sshd: enable pam and properly disable password auth