(This is a pretty generic question, if you have some particular issue, feel free to ask a more direct question..) The pam module itself doesn’t do much, really. It mostly marshals the request and sends the request to sssd which decides what to do (if anything) with the request. Which makes sense, because what the target does really depends on the deamon configuration. But in general it’s safe to have the module in all stacks, even if the deamon is not running or doesn’t provide some functionality. The only thing that might be tricky is to order pam_unix against pam_sss. But authconfig should solve this. This is the recommended way of setting up PAM stack.