Currently, open-vm-tools ships with a simple pam config that tries to work in
different OSes. However, if a user intends to configure pam authentication for
a range of services in the VM, they would need to edit the vmtoolsd pam config
file too. To make it easier, the package should install this for
/etc/pam.d/vmtoolsd:

auth     required       pam_shells.so
auth     requisite      pam_nologin.so
auth     [user_unknown=ignore success=ok ignore=ignore auth_err=die
default=bad]    pam_securetty.so
auth     include        common-auth
account  include        common-account

This is as recommended in this kb article:
https://kb.vmware.com/s/article/78251

For future versions of open-vm-tools we are planning to ship pam config files
that are suited for specific OSes, like SLE/OpenSuSE and others.