ALTLinux checkpassword-pam is build against pam_userpass.so. According
to pam_userpass.so README:

>>>
pam_userpass doesn't perform any actual authentication.  An actual
authentication module should be stacked after pam_userpass and told to
use the authentication token (password) provided by pam_userpass.
<<<

checkpassword-pam DON'T WORK WITHOUT PAM_USERPASS!

example working configuration:

#%PAM-1.0
auth		required	pam_userpass.so
auth     	required	pam_tcb.so shadow fork prefix=$2a$ count=8 nullok
account  	required	pam_tcb.so shadow fork
password 	required	pam_deny.so
session  	required	pam_tcb.so