Note that the -h option has impact on the PAM service name. The standard service name is "login", with the -h option the name is "remote". It's necessary to .