[Problem Solved]
Hi,
I found the libnss-ldap package breaks setuid programs (su, sudo) and NoMachine PAM module happens to include su rules. Switch to the newer libnss-ldapd (and accordingly libpam-ldapd etc.) package should solve the problem. For my case I adopted sssd for credentials caching, which has its own ldap backend, and NoMachine works again.