replace simplepam with shelling out to `su`