# PAM policy for remote login over RDP (sg-rdp-authd, ADR 0010).
#
# Deliberately the same stacks as a console login: a remote login must face the
# same password rules, lockout (pam_faillock, if configured) and account expiry
# as someone at the keyboard. Anything weaker here would make RDP the easy way
# in. The session stack is used when sg-rdp-authd starts the remote session
# (systemd-run PAMName=): logind registers it and the profile service runs.
@include common-auth
# ... and, once the password is right, the session's keyring opens with it,
# as signing in at the console opens it (greetd's own PAM file). The session
# is started without the password (systemd-run), so sg-rdp-authd checks it a
# second time once the session exists, and sg-rdp-pamcheck tells the module
# where the person's keyring daemon is. "-": nothing without gnome-keyring.
-auth       optional    pam_gnome_keyring.so
@include common-account
@include common-session
