auth        optional                   pam_ecryptfs.so unwrap                                 {include if "with-ecryptfs"}

password    optional                   pam_ecryptfs.so unwrap                                 {include if "with-ecryptfs"}

session     optional                   pam_umask.so silent
session     [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
session     [default=1]                pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed}
session     optional                   pam_lastlog.so silent noupdate {if not "without-lastlog-showfailed":showfailed}