I am currently usingauth required pam_unix.so try_first_pass nullokauth optional pam_ssh.so  use_first_pass(plus some other, probably irrelevant entries Arch Linux added by default), which means my login password is also used to attempt unlocking any ssh-key stored (or linked to) in ~/.ssh/login-keys.d/ thanks to pam_ssh (I could also use try_first_pass instead in order to get a passphrase prompt should no ssh key be unlocked by my login password).This works fine so long as the SSH key passphrase is identical to the login one. However, what I would like to achieve is that I can basically login with one of two different passwords - either my login one or the SSH key one.So I thought that pam_ssh should fist try to unlock my SSH key, and only if that fails should pam_unix be required, otherwise it should be skipped. Can this be achieved somehow?At first I thought the solution lies in putting pam_ssh first, but additionally it has to be made sufficient instead of optional:auth sufficient pam_ssh.so  try_first_passauth required pam_unix.so try_first_pass nullokHowever, in the real files there are some other required lines following required pam_unix.so, such as required pam_env.so, which would now be ignored! So how can I really solve this?
How to achieve conditional PAM authentication?
password;pam