Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have sudo configured like this:

joe ALL=(root) NOPASSWD: /bin/su - steve

What it does exactly?

I am confused.

I guess there's three different ways to execute that command:

  1. su - steve

  2. sudo su - steve

  3. sudo -u root su - steve

In which cases it's not going to ask for a password? What is the difference between commands 2 and 3?

When joe runs command 2, will it run as user joe or root?

share|improve this question

3 Answers 3

It seems like you may have some confusion between what sudo and su are used for. Both enable a user to execute commands as if they are another user with different priveleges, but there are distinct differences.

An over generalization would be:

  • su - get a shell with uid/gid of an other user, authenticating with that users password.
  • sudo - run a command with uid/gid of an other user, authenticating with your password.

SU

In general, most people utilize su to initiate a shell with (s)ubstitue (u)ser id and/or group id. This is most commonly done to gain root privileges but can also be used for any system user.

If the user running su is not root, then it will ask for the password of the user you are trying to su as.

  • su - login as root with a login shell that will have an environment similar to a real login. Need root's password.
  • su - alice login as alice with a login shell that will have an environment similar to a real login. Need alice's password.
  • su or su alice like examples above with difference that the initial user environment is maintained with the exception of the environment variables USER, SHELL, and HOME. This can have unexpected consequences. As example since PATH is not changed, when trying to change the password you may not be running the command /usr/bin/passwd but /usr/local/bin/passwd or even /home/{$ORIGUSER}/bin/passwd.

  • su -c command - execute the command as root with a login shell and exit to original user shell.

  • su -c command - alice execute the command as alice with a login shell and exit to original user shell.

References

SUDO

Sudo allows more flexibility than su. The most apparent to enduser is that they are authenticating using their own password or even no password if configured that way.

By utilizing the configuration file visudo, the priveleges allowed by the user can be controlled with much more controll.

As an example, you can allow a user to execute some commands with no password required and other commands may require a password.

Please see the associated man pages to get an idea of all the variations that can be done.

References

The two most visible benefits of sudo vs su

  • The ability to give certain groups of users the root privileges of only a subset of commands without having to give them the root password. This allows a way to have a restrictive tier of administrator level users with root access to only the commands they need to do their job.
  • Since you are only executing one command as root, lowers risks of accidental harm. For an example, you think you are in your user directory /home/user/myjunkdocs and run rm -rf but you are actually in the root directory and delete the system software.
share|improve this answer

su logs in to the superuser by default (or the specified user) but it requires the target's password (i.e. su root needs the root password). It has nothing to do with sudo.

sudo su will log you in as root with joe's password. It'll prompt you for joe's password, and then runs the command su as root, which doesn't require a password for the superuser (root). Meaning, it will log you in to a root shell with joe's password.

The third command does the same thing, it just specifies explicitly that you want to run the command su as root, which is the default anyway, just more explicit.

share|improve this answer

su (switch user) command is used to switch to a particular user.

For eg: su tom    ----------> to login as tom

sudo su will switch to root user.

sudo is used to grand special permissions to a normal user. But the condition is that, the sudo user must be enabled in the sudoers file.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.