diff --git a/modules/users.nix b/modules/users.nix
index 621cbac..f540a95 100644
--- a/modules/users.nix
+++ b/modules/users.nix
@@ -49,7 +49,19 @@
     enable = true;
   };
 
-  security.pam.services.default.unixAuth = false;
+  security.pam.services.default = {
+    unixAuth = false;
+    text = lib.mkAfter ''
+      auth     required pam_warn.so
+      auth     required pam_deny.so
+      account  required pam_warn.so
+      account  required pam_deny.so
+      password required pam_warn.so
+      password required pam_deny.so
+      session  required pam_warn.so
+      session  required pam_deny.so
+    '';
+  };
 
   security.sudo = {
     enable = true;