"wheel" is a user/group on Sun OS's (and maybe OSX). The Wheel account was/is an account that was slightly less powerful than root. I see what's happening, I think. If you add yourself to the wheel group, then you can run processes of "wheel" privilege. Do a "man pam_wheel".
I broke the kludge the Ubuntu setup for sudo and added a passwd to root. That way I can get a root terminal and use it, instead of one sudo line at a time. Apple and OSX do the same thing. The root password is never divulged. Regular users run root privileges at a lower level than the real "root".
As far as the best OS, I would pick Fedora Core 8. Fedora Core 9 is broken WRT nvidia and X Windows. Though if this firewall machine you are setting up would be "faster" if you didn't run at run level 5 or with a GUI. Bitcommander has programs to check emails and samba connections for viruses. The programs are installed as rpm's or binary shell scripts. That way email are scanned. Also files delivered via Samba are scanned. It doesn't make much point in scanning packets as they are forwarded. It is better to wait until the entire file is downloaded and collected on the disk before a scan is done. I think iptables can scan the contents of a packet for patterns, but with thousands of virus's, I don't think a machine could keep up with a large download. Iptables can block individual sites though by IP address.