FreeBSD 7.0 Kerberos Login over SSH, But Not Console

I assume there is an easy solution to this, but I prefer to ask before mucking up our intranet server. During a support session, my co-worker and I realized we could login in with our Kerberos credentials over SSH, but not the console (in this case the VI Client for ESXi, but it does not really matter). So, do I just modify the login PAM config?

Current state:

# PAM configuration for the "sshd" service
#

# auth
#auth           sufficient      pam_opie.so             no_warn no_fake_prompts
#auth           requisite       pam_opieaccess.so       no_warn allow_local
#auth           sufficient      pam_ssh.so              no_warn try_first_pass
auth            sufficient      pam_krb5.so             try_first_pass
auth            required        pam_unix.so             try_first_pass

# account
#account        required        pam_nologin.so
#account        required        pam_login_access.so
account         sufficient      pam_krb5.so             try_first_pass
account         required        pam_unix.so

# password
#password       sufficient      pam_krb5.so             no_warn try_first_pass
#password       required        pam_unix.so             no_warn try_first_pass
password        required        pam_permit.so

# session
#session        optional        pam_ssh.so
#session        required        pam_permit.so
session         required        pam_permit.so           

#
#
# PAM configuration for the "login" service
#

# auth
auth            sufficient      pam_self.so             no_warn
auth            include         system

# account
account         requisite       pam_securetty.so
account         required        pam_nologin.so
account         include         system

# session
session         include         system

# password
password        include         system

Any hints or tips welcome.