Step 1:  Download and build LinuxPAM.  This part was fairly straightforward to me,  I downloaded the source to a new directory and basically did:

BuildDir=$(pwd)

cd /etc && mkdir pam.d  && cd pam.d
echo "#%PAM-1.1" > ./other
echo "auth     required   pam_deny.so" >> ./other
echo "account  required   pam_deny.so" >> ./other
echo "password required   pam_deny.so" >> ./other
echo "session  required   pam_deny.so" >> ./other


cd $BuildDir/Linux-PAM-1.1.8/

#Todo:  Check if cracklib is installed and disable if not
./configure --disable-selinux 
make
make check
make install


Better way to do this:  Make a proper slackbuild, check for things like cracklib,  build packages so you can redistribute easily.  


Step 2:

Rebuild shadow,  I just took the shadow directory from Slack 14.1 x64,  added the --with-libpam option to the slack build,  and ran the slack build.  Then reinstall the resulting package.  If you rebuild after installing libpam,  it might detect pam as part of the configure process without explicitly specifying, I saw something to this effect when reading a bunch of stuff while doing this, but its easy enough to add the option anyways.


Step 3:  At this point I had to readjust some permissions making /sbin/unix_chkpwd root.shadow and setgid again,  making sure /usr/bin/su was root.root and setuid.
Note:   Local login was failing because of these issues,  Could still ssh in.  As you go along make sure you can log in local before messing with ssh and vice versa

Step 4:  Make sure the basic /etc/pam.d/ conf files are in place,  and changes to login.defs.   For this part I relied on  the instructions here:  http://www.linuxfromscratch.org/blfs/view/svn/postlfs/shadow.html   under the "Configuring Linux-PAM to Work with Shadow"  header.


At this point, as far as functionality you want to be sort of back where you started, local login works with local users, but its using PAM in the process.

Step 5:  Rebuild sshd.  Downloaded the 14.1 openssh contents again, change --without-pam to --with-pam, run the slackbuild, install the package.

Step 6:   Rebuild Samba,   download the 14.1 samba goodies,  remove the --without-pam option and run the slackbuild.   Here I ran into a build issue,
          Samba wanted to use /usr/include/com_err.h  instead of using the files in source4/heimdal/lib/com_err/  which caused a compile time error, so you might have to 
          work around that,  my hacky solution while still trying to figure out the problem, was just swapping the files during the build then swapping them back.

Step  7:  Install new samba package.  I think I might have had to 'ln -s /usr/lib64/security/pam_winbind.so /lib64/security/pam_winbind.so' as well but Im not sure it matters,                             
           I still get a warning on that file not existing in /var/log/secure but the file exists,  module is there and working :shrug:

Step 8:   Modify rc.samba  to start and stop windbind -D along with the other samba components.


Step 9:    Set up your samba smb.conf with ads security, put in domain info,  set template shell = /bin/bash, I can post conf later if wanted.  Start samba and net ads join -U username   # join to the ads domain

Step 10:   Configure local logins to use winbind,  edit the pam.d/system-session  system-account, system-auth, system-password files to require pam_winbind.so after the 'auth sufficient pam_unix.so'  lines  [I will post the conf files I ended up with for all this stuff later if anyone wants,  just remind me about it]  Edit nsswitch conf to look at 'files winbind'  for users, groups, hosts.  Make sure you can su - to other users and login from fresh terminals

Step 11:   Once local logins are working,  for ssh you create an /etc/pam.d/sshd  which in my case looks like this (and since its mostly the same I could have probably just included the various system-* files instead of pasting them into this file :\  ) :

auth            sufficient      pam_unix.so            
auth            required        pam_winbind.so  try_first_pass use_authtok

account         sufficient      pam_unix.so
account         required        pam_windbind.so try_first_pass use_authtok


session   required    pam_mkhomedir.so  skel=/etc/skel umask=0022
session   sufficient  pam_unix.so
session   sufficient  pam_winbind.so   use_first_pass use_authtok
session   required    pam_limits.so
session   required    pam_env.so


and set UsePam  to yes  in your sshd config,  restart sshd.