authconfig = NIS, MD5, Shadow but passwords get stored as DES?

I'm trying to get a farm of RH Linux servers to use NIS, mostly for the
purpose of having uid/gid names match across NFS shares. Unfortunately, I've
come across all sorts of WEIRD problems.

One of those problems is that when changing passwords, they are now stored
using DES rather than MD5. Coupled with the fact that NIS makes it quite easy
to get your hands on the hashes, this makes me very uncomfortable. And
confused. Can anyone explain to me why the MD5 keyword is being ignored?

Here is the /etc/pam.d/passwd file:
#%PAM-1.0
auth       required     /lib/security/pam_stack.so service=system-auth
account    required     /lib/security/pam_stack.so service=system-auth
password   required     /lib/security/pam_stack.so service=system-auth

And the /etc/pam.d/system-auth file:
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/pam_env.so
auth        sufficient    /lib/security/pam_unix.so likeauth nullok
auth        required      /lib/security/pam_deny.so

account     required      /lib/security/pam_unix.so

password    required      /lib/security/pam_cracklib.so retry=3 type=
password    sufficient    /lib/security/pam_unix.so nullok use_authtok md5
shadow nis
password    required      /lib/security/pam_deny.so

session     required      /lib/security/pam_limits.so
session     required      /lib/security/pam_unix.so

I've been spending hours trying to google for a solution, all I've come up
with is that Solaris doesn't support MD5... but I have a 100% RH Linux farm so
this shouldn't affect me, right?


--
Andreas Lund ([email protected])
Tel: +47 90.07.71.62 / +47 63.88.33.56
Ano-Tech Computers (http://www.atc.no/)
** He had a baseball bat and I was tied to a chair. 
** Pissing him off was the smart thing to do.  -- Max Payne