diff --git a/factory/etc/pam.d/system-auth b/factory/etc/pam.d/system-auth
index dec7a8f017..d988233d1c 100644
--- a/factory/etc/pam.d/system-auth
+++ b/factory/etc/pam.d/system-auth
@@ -1,11 +1,14 @@
 # This file is part of systemd.
 
 auth     sufficient pam_unix.so nullok try_first_pass
+auth     required   pam_deny.so
 
 account  required   pam_nologin.so
 account  sufficient pam_unix.so
+account  required   pam_permit.so
 
 password sufficient pam_unix.so nullok sha512 shadow try_first_pass try_authtok
+password required   pam_deny.so
 
 -session optional   pam_loginuid.so
 -session optional   pam_systemd.so