PAM Caveats

ALWAYS have a handy rescue disk when playing with PAM configuration.

ALWAYS store an old copy of the config file you are about to change.

If you messed the config and cannot login - boot into single user mode.

PAM will deny access if there is some unexpected error (e.g. config file syntax error, etc.). You won't see anything on screen, but a record will be written in your system's security log file.

When a module with no config file is accessed, the 'other' config file will be used to authenticate its user.