I failed hard on an edit to pamd, which resulted in any password being accepted for any user. Anything but no password.

Not something I would usually test for, but lesson learned. Thank his noodliness we don't have ssh exposed anywhere outside our network.