Comment 17 for bug 369575

Isn't it possible to use debconf to change around the enabled profiles, via the libpam-runtime/profiles selection?

Steve: I'm not sure I understand what you mean by "automatically apply ... by the same mechanism." I can set minimum_uid in krb5.conf, but I also have to toss the minimum_uid= options in /etc/pam.d/common-*, because PAM module options take precedence over what's in krb5.conf.

That's why I'm using a custom Kerberos profile. It's basically identical to the stock "krb5" profile, just without the minimum_uid= bit. I *want* to use the package defaults---the only reason I can't is because minimum_uid is hardcoded in there, not in a conffile, and not under /etc.