проблемы с ldap

я сделал следуйшее:
дебиан, установил ldap-server libpam-ldap libnss
конфиг у слапд такой
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema
include         /etc/ldap/schema/openldap.schema
include         /etc/ldap/schema/misc.schema

schemacheck     on

pidfile         /var/run/slapd/slapd.pid

argsfile        /var/run/slapd.args

loglevel        0

modulepath      /usr/lib/ldap
moduleload      back_bdb

backend         bdb
checkpoint 512 30

database        bdb

suffix          "dc=localhost"

directory       "/var/lib/ldap"

index           objectClass eq
-EOF-

файл /etc/ldap.conf
host 127.0.0.1
base dc=localhost
rootbinddn cn=admin,dc=localhost
port 389
scope sub
pam_filter objectclass=posixAccount
pam_login_attribute uid
nss_base_passwd dc=localhost?sub?objectClass=posixAccount
nss_base_shadow dc=localhost?sub?objectClass=posixAccount
nss_base_group  dc=localhost?sub?objectClass=posixGroup
ssl no
-EOF-

файл  /etc/nsswitch.conf
passwd: files ldap 
shadow: files ldap 
group:  files ldap
-EOF-

файд /etc/pam.d/login
auth     required   /lib/security/pam_securetty.so
auth     required   /lib/security/pam_nologin.so
auth     sufficient /lib/security/pam_ldap.so
auth     required   /lib/security/pam_unix_auth.so use_first_pass
account  sufficient /lib/security/pam_ldap.so
account  required   /lib/security/pam_unix_acct.so
password required   /lib/security/pam_cracklib.so
password sufficient /lib/security/pam_ldap.so
password required   /lib/security/pam_unix_passwd.so use_first_pass md5 shadow
session  required   /lib/security/pam_unix_session.so
-EOF-
в лдап засовываю 
dn: cn=pupkingroup,dc=localhost
objectClass: posixGroup
cn: pupkingroup
gidNumber: 6000
description: Primary group of Pupkin-COM-RU domain
memberUid: vasya
-EOF-
dn: cn=vasya,dc=localhost
objectClass: nisMailAlias
objectClass: posixAccount
cn: vasya
uid: vasya
uidNumber: 6000
gidNumber: 6000
gecos: Vasiliy Pupkin
loginShell: /bin/bash
homeDirectory: /home/vasya
-EOF-
ну и соотвецтвено высталяю пароль не юзера вася, после чего вытаюсь залогинется в систму под васей, в логах вижу:
May  6 20:06:03 home1 login[7999]: pam_ldap: error trying to bind (Invalid credentials)
где грабли?