AFTER pam_unix.so

auth optional pam_exec.so expose_authtok /usr/local/bin/zfs-unlock-home.sh ifok

remainder redacted