We have some Oracle Linux 9 servers where the /etc/pam.d/sshd config changes on reboot where the auth substack password-auth entry is removed.
What process would alter/recreate this file on reboot?
All these server have the Qualys & Jumpcloud agents installed.
Kind regards