banner is helpful
the pam.d/su template is
required or else `su` won't load /etc/security/limits*
some ubuntu aws ami don't have it enabled by default