[root@gratos ~]# cat /etc/pam.d/system-auth 
# cfengine-distributed file
# any local change will get lost
# $Id: system-auth 1069 2007-11-13 09:51:19Z rousse $

auth    required        pam_env.so
auth    sufficient      pam_unix.so likeauth nullok
auth    sufficient      pam_ldap.so use_first_pass
auth    required        pam_deny.so

account sufficient      pam_localuser.so
account sufficient      pam_ldap.so
account required        pam_deny.so

password        required        pam_cracklib.so retry=3 minlen=2 dcredit=0 ucredit=0
password        sufficient      pam_unix.so nullok use_authtok md5 shadow
password        sufficient      pam_ldap.so use_authtok
password        required        pam_deny.so

session optional        pam_keyinit.so revoke
session required        pam_mkhomedir.so
session required        pam_limits.so
session required        pam_unix.so
session optional        pam_ldap.so

[root@gratos ~]# cat /etc/pam.d/su
#%PAM-1.0
auth       sufficient   pam_rootok.so debug
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth       sufficient   pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth       required     pam_wheel.so use_uid
auth       include      system-auth
account    include      system-auth
password   include      system-auth
session    optional     pam_xauth.so
session    include      system-auth