move umask to system-login

3 files changed, 22 insertions, 9 deletions

diff --git a/etc.bash b/etc.bash
index 282cf16..cff3c36 100755
--- a/etc.bash
+++ b/etc.bash
@@ -3,7 +3,7 @@
 sudo cp -rv etc/keyd/* /etc/keyd/
 sudo cp -v etc/pacman.conf /etc/
 sudo cp -v etc/pam.d/system-local-login /etc/pam.d
-sudo cp -v etc/pam.d/login /etc/pam.d
+sudo cp -v etc/pam.d/system-login /etc/pam.d
 sudo cp -v etc/updatedb.conf /etc/
 sudo cp -v etc/sysctl.d/99-security.conf /etc/sysctl.d
 sudo cp -v etc/sysctl.d/98-hardened-overrides.conf /etc/sysctl.d
diff --git a/etc/pam.d/login b/etc/pam.d/login
deleted file mode 100644
index 59a4be3..0000000
--- a/etc/pam.d/login
+++ /dev/null
@@ -1,8 +0,0 @@
-#%PAM-1.0
-
-auth       requisite    pam_nologin.so
-auth       include      system-local-login
-account    include      system-local-login
-session    include      system-local-login
-session    optional     pam_umask.so       umask=0077
-password   include      system-local-login
diff --git a/etc/pam.d/system-login b/etc/pam.d/system-login
new file mode 100644
index 0000000..ddab1e9
--- /dev/null
+++ b/etc/pam.d/system-login
@@ -0,0 +1,21 @@
+#%PAM-1.0
+
+auth       required   pam_shells.so
+auth       requisite  pam_nologin.so
+auth       include    system-auth
+
+account    required   pam_access.so
+account    required   pam_nologin.so
+account    include    system-auth
+
+password   include    system-auth
+
+session    optional   pam_loginuid.so
+session    optional   pam_keyinit.so       force revoke
+session    include    system-auth
+session    optional   pam_lastlog2.so      silent
+session    optional   pam_motd.so
+session    optional   pam_mail.so          dir=/var/spool/mail standard quiet
+session    optional   pam_umask.so         umask=0077
+-session   optional   pam_systemd.so
+session    required   pam_env.so