Q: unable to run logrotate postscripts command with substitute user logrotate(3.8.6) on RHEL7 is giving me PAM Auth rejections when running postscripts command with substitute user. 
same configuration works fine when i force logrotate from shell as root, but failing with below error when logrotate is executed by cron
logrotate config
/var/log/rabbitmq/*.log {
    su rabbitmq rabbitmq
        daily
        dateext
        dateyesterday
        missingok
        rotate 7
        compress
        delaycompress
        notifempty
        sharedscripts
        postrotate
          su rabbitmq -s /bin/sh "echo"-c
        endscript
      }

content in /var/log/secure
May  3 22:57:01 ip-10-6-78-5 su: pam_unix(su:auth): auth could not identify password for [rabbitmq]
May  3 22:57:01 ip-10-6-78-5 su: pam_unix(su:auth): auth could not identify password for [rabbitmq]
May  3 22:57:01 ip-10-6-78-5 su: pam_succeed_if(su:auth): requirement "uid >= 1000" not met by user "rabbitmq"
May  3 22:57:01 ip-10-6-78-5 su: pam_succeed_if(su:auth): requirement "uid >= 1000" not met by user "rabbitmq"
May  3 22:57:01 ip-10-6-78-5 su: FAILED SU (to rabbitmq) root on none
May  3


A: Could you try to add sudo before su and use -c parameter for su command, so your commands should looks like:
sudo su rabbitmq -c '/bin/sh "echo"-c'
