Why do you use things like auth sufficient pam_rootok.so auth required pam_permit.so (eg. /etc/pam.d/useradd ) instead of auth required pam_rootok.so ? If there is a reason for this, please just give me some hint and excuse my waste of your lifetime. Reproducible: Always
When you're root anyways, further checks are pointless.