[Samba] validate root locally with winbind

[Chris Jensen]

> > /etc/pam.d/system-auth
> >
> > auth        required      /lib/security/pam_env.so
> > auth        sufficient    /lib/security/pam_winbind.so
> > auth        sufficient    /lib/security/pam_unix.so likeauth nullok
> > use_first_pa ss
> > auth        required      /lib/security/pam_deny.so
> 
> Can I reverse that so that it checks local files first? That way if the user
> (eg "root") is local it doesn't have to check the domain.
> 

I think so, just make sure the use_first_pass parameter is moved to
the winbind line.