The passwords on one of my CentOS boxes is no longer accepted by
su for the user clipuser but that same password is accepted by
passwd (after su'ing from root to the user).
/var/log/secure doesn't really have anything useful, here is the relevant log entries:
Feb 21 16:58:37 CLIP sshd: pam_tally3(sshd:auth): user clipuser (500) tally 31, deny 3 Feb 21 16:58:39 CLIP sshd: Failed password for clipuser from 172.16.66.239 port 33928 ssh2