@!@
krb5_opts = []
if configRegistry.is_true('pam/krb5/ticket_after_pwchange'):
    krb5_opts.append('ticket_after_pwchange')
print('password requisite  pam_cracklib.so')
print('password sufficient pam_unix.so obscure use_first_pass use_authtok')
print('password required pam_krb5.so use_first_pass use_authtok force_pwchange ' + ' '.join(krb5_opts))
@!@
