Really su

Mostly from: http://serverfault.com/questions/149673/linux-how-to-prevent-a-user-from-login-in-but-allow-su-user