This is just a note to anyone wanting to have only members
of the wheel group su root.  By default RedHat has the GID
of the wheel group set to be 10.  However, PAM assumes it's
0.  Even if you change the file /etc/group (and /etc/group-
for good measure) so that wheel has GID=0, it still doesn't
work (for me at least :)  However by placing group=wheel at
the end of the first auth line, all will be well!  So the
auth lines of /etc/pam.d/su should be something like:

auth  required  /lib/security/pam_wheel.so group=wheel
auth  required  /lib/security/pam_pwdb.so shadow nullok