Can't su to root

[max@hyre.net]

   Gentlefolk:

   I've got two Debian systems set up on my laptop:  one is a
small, rescue partition, the other is my working system with
X11, Gnome, &c.  Both are running 3.1, but I've been upgrading
the large one to etch.

   Somewhere along the line I could no longer su to root on the
large system.  Auth.log says (wrapped for legibility):

    Apr 18 09:10:42 localhost login[1295]:
        (pam_unix) session opened for user mhyre by (uid=0)
    Apr 18 09:10:49 localhost su[1318]:
        (pam_unix) authentication failure;
        logname= uid=1000 euid=0 tty=tty1 ruser=mhyre rhost= 
user=root
    Apr 18 09:10:52 localhost su[1318]:
        pam_authenticate: Authentication failure
    Apr 18 09:10:52 localhost su[1318]: FAILED su for root by
mhyre
    Apr 18 09:10:52 localhost su[1318]: - tty1 mhyre:root

When succeeding on the small system, the log reads:

    Apr 18 09:13:01 localhost login[2204]:
        (pam_unix) session opened for user mhyre by LOGIN(uid=0)
    Apr 18 09:13:12 localhost su[2274]: + tty1 mhyre:root
    Apr 18 09:13:12 localhost su[2274]:
        (pam_unix) session opened for user root by
mhyre(uid=1000)

Note that my initial login (as mhyre) shows me logged in by
`LOGIN' when things go right, but the empty string when things
fail.  The next line (``authentication failure'') is interesting
in the ``logname='' and the ``ruser'' and ``rhost'' info.

   Random notes:

o The /etc/pam.confs differ only in a comment.
o I've copied /etc/pam.d from the working system to the failing
  one, and used `diff' to verify that they're identical.
o They have the same password hash in /etc/shadow.
o /var/log/{messages,syslog,dmesg} have pretty much the same
  info, and none of it suggests problems in the authorization
  system.
o The inittabs are identical.
o I haven't (knowingly) touched anything in init.d.

   Any suggestions?


            Thanks,

                Max Hyre