Mark PAM profiles krb5, sss and yourdev as "seen" in /var/lib/pam so
next execution of command /usr/sbin/pam-auth-update in interactive
mode will ignore the values of 'Default' properties.
This avoids the automatic selection of the sss profile, which conflicts
with the yourdev profile.
Presence of comments in pam-configs/ file cause several warnings when
invoking command `pam-auth-updates` (use of uninitialized value), and
then later the PAM configuration is broken:
- SSH login fails immediately (connection closed)
- opening a session with `sudo su -` is impossible (authorisation refused)
- and maybe more...
Without comments in /usr/share/pam-configs/yourdev, everything works as
expected, no warnings in `pam-auth-updates`, no authentication problems.
With default priority (128), pam-auth-update put module pam_sss after
module pam_unix in /etc/pam.d/common-auth, and then a user with a
local account and local password synchronized with AD password will
never be granted a Kerberos TGT on session opening.
According to pam-auth-update(8), it is an error to use option --force
in postinst script:
This option must not be used by package maintainer scripts;
it is intended for use by administrators only.
