diff --git a/Python/etc/pam.d/common-auth b/Python/etc/pam.d/common-auth
index 06bd9d3..b51fc8f 100644
--- a/Python/etc/pam.d/common-auth
+++ b/Python/etc/pam.d/common-auth
@@ -24,9 +24,9 @@ if not has('wheezy'):
 
 else:
     @# here are the per-package modules (the "Primary" block)
-    @auth    [success=2 default=ignore]      pam_unix.so nullok_secure use_first_pass
     if has('ldap'):
-        print "auth    [success=1 default=ignore]      %s minimum_uid=1000" % pam_module
+        print "auth    [success=2 default=ignore]      %s minimum_uid=1000" % pam_module
+    @auth    [success=1 default=ignore]      pam_unix.so nullok_secure
     @# here's the fallback if no module succeeds
     @auth    requisite                       pam_deny.so
     @# prime the stack with a positive return value if there isn't one already;