Comment by nyolfen

> You could even spawn a process to remove the pam_duress module so the threat actor won't be able to see if the duress module was available.