/etc/pam.d
NameSizeModeActions
config-util2320644editdlrm
fingerprint-auth7010644editdlrm
login7150644editdlrm
other1540644editdlrm
password-auth7600644editdlrm
postlogin3980644editdlrm
remote6400644editdlrm
runuser1430644editdlrm
runuser-l1380644editdlrm
smartcard-auth1530644editdlrm
su6570644editdlrm
su-l1370644editdlrm
system-auth7600644editdlrm
Edit: /etc/pam.d/su (657B)
#%PAM-1.0 auth required pam_env.so auth sufficient pam_rootok.so # Uncomment the following line to implicitly trust users in the "wheel" group. #auth sufficient pam_wheel.so trust use_uid # Uncomment the following line to require a user to be in the "wheel" group. #auth required pam_wheel.so use_uid auth substack system-auth auth include postlogin account sufficient pam_succeed_if.so uid = 0 use_uid quiet account include system-auth password include system-auth session include system-auth session include postlogin session optional pam_xauth.so session required pam_sulve.so session required pam_lve.so 500 1