# su: selalu require password, bahkan dari root
# Step 1: cek apakah user ada di wheel group
auth    required   pam_wheel.so group=wheel

# Step 2: verifikasi password target user - WAJIB, tidak ada bypass
# requisite = gagal langsung berhenti (tidak lanjut)
auth    requisite  pam_unix.so nodelay

# Jika kedua berhasil, setup session
@include common-account

session required   pam_env.so readenv=1
session required   pam_env.so readenv=1 envfile=/etc/default/locale
session optional   pam_mail.so nopen
session required   pam_limits.so

@include common-session