Comment 6 for bug 272232

This looks like a PAM configuration bug.

When pam_unix fails, the error is (willingly) ignored.

One temporary solution to fix this could be to change the line:
    password [success=1 default=ignore] pam_unix.so obscure sha512
to
    password required pam_unix.so obscure sha512