The Surreal Horror of Pam
PAM is quite something.  Normally you ignore it and it quietly gets on with the job.  Then one day you find yourself deploying something like this on your laptop:<p><pre><code>  %PAM-1.0

  auth  required                   pam_faillock.so      preauth
  auth  [success=3 default=ignore] pam_unix.so          try_first_pass nullok
  auth  [success=2 default=ignore] pam_winbind.so
  -auth [success=1 default=ignore] pam_systemd_home.so
  auth  [default=die]              pam_faillock.so      authfail
  auth  required                   pam_permit.so
  auth  required                   pam_env.so
  auth  required                   pam_faillock.so      authsucc

  -account [success=2 default=ignore]  pam_systemd_home.so
  account  [success=1 default=ignore]  pam_winbind.so
  account  required                    pam_unix.so
  account  optional                    pam_permit.so
  account  required                    pam_time.so

  -password [success=2 default=ignore] pam_systemd_home.so
  password  [success=1 default=ignore] pam_winbind.so
  password  required                   pam_unix.so sha512 shadow
  password  optional                   pam_permit.so

  session required  pam_limits.so
  session required  pam_unix.so
  session required  pam_winbind.so
  session optional  pam_permit.so
</code></pre>
The syntax is quite terse and like nothing else.  No idea why it insists on wasting characters though.  auth could be au, account: ac, password: pa and session: se.  Why on earth put pam_ on the front of the modules and .so on the end.  Tut!<p>The winbind stuff is configured elsewhere in several places - &#x2F;etc&#x2F;samba&#x2F;smb.conf and &#x2F;etc&#x2F;security&#x2F;pam_winbind.conf (obviously).<p>In general it is good enough to keep a spare virtual console logged in as root whilst you play with PAM.  Otherwise get some experience with say Gentoo and Arch and the like.  Then you will have rather good system rescue skills.  Keep a System Rescue CD&#x2F;USB to hand ... boot, mount &#x2F;, &#x2F;boot, &#x2F;dev, &#x2F;sys etc, chroot ... fix whatever you broke and then reboot.  Rinse, repeat.  Or spin up a VM and snapshot&#x2F;checkpoint it before experimenting.