I know how is working 'sudo su - ' or sudo. But not sure why after sudo wave I just can't login on root with 'sudo su -' but with 'sudo su - root' im able to. Where is the difference?

btw. Ldap is implemented - it is because of that?

  • 1
    What error do you get when you try sudo su -? – Barmar Jul 5 '17 at 20:39
  • sorry, user <id> is not allowed to execute 'bin/su -' as root on <server>. – Null0007 Jul 5 '17 at 20:43
  • Sounds like an issue with the /etc/sudoers file. It allows sudo su - root but not sudo su -. – Barmar Jul 5 '17 at 20:44
  • yeah it is strange.. – Null0007 Jul 5 '17 at 20:54
  • SO edit the sudoers file to allow what you want. – Barmar Jul 5 '17 at 20:55

I was wonder if

sudo su

is exactly the same as

sudo -s

or if that's more like

sudo sa

even though it appears sa for system administrator is no longer included in the ubuntu variant by default (apt install acct), so I guess I mean logically. Actually I guess I am showing my age with 'sa' but never used it because at the time 'su' was a more direct approach.

doing 'su' directly is not possible as you need the root password but the account is disabled by default.

It is added security to have a different user that has access then the hacker has to guess the username as well as a password, but you can add back root, and disable the sudoers for the still unknown account, which would be more secure with double passwords and an unknown username.

here's how to enable

sudo su
passwd root
passwd -u root

and to disable or lock root again

passwd -l root

You will see this difference in the prompt path not having changed to the tilde (aka user's home directory) vs full /home/user path of the user that just su'ed so probably less desirable then sudo su or sudo -s anyway.

Actually root still cant use SSH to login directly by default anyway so it is added security if you eventually disable the original login account from sudoers.

This is probably the cleanest safest feeling way to do it meaning remove a user from the group sudo. (obviously you would preferable not need to prefix with sudo since you su'ed to root).

gpasswd -d username sudo

If you also double up the length of the passwords (for both accounts) other then an obvious guessable plain doubling so say 16 characters then it's pretty secure. Actually to this point it may still be untrue since man crypt shows 'By taking the lowest 7 bits of each of the first eight characters of the key, a 56-bit key is obtained.' may still only use the first 8 chars anyway, my tests say otherwise so maybe that's another good question about password lengths.

Yes you can still su from the ssh login user after removal from the group.

MasterJames Lesson of the day and every day for many things is: old school was always better, changing perfection is normal but it doesn't make it right.

Only thing different from way back is you can't SSH directly to root. If FTP is not as secure maybe don't use it anyway. use rsync over SSH etc.

Final note is if you want to generate the password file shadow encrypted string in an automated shell etc try this link for more. https://unix.stackexchange.com/questions/81240/manually-generate-password-for-etc-shadow There are many ways but this is simplest. (if on the command line to avoid adding to history put a space first).

 echo "root:newword1" | chpasswd

Actually this is looking more like the shadow file.

 python3 -c "from crypt import *; print('\n'+crypt('mypassword123', METHOD_SHA512));" | sed '/^$/d'
|improve this answer|||||

sudo su - means run the command su as sudo which means as root. Here the system will ask you for your password since you are a sudoer. So when you offer your password then you are now working with root ability so when you run now su by the time you are using root abilities so you don't need any password. It's same as if you are a root then su to any other user will not ask for the password because you are a root.

when you just run the command su the system is not dealing with you that you are a sudo and deals with you as a normal user to it will ask for the root password since su means to switch to root user.


|improve this answer|||||
  • -1, this doesn't deal with the issue in question at all – gronostaj Apr 25 '19 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.