Nice blog post that explains how to setup the Google Authenticator PAM module to restrict the root access  with ‘su’.