/etc/pam.d/common-password contains authorization settings which a re common to all services.
This file is included from other service-specific PAM config files, and should contain a list of the authorization modules that define the central access policy for use on the system. The default is to only deny service to users whose accounts are expired in /etc/shadow.
As of pam 1.0.1-6, this file is managed by pam-auth-update by default. To take advantage of this, it is recommended that you configure any local modules either before or after the default block, and use pam-auth-update to manage selection of other modules. See pam-auth-update(8) for details.