My one rule about PAM is always have an ssh session going when you mess with it and never drop it until you've tested logins 7 ways to Sunday. I remember one time making a seemingly minor change - testing it; huzzah! logins still work - dropping the connection and much much later realizing that you didn't need any password to login. Oops.