su - user Vs sudo su - user

linux sudo users su

32,156

Solution 1

Just repeating both @dr01 and @OneK's answers because they are both missing some fine details:

su - username - Asks the system to start a new login session for the specified user. The system will require the password for the user "username" (even if its the same as the current user).
sudo su - username will do the same, but first ask the system to be elevated to super user mode, after which su will not ask for "username"'s password because a super user is allowed to change into any other user without knowing their password. That being said, sudo in itself enforces security by by checking the /etc/sudoers file to make sure the current user is allowed to gain super user permissions,and possibly verifying the current user's password.

I would also like to comment that to gain a super user login session, please use sudo -i (or sudo -s) as sudo su - is just silly: its asking sudo to give super user permissions to su so that su can start a login shell for the super user - when sudo can achieve the same result better it by itself.

Solution 2

Having superuser rights, sudo su - username will log you in (in a login shell) as $username without asking for a password, while su - username will ask for the password of $username.

Solution 3

sudo su - username does the same as su - username: runs a login shell as username.

su - username run as root and sudo su - username do not require to know username's password (as they are run with elevated privileges), while su - username run as a normal user requires to know it.

32,156

overexchange

Updated on September 18, 2022

Comments

overexchange almost 2 years

sudo su - will elevate any user(sudoer) with root privilege.

su - anotheruser will switch to user environment of the target user, with target user privileges

What does sudo su - username mean?
overexchange almost 6 years

For a user(user1) to run with appropriate sudo rights, What are the changes required for achieving this sudo rights?
dr_ almost 6 years

Sudo rights are defined in /etc/sudoers
overexchange almost 6 years

We would not require password in former case unlike latter case
overexchange almost 6 years

for your point: "can only be run by the superuser" If current user has passwd, then you would not need to be superuser.. Isn't it?
overexchange almost 6 years

No need to be super user to su - username, if you know the passwd
OneK almost 6 years

From my understanding that is what I answered? You don't need to be superuser to su, but being super user, it won't ask you for a password of the user you want to become.Edit: after your edit, @overexchange, it makes more sense to me.
overexchange almost 6 years

Does that mean... sudo is used to just give privilege as sudoer without a need of passwd? or something more than that...
OneK almost 6 years

sudo will execute the command that follows as the user with elevated rights. Hence, you might as well change the password for the $username, so you can become the user as well without being asked for a password.
overexchange almost 6 years

As a sudoer...switching to target user without a passwd, but still getting elevated rights of that target user....
dr_ almost 6 years

Apologies, what I wrote was wrong. Caffeine abstinence probably... I corrected my answer.
overexchange almost 6 years

So.. what should be the entry in /etc/sudoers file? for sudo su - foo working...
Motivated over 5 years

@Guss - What are the differences between sudo -i and sudo -s and why choose one over another? Secondly, why use sudo -i for example when there is the option to use su -?
Guillaume Boudreau over 5 years

@Motivated: -i is a "login shell", while -s is an "interactive shell". There's a very delicate difference between the two which is mostly shell implementation dependant and has to do with initialization sequence and which setting files are loaded. Read your shell's manual page for exact details, but its also a good idea to consult man sudo.
Guillaume Boudreau over 5 years

Secondly: sudo -i and su - do the same thing (su - is equivalent to su --login), using different authorization mechanism: su verifies the password for the root account, while sudo verifies the password for your current user account and also verifies that your current user account is allowed to run administrative operations according to the /etc/sudoers policy. This is the reason sudo is prefered: it doesn't require your system to have a root password (which is considered insecure) and usage is subject to a finer grained security policy.
Motivated over 5 years

@Guss - Thanks. In reading the man page it isn't clear as to the selecting the appropriate command. For example, when should sudo -i and sudo -s be used?
Guillaume Boudreau over 5 years

I recommend only using sudo -i as it behaves like su - that everyone knows (and loves >:-( ), so there'd be fewer surprises. If your root shell is Bash, then the difference between -i and -s is that -i causes the profile file to be loaded while -s will cause the .bashrc file to be loaded (it is usually also loaded from the profile file) - so if you know there are settings in the profile file you'd like to skip, use -s. Otherwise, stick with -i.