O usuário precisa estar habilitado (ter senha definida, não estar vencida, etc).
É possível que seu su não emita um aviso como o meu. Você pode consultar /var/log/auth.log para ver o que está acontecendo
# su apache -c bash
This account is currently not available.
# tail -n 10 /var/log/auth.log
Oct 17 05:53:16 geee su[30744]: Successful su for apache by root
Oct 17 05:53:16 geee su[30744]: + /dev/pts/11 root:apache
Oct 17 05:53:17 geee su[30744]: pam_unix(su:session): session opened for user apache by (uid=0)
Oct 17 05:53:17 geee nologin: Attempted login by jaroslav on /dev/pts/11
Oct 17 05:53:17 geee su[30744]: pam_unix(su:session): session closed for user apache
Oct 17 05:53:20 geee su[30748]: Successful su for apache by root
Oct 17 05:53:20 geee su[30748]: + /dev/pts/11 root:apache
Oct 17 05:53:20 geee su[30748]: pam_unix(su:session): session opened for user apache by (uid=0)
Oct 17 05:53:20 geee nologin: Attempted login by jaroslav on /dev/pts/11
Oct 17 05:53:20 geee su[30748]: pam_unix(su:session): session closed for user apache