pam.d

server: OpenLDAP 2.4.43
clients: nss-pam-ldapd 0.9.6

These are my server side pam.d files.

/etc/pam.d/passwd
auth       sufficient   pam_rootok.so
auth       include      system-auth
account    include      system-auth
password   include      system-auth

/etc/pam.d/sshd
auth       include      system-remote-login
account    include      system-remote-login
password   include      system-remote-login
session    include      system-remote-login

/etc/pam.d/system-auth
auth            required        pam_env.so
auth            required        pam_unix.so try_first_pass likeauth nullok
auth            optional        pam_permit.so
auth            sufficient      pam_ldap.so use_first_pass
account         required        pam_unix.so
account         optional        pam_permit.so
account         sufficient      pam_ldap.so
password        required        pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
password        required        pam_unix.so try_first_pass use_authtok nullok sha512 shadow
password        optional        pam_permit.so
password        sufficient      pam_ldap.so use_authtok use_first_pass
session         required        pam_limits.so
session         required        pam_env.so
session         required        pam_unix.so
session         optional        pam_permit.so
session         optional        pam_ldap.so

/etc/pam.d/system-remote-login
auth       include      system-login
account    include      system-login
password   include      system-login
session    include      system-login

/etc/pamd/system-login
auth       required     pam_tally2.so onerr=succeed
auth       required     pam_shells.so
auth       required     pam_nologin.so
auth       include      system-auth
account    required     pam_access.so
account    required     pam_nologin.so
account    include      system-auth
account    required     pam_tally2.so onerr=succeed
password   include      system-auth
session	   optional     pam_loginuid.so
session    required     pam_env.so
session    optional     pam_lastlog.so silent
session    include      system-auth
session    optional     pam_motd.so motd=/etc/motd
session    optional     pam_mail.so