I know how is working 'sudo su - ' or sudo. But not sure why after sudo wave I just can't login on root with 'sudo su -' but with 'sudo su - root' im able to. Where is the difference?
btw. Ldap is implemented - it is because of that?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
I was wonder if
is exactly the same as
or if that's more like
even though it appears sa for system administrator is no longer included in the ubuntu variant by default (apt install acct), so I guess I mean logically. Actually I guess I am showing my age with 'sa' but never used it because at the time 'su' was a more direct approach.
doing 'su' directly is not possible as you need the root password but the account is disabled by default.
It is added security to have a different user that has access then the hacker has to guess the username as well as a password, but you can add back root, and disable the sudoers for the still unknown account, which would be more secure with double passwords and an unknown username.
here's how to enable
sudo su passwd root passwd -u root
and to disable or lock root again
passwd -l root
You will see this difference in the prompt path not having changed to the tilde (aka user's home directory) vs full /home/user path of the user that just su'ed so probably less desirable then sudo su or sudo -s anyway.
Actually root still cant use SSH to login directly by default anyway so it is added security if you eventually disable the original login account from sudoers.
This is probably the cleanest safest feeling way to do it meaning remove a user from the group sudo. (obviously you would preferable not need to prefix with sudo since you su'ed to root).
gpasswd -d username sudo
If you also double up the length of the passwords (for both accounts) other then an obvious guessable plain doubling so say 16 characters then it's pretty secure. Actually to this point it may still be untrue since man crypt shows 'By taking the lowest 7 bits of each of the first eight characters of the key, a 56-bit key is obtained.' may still only use the first 8 chars anyway, my tests say otherwise so maybe that's another good question about password lengths.
Yes you can still su from the ssh login user after removal from the group.
MasterJames Lesson of the day and every day for many things is: old school was always better, changing perfection is normal but it doesn't make it right.
Only thing different from way back is you can't SSH directly to root. If FTP is not as secure maybe don't use it anyway. use rsync over SSH etc.
Final note is if you want to generate the password file shadow encrypted string in an automated shell etc try this link for more. https://unix.stackexchange.com/questions/81240/manually-generate-password-for-etc-shadow There are many ways but this is simplest. (if on the command line to avoid adding to history put a space first).
echo "root:newword1" | chpasswd
Actually this is looking more like the shadow file.
python3 -c "from crypt import *; print('\n'+crypt('mypassword123', METHOD_SHA512));" | sed '/^$/d'
sudo su - means run the command su as sudo which means as root. Here the system will ask you for your password since you are a sudoer. So when you offer your password then you are now working with root ability so when you run now su by the time you are using root abilities so you don't need any password. It's same as if you are a root then su to any other user will not ask for the password because you are a root.
when you just run the command su the system is not dealing with you that you are a sudo and deals with you as a normal user to it will ask for the root password since su means to switch to root user.