Comment # 1 on bug 1226452 from Thorsten Kukuk

This problem is not solvable, since they have a classical deadlock:

pam_systemd needs be be called before pam_krb5
pam_fscrypt needs to be called after pam_unix
pam_krb5 and pam_unix setup is so complex that you cannot put pam_systemd
somewhere inbetween.

So if you don't use kerberos, you have maybe luck and it works if you change it
manual.
Else: somebody needs to cleanup this dependency mess in the modules, this is
nothing pam-config can solve.