PAM SFA /var/log/gksfd.log by default is holding 666 permissions. Changing and saving permissions to 400 works but changes revert back to 666 after the server is restarted.
Fix has been applied on PAM 3.3 release.
PAM 3.3 has been scheduled to be released in February 2019.
Downloadable PAM 3.3 link will be provided after the release date.