pam service name is name of sshd binary, so we provide a symlink. sshd must run as root to provide pam.