su root密码正确但无法切换

新部署天翼云主机，新建普通账户zkml，使用root密码和zkml密码都可以单独正常登陆。普通账户登录后su root输入正确密码提示如下错误：

测试

根据网络查看su和passwd权限都是正确rws。
最后查询到有人说需要将普通账户添加到wheel组才能使用,在root账户下修改

[root@ecs-98b1-0002 ~]# usermod -a -G wheel zkml
[root@ecs-98b1-0002 ~]# id zkml
uid=500(zkml) gid=500(zkml) groups=500(zkml),10(wheel)
gpasswd -d zkml wheel 删除组中zkml用户

正常切换

第二种解决方法：
因为安全认证PAM原因导致必须是在wheel组才能是有su root。如果注销也可以正常切换

#auth required pam_wheel.so use_uid

vi /etc/pam.d/su
#%PAM-1.0
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
auth            required        pam_wheel.so use_uid  #主要是此处导致，将此处注销掉也可以
auth            include         system-auth 
account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
account         include         system-auth
password        include         system-auth
session         include         system-auth
session         optional        pam_xauth.so

安全考虑不建议使用第二章方法