I've finally sorted it out. The problem is Debian bug 870126.
Work around it by manually adding:

 session    optional   pam_keyinit.so force revoke

to /etc/pam.d/nodm

Reply via email to