Limit su

In order to limit su to root to members of group wheel only add the following line to /etc/pam.d/su

auth            required        pam_wheel.so use_uid group=wheel root_only