#%PAM-1.0
auth		required	pam_tcb.so shadow fork prefix=$2y$ count=8 nullok use_first_pass
password	required	pam_tcb.so use_authtok shadow fork prefix=$2y$ count=8 nullok write_to=tcb
-session	optional	pam_keyinit.so force revoke
