One (probably slightly simpler) alternative is to use pam_pwdfile. It essentially allows authentication against a user-specified file, formatted like the default
pam_pwdfile does not seem to be developed, but it probably just works and needs no new features. It is also available in the Debian archive, which gives it security support (if ever needed).
To use it, install it (e.g.
libpam-pwdfile on Debian) and put a line like this in your pam config:
auth required pam_pwdfile.so pwdfile=/path/to/passwd_file
See the README for details.
/path/to/passwd file should contain a list of usernames and hashed passwords, separated by colons, one user on each line. The hashed password can be taken from your
/etc/shadow file, or generated with
mkpasswd. E.g., to get a SHA-512-hashed password:
$ mkpasswd -m SHA-512
passwd file could look like below. This shows a SHA-512 and descrypt hashed password:
A similar alternative pam-module is pam_fshadow, but this module does not seem packaged by Debian, so I have not investigated it further.