(e.g. <filename>/dev/hidraw1</filename>), referring to a FIDO2 security token implementing the
<literal>hmac-secret</literal> extension that shall be able to unlock the user account. A random salt
value is generated on the host and passed to the FIDO2 device, which calculates a HMAC hash of the
- salt combined with an internal secret key. The result is then used as the key to unlock the user
- account. The random salt is included in the user record, so that whenever authentication is needed it
- can be passed again to the FIDO2 token again.</para>
+ salt using an internal secret key. The result is then used as the key to unlock the user account. The
+ random salt is included in the user record, so that whenever authentication is needed it can be
+ passed to the FIDO2 token again.</para>
<para>Instead of a valid path to a FIDO2 <literal>hidraw</literal> device the special strings
<literal>list</literal> and <literal>auto</literal> may be specified. If <literal>list</literal> is
<term><varname>KillOnlyUsers=</varname></term>
<term><varname>KillExcludeUsers=</varname></term>
- <listitem><para>These settings take space-separated lists of usernames that override
- the <varname>KillUserProcesses=</varname> setting. A user name may be added to
- <varname>KillExcludeUsers=</varname> to exclude the processes in the session scopes of
- that user from being killed even if <varname>KillUserProcesses=yes</varname> is set. If
- <varname>KillExcludeUsers=</varname> is not set, the <literal>root</literal> user is
- excluded by default. <varname>KillExcludeUsers=</varname> may be set to an empty value
- to override this default. If a user is not excluded, <varname>KillOnlyUsers=</varname>
- is checked next. If this setting is specified, only the session scopes of those users
- will be killed. Otherwise, users are subject to the
- <varname>KillUserProcesses=yes</varname> setting.</para></listitem>
+ <listitem><para>These settings take space-separated lists of usernames that override the
+ <varname>KillUserProcesses=</varname> setting. A user name may be added to
+ <varname>KillExcludeUsers=</varname> to exclude the processes in the session scopes of that user from
+ being killed even if <varname>KillUserProcesses=yes</varname> is set. If
+ <varname>KillExcludeUsers=</varname> is not set, the <literal>root</literal> user is excluded by
+ default. <varname>KillExcludeUsers=</varname> may be set to an empty value to override this
+ default. If a user is not excluded, <varname>KillOnlyUsers=</varname> is checked next. If this
+ setting is specified, only the processes in the session scopes of those users will be
+ killed. Otherwise, users are subject to the <varname>KillUserProcesses=yes</varname> setting.
+ </para></listitem>
</varlistentry>
<varlistentry>