The config file is provided by pam-modules, but with Default: no. We need to call pam-auth-update to enable or disable it.
