pass
auth		[default=1]	pam_ccreds.so action=store use_first_pass
auth		required	pam_deny.so
auth		required	pam_permit.so
account		include		system-auth-krb5-only
password	include		system-auth-krb5-only
session		include		system-auth-krb5-only
