Debian jessie introduced pam-auth-update, which packages call when they have
bits of common PAM configuration.

From NEWS file:

  [systemd] New class to allow systemd daemon reloads. (adamhl)

  [dns] Changes Livermore detection to use the system's primary IP
  address, instead of using a manually-set parameter. (akkornel)

  [kerberos] Automatically determine if we are in Livermore; if we are,
  place the Livermore-based KDC at the top of the list. (akkornel)

  Clients who are using the base::kerberos::dr class should immediately
  switch to using base::kerberos.  base::kerberos::dr is deprecated.

  [kerberos] Add two parameters to the base::kerberos class. The first
  is used to force the kerberos client to prefer TCP over UDP. The
  second allows one to indicate which kerberos environment to use: prod,
  test, or uat. In both cases, the defaults are such that the krb5.conf
  will continue to have the same contents as before the addition of
  these parameters.

Add two new parameters. The first is to add a line to the krb5.conf file
indicating that we prefer TCP. The other is a parameter stating which
kerberos environment we want: prod, test, or uat.