Dear Lukas,

I found it! Thanks for your help you ended up setting me on the right path.

Turns out that this line in /etc/pam/password-auth-ac needed to be
-----------------------------------------
account     sufficient    pam_unix.so broken_shadow
----------- Became -----------------
account     required      pam_unix.so broken_shadow
-----------------------------------------

and that fixed it.

-Seth