1

I have sudo configured like this:

joe ALL=(root) NOPASSWD: /bin/su - steve

What it does exactly?

I am confused.

I guess there's three different ways to execute that command:

  1. su - steve

  2. sudo su - steve

  3. sudo -u root su - steve

In which cases it's not going to ask for a password? What is the difference between commands 2 and 3?

When joe runs command 2, will it run as user joe or root?

4 Answers 4

4

It seems like you may have some confusion between what sudo and su are used for. Both enable a user to execute commands as if they are another user with different priveleges, but there are distinct differences.

An over generalization would be:

  • su - get a shell with uid/gid of an other user, authenticating with that users password.
  • sudo - run a command with uid/gid of an other user, authenticating with your password.

SU

In general, most people utilize su to initiate a shell with (s)ubstitue (u)ser id and/or group id. This is most commonly done to gain root privileges but can also be used for any system user.

If the user running su is not root, then it will ask for the password of the user you are trying to su as.

  • su - login as root with a login shell that will have an environment similar to a real login. Need root's password.

  • su - alice login as alice with a login shell that will have an environment similar to a real login. Need alice's password.

  • su or su alice like examples above with difference that the initial user environment is maintained with the exception of the environment variables USER, SHELL, and HOME. This can have unexpected consequences. As example since PATH is not changed, when trying to change the password you may not be running the command /usr/bin/passwd but /usr/local/bin/passwd or even /home/{$ORIGUSER}/bin/passwd.

  • su -c command - execute the command as root with a login shell and exit to original user shell.

  • su -c command - alice execute the command as alice with a login shell and exit to original user shell.

References

SUDO

Sudo allows more flexibility than su. The most apparent to enduser is that they are authenticating using their own password or even no password if configured that way.

By utilizing the configuration file visudo, the priveleges allowed by the user can be controlled with much more controll.

As an example, you can allow a user to execute some commands with no password required and other commands may require a password.

Please see the associated man pages to get an idea of all the variations that can be done.

References

The two most visible benefits of sudo vs su

  • The ability to give certain groups of users the root privileges of only a subset of commands without having to give them the root password. This allows a way to have a restrictive tier of administrator level users with root access to only the commands they need to do their job.
  • Since you are only executing one command as root, lowers risks of accidental harm. For an example, you think you are in your user directory /home/user/myjunkdocs and run rm -rf but you are actually in the root directory and delete the system software.
1

su logs in to the superuser by default (or the specified user) but it requires the target's password (i.e. su root needs the root password). It has nothing to do with sudo.

sudo su will log you in as root with joe's password. It'll prompt you for joe's password, and then runs the command su as root, which doesn't require a password for the superuser (root). Meaning, it will log you in to a root shell with joe's password.

The third command does the same thing, it just specifies explicitly that you want to run the command su as root, which is the default anyway, just more explicit.

1

"I guess there's three different ways to execute that command:

su - steve

sudo su - steve

sudo -u root su - steve"

All three, if successful, will get you a command prompt for the ID 'steve', where you can then run any command you wish 'as' 'steve.' The first command will prompt you for steve's password, and does not use the sudo entry at all. The second two are 'exactly the same', you will become 'steve' without entering a password.

If you had coded: joe ALL=(root) /bin/su - steve you'd have to enter your own (joes') password, then you will become 'steve'.

0

su (switch user) command is used to switch to a particular user.

For eg: su tom    ----------> to login as tom

sudo su will switch to root user.

sudo is used to grand special permissions to a normal user. But the condition is that, the sudo user must be enabled in the sudoers file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .