PAM is an authn core in any modern mainstream Linux distro. If you build and/or tweak Linux boxes, PAM was almost always here right with you. The only question is do you know what exacly PAM do?
I remember when I was in school (about 15 years ago) Slackware was one of the few distro's that didn't have PAM and they made a big point of it. So I did a quick Google just now and found that this year (2020) even Slackware got PAM [1]. Had a good chuckle over that.
It's saying something that rolling-your-own is even a debatable alternative to PAM (because if there's a flaw in your program, "only" that program is vulnerable, not the whole system. "Only" in quotes because it's just one privilege escalation step away)
What is "built-in auth" for a console login or SSH?
Before you come up with an answer involving /etc/shadow and crypt(), consider that not all systems use local password files... and that you've just reinvented what PAM does, except less flexible and more prone to implementation errors.
