change to pam_access

roles/pam_sshd/templates/loginnodes_sshd.j2

@@ -4,7 +4,7 @@ auth       substack     password-auth
 auth       include      postlogin
 # Used with polkit to reauthorize users in remote sessions
 -auth      optional     pam_reauthorize.so prepare
-account [success=1 default=ignore] pam_succeed_if.so quiet user ingroup systems
+account    sufficient   pam_access.so
 account    required     pam_nologin.so
 account    include      password-auth
 password   include      password-auth