cat >> etc/pam.d/system-auth << "EOF"
auth      optional    pam_cap.so
EOF