Now this has really been a waste of time. Months ago I convinced myself that NIS isn't really a modern way to keep my user accounts network-wide - be it even only my home network. So I tried libnss-ldap and read wiki.debian.org on LDAP and literally found dozens of documents that describe how to do LDAP authentication for your users with NSS. Unfortunately most of them didn't work for me. But finally I managed to get it working (after a few days) and was happy.
And then came the day that I decided to install Etch's security updates and upgraded libnss-ldap 251-7.5 to 251-7.5etch1 in the process. Everything seemed to work well and I could log in. Just that Postfix somehow refused to deliver mails locally any more. The "local" daemon died repeatedly. After some careful Postfix debugging I found that I get a traceback that ended with "0x404841d8 in ?? () from /lib/libnss_ldap.so.2". To cut a long story short: the upgrade set a "binddn" in the "libnss-ldap.conf" but no "bindpw". But what really seemed to get Postfix mad was that the "libnss-ldap.conf" wasn't readable for all any more (0600). Apparently the current libnss-ldap package in Sid sets that permissions right but on Etch that has really broken things. Recommendation from #postfix: "dont you never ever let debconf manage LDAP". Not good.
No idea how that happened as I'm pretty new to nss and ldap but I wished I could have spent that evening differently. So in case anyone else happens to encounter "postfix/qmgr: warning: premature end-of-input on private/local socket while reading input attribute name" then try to "chmod a+r /etc/libnss-ldap.conf". Just check that you don't have a bind password in there. :) Once I fully understand that I'll check if I can contribute to the Debian wiki article or was just too dumb. If I were sure what's going on I'd file a bug report, too.