#%PAM-1.0
auth            required        pam_env.so
auth            sufficient      pam_rootok.so

# Immediately deny restricted users (NO password prompt)
auth       [default=die] pam_wheel.so use_uid deny group=wheel_restricted

# Allow normal wheel admins
auth            required        pam_wheel.so use_uid

auth            substack        system-auth
auth            include         postlogin

account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
account         include         system-auth

password        include         system-auth

session         include         system-auth
session         include         postlogin
session         optional        pam_xauth.so
session         required        pam_sulve.so
session         required        pam_lve.so      500      1