Я не использую, пока разбираюсь. Вот что нашел (см. release/en_us/0333/pam.txt) :

Server Setup:
In order to configure a server to use PAM, the DBA must know:
a. The name of the PAM module.
b. Whether the PAM module will raise a challenge in addition to a
simple password.

With this information, the sqlhosts entry can be formed as follows:
(Names used here are for illustration purposes.)

PAM service: pam_chal
Authentication mode: challenge

ifxserver1 oltlitcp servermc portnum1 s=4,pam_serv=(pam_chal),pamauth=(challenge)

PAM service: pam_password (Needs only a password)
Authentication mode: password

ifxserver2 oltlitcp servermc portnum2 s=4,pam_serv=(pam_pass),pamauth=(password)

PAM service: pam_retry (Allows 3 chances to respond correctly)
Authentication mode: challenge

ifxserver3 oltlitcp servermc portnum3 s=4,pam_serv=(pam_retry),pamauth=(challenge)