It seems to me that setuid root is not required, and that SETGID shadow seem to be enough to solve issue.
# ls -l /sbin/unix_chkpwd -rwxr-xr-x 1 root root 20596 aoû 6 03:35 /sbin/unix_chkpwd # chown .shadow /sbin/unix_chkpwd # chmod g+s /sbin/unix_chkpwd # ls -l /sbin/unix_chkpwd -rwxr-sr-x 1 root shadow 20596 aoû 6 03:35 /sbin/unix_chkpwd => works for me -Thomas
