diff --git a/src/auth.c b/src/auth.c
index 44236081..badf808d 100644
--- a/src/auth.c
+++ b/src/auth.c
@@ -10,6 +10,7 @@
 
 #include "phosh-config.h"
 #include "auth.h"
+#include "grp.h"
 
 #include <security/pam_appl.h>
 
@@ -69,6 +70,8 @@ authenticate (PhoshAuth *self, const char *authtok)
 {
   int ret;
   gboolean authenticated = FALSE;
+  struct group *eff_group;
+  int real_gid, init_eff_gid, re;
   const char *username;
   const struct pam_conv conv = {
     .conv = pam_conversation_cb,
@@ -84,7 +87,17 @@ authenticate (PhoshAuth *self, const char *authtok)
     }
   }
 
+  /* setegid with group chkpwd to check passwords by pam_tcb */
+  real_gid = getgid ();
+  eff_group = getgrnam ("chkpwd");
+  if (eff_group != NULL) {
+    init_eff_gid = eff_group->gr_gid;
+    re = setegid (init_eff_gid);
+    if (re == -1)
+      g_warning("pam_authenticate setegid(%d) failed", init_eff_gid);
+  }
   ret = pam_authenticate (self->pamh, 0);
+  setegid (real_gid);
   if (ret != PAM_SUCCESS) {
     if (ret != PAM_AUTH_ERR)
       g_warning ("pam_authenticate error %s", pam_strerror (self->pamh, ret));