Comment # 12 on bug 1170443 from Stanislav Brabec

Does your su binary have SUID flag?

"check pass; user unknown" does not come from su. It comes from PAM.

It is present in two places:
helper_verify_password(): if (pwd == NULL || salt == NULL)
_unix_verify_password()

"password check failed for user root" also comes from PAM: unix_chkpwd

You can try to debug option to the pam_unix.so line in
/etc/pam.d/common-password.

There was a su configuration parsing behavior fix several months ago. Your
configuration is the new default. Most users will not need to modify
(/usr)/etc/default/su, (/usr)/etc/login.defs is sufficient.

Did you any changes in (/usr)/etc/login.defs?