除wheel组成员外，禁止普通用户su - root

涉及两个配置文件：
1、/etc/pam.d/su 加以下参数
auth required pam_wheel.so use_uid
2、/etc/login.defs 加以下参数
SU_WHEEL_ONLY yes

验证添加用户：
[root@zeng ~]# useradd zeng
[root@zeng ~]# su zeng
[zeng@zeng root]$ su -
Password:
su: Permission denied

zeng加入wheel组，登录成功
[root@zeng ~]# usermod -G wheel zeng
[root@zeng ~]# su - zeng
Last login: Sat Jun 1 22:13:39 PDT 2019 on pts/0
[zeng@zeng ~]$ su -
Password:
Last login: Sat Jun 1 22:13:31 PDT 2019 on pts/0
Last failed login: Sat Jun 1 22:14:50 PDT 2019 on pts/0
There were 2 failed login attempts since the last successful login.
[root@zeng ~]#

剔除wheel组
[root@zeng java]# gpasswd -d zeng wheel