diff --git a/src/login/systemd-user.in b/src/login/systemd-user.in
index ce22744501..70ca709f51 100644
--- a/src/login/systemd-user.in
+++ b/src/login/systemd-user.in
@@ -8,6 +8,8 @@
 {% endif %}
 account  required   pam_unix.so no_pass_expiry
 
+auth     required   pam_deny.so
+
 {% if HAVE_SELINUX %}
 session  required   pam_selinux.so close
 session  required   pam_selinux.so nottys open
diff --git a/src/run/systemd-run0.in b/src/run/systemd-run0.in
index c628ef237d..6ad114f0de 100644
--- a/src/run/systemd-run0.in
+++ b/src/run/systemd-run0.in
@@ -8,6 +8,8 @@
 {% endif %}
 account  required   pam_unix.so
 
+auth     required   pam_deny.so
+
 {% if HAVE_SELINUX %}
 session  required   pam_selinux.so close
 session  required   pam_selinux.so open