suSwitch to another user
su starts a shell (or one command) as another user after asking for THAT user's password. su - gives a full login environment. On modern servers root's password is locked, so su is mostly used by root to become service accounts, while people use sudo.
su [-] [-s SHELL] [-c COMMAND] [USER]You need to run a database maintenance command as the postgres user on the DB server.
suSubstitute user: runs a shell as another account (util-linux).
/usr/bin/su is setuid root. It looks up the target account, then runs the PAM stack in /etc/pam.d/su: pam_rootok lets root through without a password; everyone else must type the target user's password (not their own), and the account phase checks expiry and lock state. On success su calls setgid, initgroups and setuid to take on the target's UID and groups, opens a PAM session, and executes the target's login shell from /etc/passwd. Plain su keeps most of your environment and your current directory, only setting HOME, SHELL, USER and LOGNAME (unless the target is root) and keeping your PATH. su - (--login) clears the environment, sets a default PATH, changes to the target's home and runs the shell as a login shell so it reads /etc/profile and ~/.profile. If the target's shell is /usr/sbin/nologin, the shell itself refuses; -s /bin/bash overrides that for root.
su is a setuid-root program that authenticates you as the target user through PAM, switches credentials and starts their login shell.
su is owned by root with the setuid bit, so it starts with effective UID 0. It needs that power to read shadow and to change its own UID later.
- / -l / --loginFull login environment (recommended)-c CMDRun a single command and return-s SHELLUse this shell (e.g. bash for a nologin account)-m / -pPreserve the current environment-g GROUPPrimary group to use (root only)-P / --ptyRun the command in a new pseudo-terminal (safer with -c)(no user)Become root (needs root's password)su without -, then running scripts as the other userYou keep your own PATH, directory and variables, so the script behaves differently from the real user's login, and secrets in your env leak.
su - USER (or sudo -iu USER)Setting a root password on Ubuntu so that su - worksA root password is one more shared secret to brute-force, and root logins aren't attributed to a person.
Use sudo -i: per-user authentication and an audit trailsu - www-data and assuming it failed because of permissions'This account is currently not available' is nologin doing its job.
sudo -u www-data COMMAND, or sudo su -s /bin/bash www-data for a shellTyping your own password when su asks for onesu always authenticates the TARGET user (except when root runs it).
Use sudo when you want to authenticate as yourselfTry these on a Linux machine of your own. Each task has a hint and a solution.
Run 'whoami; pwd' as root using su through sudo, with a login environment.
Show the difference in current directory between su and su - when switching to devops from /tmp as root.
Run 'id' as the www-data user even though its shell is nologin.
suSwitch to another user
su starts a shell (or one command) as another user after asking for THAT user's password. su - gives a full login environment. On modern servers root's password is locked, so su is mostly used by root to become service accounts, while people use sudo.
su [-] [-s SHELL] [-c COMMAND] [USER]You need to run a database maintenance command as the postgres user on the DB server.
suSubstitute user: runs a shell as another account (util-linux).
/usr/bin/su is setuid root. It looks up the target account, then runs the PAM stack in /etc/pam.d/su: pam_rootok lets root through without a password; everyone else must type the target user's password (not their own), and the account phase checks expiry and lock state. On success su calls setgid, initgroups and setuid to take on the target's UID and groups, opens a PAM session, and executes the target's login shell from /etc/passwd. Plain su keeps most of your environment and your current directory, only setting HOME, SHELL, USER and LOGNAME (unless the target is root) and keeping your PATH. su - (--login) clears the environment, sets a default PATH, changes to the target's home and runs the shell as a login shell so it reads /etc/profile and ~/.profile. If the target's shell is /usr/sbin/nologin, the shell itself refuses; -s /bin/bash overrides that for root.
su is a setuid-root program that authenticates you as the target user through PAM, switches credentials and starts their login shell.
su is owned by root with the setuid bit, so it starts with effective UID 0. It needs that power to read shadow and to change its own UID later.
- / -l / --loginFull login environment (recommended)-c CMDRun a single command and return-s SHELLUse this shell (e.g. bash for a nologin account)-m / -pPreserve the current environment-g GROUPPrimary group to use (root only)-P / --ptyRun the command in a new pseudo-terminal (safer with -c)(no user)Become root (needs root's password)su without -, then running scripts as the other userYou keep your own PATH, directory and variables, so the script behaves differently from the real user's login, and secrets in your env leak.
su - USER (or sudo -iu USER)Setting a root password on Ubuntu so that su - worksA root password is one more shared secret to brute-force, and root logins aren't attributed to a person.
Use sudo -i: per-user authentication and an audit trailsu - www-data and assuming it failed because of permissions'This account is currently not available' is nologin doing its job.
sudo -u www-data COMMAND, or sudo su -s /bin/bash www-data for a shellTyping your own password when su asks for onesu always authenticates the TARGET user (except when root runs it).
Use sudo when you want to authenticate as yourselfTry these on a Linux machine of your own. Each task has a hint and a solution.
Run 'whoami; pwd' as root using su through sudo, with a login environment.
Show the difference in current directory between su and su - when switching to devops from /tmp as root.
Run 'id' as the www-data user even though its shell is nologin.