diff --git a/pveum.adoc b/pveum.adoc
index d089cb6..49cfd68 100644
--- a/pveum.adoc
+++ b/pveum.adoc
@@ -184,6 +184,14 @@ endpoint only apply to the local node and not cluster-wide. Even though {pve}
 has a multi-master design, using different passwords for different nodes can
 still offer a security benefit.
 
+{pve} uses the PAM service name `proxmox-ve-auth` to authenticate users of this
+realm. This allows changing the PAM configuration only for logins to {pve},
+without affecting other services like the login on the console or via SSH, by
+creating the file `/etc/pam.d/proxmox-ve-auth`. If this file does not exist,
+PAM uses the configuration of the `other` service, so a copy of
+`/etc/pam.d/other` is a good starting point. Like the system users, this
+configuration is local to each node.
+
 In terms of configurability, an administrator can choose to require two-factor
 authentication with logins from the realm and to set the realm as the default
 authentication realm.