I found temporary workaround- nscd daemon must be stopped. Anyway, something very odd going on, i found, (nscd running) that not all accounts was blocked?! some kind of timeout? in /var/log/messages- Nov 25 09:32:19 riffle unix_chkpwd[9614]: check pass; user unknown Nov 25 09:32:19 riffle login(pam_unix)[9529]: authentication failure; logname=LOGIN uid=0 euid=0 tty=tty3 ruser= rhost= Nov 25 09:32:19 riffle login(pam_unix)[9529]: could not identify user (from getpwnam(al)) Nov 25 09:32:19 riffle login[9529]: User not known to the underlying authentication module but in meantime finger shows user information for same user :) after 'service nscd stop' user can login instantly... al
