I'd like the PAM module to skip the pam_mount.so line when a unix login succeeds. I've tried various things including:

auth    [success=2 default=ignore]   pam_unix.so nullok_secure
auth    [success=2 default=ignore]   pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login try_first_pass
auth    requisite                    pam_deny.so
auth    requisite                    pam_permit.so
auth    required                     pam_permit.so
auth    optional                     pam_mount.so

But can't get it to work.

Conversely, when a session shuts down, how can I modify the following os that an unmount command (via pam_mount.so) is avoided during a unix login?

session [default=1]                  pam_permit.so
session requisite                    pam_deny.so
session required                     pam_permit.so
session required                     pam_unix.so
session optional                     pam_winbind.so
session optional                     pam_mount.so