Двойной ввод пароля при login или su

/etc/pam.d/su в студию

#%PAM-1.0

auth       sufficient   pam_rootok.so

# If you want to restrict users begin allowed to su even more,
# create /etc/security/suauth.allow (or to that matter) that is only
# writable by root, and add users that are allowed to su to that
# file, one per line.
#auth       required     pam_listfile.so item=ruser sense=allow onerr=fail file=/etc/security/suauth.allow

# Uncomment this to allow users in the wheel group to su without
# entering a passwd.
#auth       sufficient   pam_wheel.so use_uid trust

# Alternatively to above, you can implement a list of users that do
# not need to supply a passwd with a list.
#auth       sufficient   pam_listfile.so item=ruser sense=allow onerr=fail file=/etc/security/suauth.nopass

# Comment this to allow any user, even those not in the 'wheel'
# group to su
auth       required     pam_wheel.so use_uid

auth       include              system-auth

account    include              system-auth

password   include              system-auth

session    include              system-auth
session    required     pam_env.so
session    optional             pam_xauth.so

system-auth:


#%PAM-1.0

auth       required     pam_env.so
auth       sufficient   pam_unix.so try_first_pass likeauth nullok
auth       required     pam_deny.so
auth       optional     pam_mount.so use_first_pass

account    required     pam_unix.so

password   required     pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 try_first_pass retry=3
password   sufficient   pam_unix.so try_first_pass use_authtok nullok md5 shadow
password   required     pam_deny.so

session    required     pam_limits.so
session    required     pam_unix.so
session    optional     pam_mktemp.so
session    optional     pam_mount.so

> auth required pam_env.so

А вот это неправильно. pam_env должен стоять в session, а не в auth (кроме сервиса cron, где он в Debian почему-то прописан в auth).

/etc/pam.d/login: session required pam_env.so readenv=1

/etc/pam.d/su: session required pam_env.so readenv=1

/etc/pam.d/cron: auth required pam_env.so