auth            sufficient      /lib/security/pam_ldap.so use_first_pass
    auth            required        /lib/security/pam_tcb.so shadow fork prefix=a$ count=8 nullok use_first_pass
    password        sufficient      /lib/security/pam_ldap.so
    password        required        /lib/security/pam_tcb.so use_authtok shadow fork prefix=a$ count=8 write_to=tcb