V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4500_user/4520_accounts_setup.sh

@@ -1177,12 +1177,12 @@ write_pam_su() {
 # PAM configuration for the su service
 #
 
-# Hardening of '/bin/su': only members of the group 'sudo' can su to root.
-auth     required   pam_wheel.so use_uid group=sudo
-
 # If caller is already root, allow quickly without further auth:
 auth     sufficient pam_rootok.so
 
+# Hardening of '/bin/su': only members of the group 'sudo' can su to root.
+auth     required   pam_wheel.so use_uid group=sudo
+
 # Reuse a recent successful su-auth within the TTL:
 auth     sufficient pam_timestamp.so