Okay, REMOVE the line in pam.conf that refers to pam_chauthtok. It's probably unnecessary.

Look, PAM has three parts: a configuration file, a set of modules which do the hard work, and an API for applications (like "passwd" and "login") to interface to. Each application can use PAM how it wants, but there are general guidelines everyone follows. First, each application will go through PAM's "auth" service, which authenticates the user of the application. This is where "passwd" asks for your existing password and then uses each module that is configured in "pam.conf" (for "passwd" program) and invokes the "auth" service for all modules listed in the "auth" service; a failure in any one of the required modules will fail the whole service. Then, the "passwd" program will ask you for your new password (twice) and will then invoke the "password" service for each module listed in pam.conf for the passwd program under the "password" service; again, a failure for any required module will fail the whole service. In your case the failure is for a module failing to load. I suspect the chauthtok module is not really needed. So you can remove the line in pam.conf that says something like:

Code:

 passwd  password  required  pam_chauthtok.so

Now, if I'm wrong, one possibility is that passwd will fail "silently". That is, it will tell you it worked, when in fact, no change to the shadow file was actually made. In this case, it might be that pam_chauthtok was removed or that it is another module here that is needed.