su permissions in CentOS
 

Today I noticed that by default, any user can run su and get root privileges if they know the root password. I was under the impression they had to be a member of wheel.

This is controlled from the /etc/pam.d/su file, and I can uncomment a line in it to fix this.

However, I'd like to set the behavior when I set the machines up initially. Is there some method to set the default su behavior at setup time, or will I be forced to edit that file everytime I set a server up?

Did your try restarting your machine? And /etc/pam.d/su has been automagically changed after your changes? Because it shouldn't.

No, by default when you set up CentOS, it has su enabled for all users. I would like the behavior to be only allow su for wheel users.

I can manually edit the pam.d/su file but I was wondering if there was an option I could set when I'm setting the machine up from scratch.

Oh, sorry, I misunderstanded your question. In Ubuntu it is possible through preseeding, but on CentOS I just don't known. Maybe other forum users will help you.