Template: libpam-ldapd/enable_shadow Type: boolean Default: true _Description: Enable shadow lookups through NSS? For the proper operation of the PAM stack the NSS module should return shadow information for LDAP users, otherwise these users will not be able to log in. Note that the shadow entries themselves may be empty (i.e. it is not needed to expose password hashes). . More background information on this requirement can be found here: http://bugs.debian.org/583492 . You can edit /etc/nsswitch.conf by hand or choose to add the entry automatically now. Be sure to review the changes to /etc/nsswitch.conf if you choose to add the entry now.