Dec 22 06:03:16 delarocha xscreensaver[2011]: pam_unix(xscreensaver:auth): conversation failed
Dec 22 06:03:16 delarocha xscreensaver[2011]: pam_unix(xscreensaver:auth): auth could not identify password for [web]
Dec 22 06:17:01 delarocha CRON[23306]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 22 06:17:01 delarocha CRON[23306]: pam_unix(cron:session): session closed for user root
Dec 22 06:23:00 delarocha su[23595]: Successful su for root by web
Dec 22 06:23:00 delarocha su[23595]: + /dev/pts/0 web:root
Dec 22 06:23:00 delarocha su[23595]: pam_unix(su:session): session opened for user root by web(uid=1000)
Dec 22 06:24:38 delarocha unix_chkpwd[23682]: check pass; user unknown
Dec 22 06:24:42 delarocha unix_chkpwd[23686]: check pass; user unknown
Dec 22 06:24:42 delarocha unix_chkpwd[23686]: password check failed for user (web)
Dec 22 06:24:42 delarocha xscreensaver[2011]: pam_unix(xscreensaver:auth): authentication failure; logname= uid=1000 euid=1000 tty=:0.0 ruser= rhost=  user=web
Dec 22 06:24:43 delarocha xscreensaver[2011]: FAILED LOGIN 1 ON DISPLAY ":0", FOR "web"
Dec 22 06:24:49 delarocha unix_chkpwd[23693]: check pass; user unknown
Dec 22 06:24:56 delarocha login[4058]: pam_unix(login:session): session opened for user root by LOGIN(uid=0)
Dec 22 06:24:56 delarocha systemd: pam_unix(systemd-user:session): session opened for user root by (uid=0)
Dec 22 06:24:56 delarocha systemd: pam_ck_connector(systemd-user:session): cannot determine display-device
Dec 22 06:24:56 delarocha systemd-logind[832]: New session 18 of user root.
Dec 22 06:24:56 delarocha login[23711]: ROOT LOGIN  on '/dev/tty1'
Dec 22 06:25:01 delarocha CRON[23724]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 22 06:25:01 delarocha CRON[23724]: pam_unix(cron:session): session closed for user root
Dec 22 06:25:19 delarocha login[4058]: pam_unix(login:session): session closed for user root
Dec 22 06:25:19 delarocha systemd-logind[832]: Removed session 18.
Dec 22 06:25:19 delarocha systemd: pam_unix(systemd-user:session): session closed for user root
Dec 22 06:25:22 delarocha xscreensaver[2011]: pam_unix(xscreensaver:auth): conversation failed
Dec 22 06:25:22 delarocha xscreensaver[2011]: pam_unix(xscreensaver:auth): auth could not identify password for [web]

atd                            gdm-autologin           other
chfn                           gdm-launch-environment  passwd
chpasswd                       gdm-password            polkit-1
chsh                           gnome-screensaver       ppp
common-account                 i3lock                  runuser
common-auth                    lightdm                 runuser-l
common-password                lightdm-autologin       samba
common-session                 lightdm-greeter         su
common-session-noninteractive  login                   sudo
cron                           mate-screensaver        systemd-user
cups                           newusers                xscreensaver

#
# The PAM configuration file for the Shadow `su' service
#

# This allows root to su without passwords (normal operation)
auth       sufficient pam_rootok.so

# Uncomment this to force users to be a member of group root
# before they can use `su'. You can also add "group=foo"
# to the end of this line if you want to use a group other
# than the default "root" (but this may have side effect of
# denying "root" user, unless she's a member of "foo" or explicitly
# permitted earlier by e.g. "sufficient pam_rootok.so").
# (Replaces the `SU_WHEEL_ONLY' option from login.defs)
# auth       required   pam_wheel.so

# Uncomment this if you want wheel members to be able to
# su without a password.
# auth       sufficient pam_wheel.so trust

# Uncomment this if you want members of a specific group to not
# be allowed to use su at all.
# auth       required   pam_wheel.so deny group=nosu

# Uncomment and edit /etc/security/time.conf if you need to set
# time restrainst on su usage.
# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
# as well as /etc/porttime)
# account    requisite  pam_time.so

# This module parses environment configuration file(s)
# and also allows you to use an extended config
# file /etc/security/pam_env.conf.
# 
# parsing /etc/environment needs "readenv=1"
session       required   pam_env.so readenv=1
# locale variables are also kept into /etc/default/locale in etch
# reading this file *in addition to /etc/environment* does not hurt
session       required   pam_env.so readenv=1 envfile=/etc/default/locale

# Defines the MAIL environment variable
# However, userdel also needs MAIL_DIR and MAIL_FILE variables
# in /etc/login.defs to make sure that removing a user 
# also removes the user's mail spool file.
# See comments in /etc/login.defs
#
# "nopen" stands to avoid reporting new mail when su'ing to another user
session    optional   pam_mail.so nopen

# Sets up user limits according to /etc/security/limits.conf
# (Replaces the use of /etc/limits in old login)
session    required   pam_limits.so
                                              # The standard Unix authentication modules, used with
# NIS (man nsswitch) as well as normal /etc/passwd and
# /etc/shadow entries.
@include common-auth
@include common-account
@include common-session

#
# /etc/pam.d/xscreensaver - PAM behavior for xscreensaver
#

@include common-auth
@include common-account

uid=1000(web) gid=42(shadow) groups=42(shadow),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),103(netdev),106(scanner),111(bluetooth)

xscreensaver-command -l

web@delarocha:~/.i3$ su
Password: 
root@delarocha:/home/web/.i3#

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
auth    [success=1 default=ignore]      pam_unix.so nullok_secure
# here's the fallback if no module succeeds
auth    requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional                        pam_cap.so
# end of pam-auth-update config

#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.
#

# here are the per-package modules (the "Primary" block)
account [success=1 new_authtok_reqd=done default=ignore]        pam_unix.so
# here's the fallback if no module succeeds
account requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config
~

-rw-r--r--  1 root root   2490 Dec 23 00:49 passwd
-rw-r-x---+ 1 root shadow 1486 Dec 21 21:02 shadow