The pam_unix.so line typically goes at the end of the session stanza, like in the following example:
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet
session required pam_unix.so
If the pam_unix.so line is added back, then after "vastool configure pam" is run again the issue will be corrected.