I've finally sorted it out. The problem is Debian bug 870126. Work around it by manually adding: session optional pam_keyinit.so force revoke to /etc/pam.d/nodm