I managed to convert to tcb as per man tcb_convert and I didn't see any big
problems.

Except one part is not well readable (to me)
7. In each file under /etc/pam.d/ which has a "password" line
 ......... add the write_to=tcb option to the instance of pam_tcb
 used as the password changing module.

I got quite a few "password" lines but I had to read the above several
times to notice that "add..." only applies to "...the instance of pam-tcb
used as the password changing module". Obviously the passwd file contains
that, but not in so many words. It seems all other other cases don't apply,
for example:

grep passsword /etc/pam.d/*
...
gdm:password  include system-auth
...

Anyway all seems to work well with the exception of gnome-screensaver and
xlock: with neither I can login when the screen is locked; I can only
change tty and login and kill the screenlock. Everything else seems to
work: gdm, su, sudo, terminal, other users, vlock...

The logs confirm the problem but don't reveal any cause.

I'd appreciate any idea to solve this.

Thanks & BFN,
=Dick Gevers=