I want to prevent the root user from logging in directly from local console on a RHEL box, but allow login from ssh. Can this be done?
Disabling local root login is bad idea. The access may be necessary in system crash situations. According to NSA RHEL 5 security guide, 18.104.22.168 Restrict Root Logins to System Console:
Disabling root login from local console can be done by removing lines tty1 tty2 tty3 tty4 tty5 tty6 tty7 tty8 tty9 tty10 tty11 from /etc/securetty.