su/su.pam

   1 # su: auth account session
   2 auth       sufficient     pam_rootok.so
   3 auth       required       pam_opendirectory.so
   4 account    required       pam_group.so no_warn group=admin,wheel ruser root_only fail_safe
   5 account    required       pam_opendirectory.so no_check_shell
   6 password   required       pam_opendirectory.so
   7 session    required       pam_launchd.so