#!/bin/sh

# create or over-write our desired file
# /etc/pam.d/sshd
cat << 'EOF' > /etc/pam.d/sshd
auth       required     pam_env.so
auth       include      sshd-auth
account    required     pam_nologin.so
account    include      sshd-account
session    include      common-session
session    required     pam_limits.so
password   include      sshd-password
EOF

# /etc/pam.d/sshd-auth
cat << 'EOF' > /etc/pam.d/sshd-auth
auth    [success=1 default=ignore]    pam_unix.so nullok_secure
auth    requisite                     pam_deny.so
auth    required                      pam_permit.so
EOF

# /etc/pam.d/sshd-password
cat << 'EOF' > /etc/pam.d/sshd-password
password    [success=1 default=ignore]    pam_unix.so sha512
password    requisite                     pam_deny.so
password    required                      pam_permit.so
EOF

# /etc/pam.d/sshd-account
cat << 'EOF' > /etc/pam.d/sshd-account
account    [success=1 new_authtok_reqd=done default=ignore]    pam_unix.so
account    requisite                                            pam_deny.so
account    required                                             pam_permit.so
EOF

exit 0
