From e044c5cf76618b023a4315f41fe126c80c06b833 Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Tue, 19 Sep 2017 13:10:27 +0200
Subject: [PATCH] Enforce pam_sepermit for all logins (#1492313)

---
 sshd.pam | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sshd.pam b/sshd.pam
index 0f5c061..cea2624 100644
--- a/sshd.pam
+++ b/sshd.pam
@@ -1,9 +1,9 @@
 #%PAM-1.0
-auth	   required	pam_sepermit.so
 auth       substack     password-auth
 auth       include      postlogin
 # Used with polkit to reauthorize users in remote sessions
 -auth      optional     pam_reauthorize.so prepare
+account    required     pam_sepermit.so
 account    required     pam_nologin.so
 account    include      password-auth
 password   include      password-auth