Leave debian /etc/pam.d/su unmodified until user attributes are set