Preventing `passwd` for asking for the local password

Question

I have setup the sever to only use LDAP for authentication by using authconfig-tui. Everything works well but, when I run passwd, I get two prompts for a password:

[beamin@rhel6-test-server1 ~]$ passwd
Changing password for user beamin.
Changing password for beamin.
(current) UNIX password:
Enter login(LDAP) password:

Why is it asking for both? Can I prevent that from happening?

Edit #1:

Here is the content of /etc/pam.d/passwd:

$ cat /etc/pam.d/passwd
#%PAM-1.0
auth       include      system-auth
account    include      system-auth
password   substack     system-auth
-password   optional    pam_gnome_keyring.so

Here is the content of the include (/etc/pam.d/system.auth):

$ cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so

Edit #2:

Contents of nsswitch.conf asked by @Nikhil:

$ egrep 'passwd|shadow' /etc/nsswitch.conf
#passwd:    db files nisplus nis
#shadow:    db files nisplus nis
passwd:     files
shadow:     files

Answer 1

It is the /etc/nsswitch.conf that tells the system where to look for the store of users,groups in maps of passwd, group & shadow. Whether it would be local files, nis/yp, or ldap, it is the nsswitch.conf. The configuration to support this change would later come in either pam configuration or the nss libraries. pam on Linux does simplification, since it also supports tcp_wrappers along with customisation of unix authentication in various ways.

Once you have run and changed /usr/bin/authconfig to use ldap,

Authconfig will alter your PAM files for you (among other things), specifically the file /etc/pam.d/system-auth. A typical system-auth file on a Red Hat system configured to authenticate using LDAP looks like this:

The 'pam_unix' module is invoked next, and will do the work of prompting the user for a password. The arguments "nullok" and "likeauth" mean that empty passwords are not treated as locked accounts, and that the module will return the same value (the value that is "like" the "auth" value), even if it is called as a credential setting module. Note that this module is "sufficient" and not "required". The 'pam_ldap' module is invoked, and is told to "use_first_pass", in other words, use the password that was collected by the pam_unix module instead of prompting the user for another password. Note that the fact that this module is marked "sufficient", and it's positioned after pam_unix means that if pam_unix succeeds in checking a password locally, pam_ldap won't be invoked at all.

#%PAM-1.0
 # This file is auto-generated.
 # User changes will be destroyed the next time authconfig is run.
 auth        required      pam_env.so
 auth        sufficient    pam_unix.so nullok try_first_pass
 auth        requisite     pam_succeed_if.so uid >= 500 quiet
 auth        sufficient    pam_ldap.so use_first_pass
 auth        required      pam_deny.so

 account     required      pam_unix.so broken_shadow
 account     sufficient    pam_succeed_if.so uid < 500 quiet
 account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
 account     required      pam_permit.so

 password    requisite     pam_cracklib.so try_first_pass retry=3
 password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
 password    sufficient    pam_ldap.so use_authtok
 password    required      pam_deny.so

 session     optional      pam_keyinit.so revoke
 session     required      pam_limits.so
 session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
 session     required      pam_unix.so
 session     optional      pam_ldap.so

/etc/ldap.conf should have

pam_lookup_policy yes
pam_password exop

/etc/ssh/sshd_config should have and should be restarted after config change.

UsePAM yes