Remove nullok from pam configuration to avoid blank passwords