Ssh – How to enable systemd user sessions for remote logins on CentOS 7

pam_systemd is documented as starting systemd --user using user@.service.

user@.service uses PAMName=, so it runs inside a dedicated PAM session. pam_systemd has a special-case for PAMName=systemd-user, so that starting user@.service does not recurse infinitely or deadlock. (Also this process doesn't get put in a new session scope unit).

$ systemctl cat user@
# /usr/lib/systemd/system/user@.service

[Unit]
Description=User Manager for UID %i
After=systemd-user-sessions.service

[Service]
User=%i
PAMName=systemd-user
Type=notify
ExecStart=-/usr/lib/systemd/systemd --user
Slice=user-%i.slice
KillMode=mixed
Delegate=yes
TasksMax=infinity
TimeoutStopSec=120s

pam_systemd does not really work with features tied to the PAM session that vary based on the individual TTY. Instead, logind uses ACLs to grant the logged in user access to certain devices. As long as the PAM session is open, any process with that UID will be able to access them.

logind also has a DBus interface which allows one process of that user to open certain devices, intended for the display server e.g. X Windows. It has code to handle switching VTs, and multiple "seats" (groups of devices).