If you read the pam.d
manpage, more about what can be done inside the [ ]
is explained in there.
success=2
means that if this particular authentication is successful, the next two items in that file will be skipped over.
default=ignore
basically means to ignore any and all failures. They won't be a successful auth, but neither will they cause authentication to stop here.
For the first part, there are a ton of different possibilities, but everything other than 'success' is pretty much a type of failure, such as "user_unknown", "acct_expired" or "system_err".
Exactly what the combination means depends on what's in the rest of the file, since it's skipping 2 things and going to the third thing after it. It probably ends up meaning something like "sufficient", as in, "success with this authentication is enough and we won't require any other authentication methods to succeed". If there's 3 or more things after it, then it depends on what those are...