create core package

system/base/shadow/files/pam.d/login

@@ -0,0 +1,12 @@
+#%PAM-1.0
+
+auth       required	pam_securetty.so
+auth       include	system-auth
+auth       required	pam_nologin.so
+
+account    include	system-auth
+
+password   include	system-auth
+
+session    include	system-auth
+session    optional	pam_console.so

system/base/shadow/files/pam.d/other

@@ -0,0 +1,9 @@
+#%PAM-1.0
+
+auth       required	pam_deny.so
+
+account    required	pam_deny.so
+
+password   required	pam_deny.so
+
+session    required	pam_deny.so

system/base/shadow/files/pam.d/passwd

@@ -0,0 +1,8 @@
+#%PAM-1.0
+
+auth       sufficient   pam_rootok.so
+auth       include	system-auth
+
+account    include	system-auth
+
+password   include	system-auth

system/base/shadow/files/pam.d/shadow

@@ -0,0 +1,8 @@
+#%PAM-1.0 
+
+auth       sufficient	pam_rootok.so
+auth       required		pam_permit.so
+
+account    include		system-auth
+
+password   required		pam_permit.so

system/base/shadow/files/pam.d/su

@@ -0,0 +1,32 @@
+#%PAM-1.0
+
+auth       sufficient	pam_rootok.so
+
+# If you want to restrict users begin allowed to su even more,
+# create /etc/security/suauth.allow (or to that matter) that is only
+# writable by root, and add users that are allowed to su to that
+# file, one per line.
+#auth       required     pam_listfile.so item=ruser sense=allow onerr=fail file=/etc/security/suauth.allow
+
+# Uncomment this to allow users in the wheel group to su without
+# entering a passwd.
+#auth       sufficient   pam_wheel.so use_uid trust
+
+# Alternatively to above, you can implement a list of users that do
+# not need to supply a passwd with a list.
+#auth       sufficient   pam_listfile.so item=ruser sense=allow onerr=fail file=/etc/security/suauth.nopass
+
+# Comment this to allow any user, even those not in the 'wheel'
+# group to su
+auth       required     pam_wheel.so use_uid
+
+auth       include		system-auth
+
+account    include		system-auth
+
+password   include		system-auth
+
+session    include		system-auth
+session    required     pam_env.so
+session    optional		pam_xauth.so
+

system/base/shadow/files/pam.d/system-auth

@@ -0,0 +1,14 @@
+#%PAM-1.0
+
+auth       required		pam_env.so
+auth       sufficient	pam_unix.so likeauth nullok nodelay
+auth       required		pam_deny.so
+
+account    required		pam_unix.so
+
+password   required		pam_cracklib.so retry=3
+password   sufficient	pam_unix.so nullok md5 shadow use_authtok
+password   required		pam_deny.so
+
+session    required		pam_limits.so
+session    required		pam_unix.so