The biggest difference is that with
sudo you don't need the root password to run a command as root, as you would for
su. You do need the root password to add someone to the
sudoers file but thereafter that person can run all or some (if you've restricted it) as root without requiring a further password.
The other difference is, as you've noted,
sudo allows a much finer control over exactly what commands can be run.
For details of the format of the
sudoers file run
man sudoers. You'll find examples there of allowing only certain commands to be run as root. The basic structure of each line is:
user_list host_list = cmd_list
cmd_list can include details of which user the real user is allowed to switch to. For instance, you might allow a webmaster to switch to wwwroot to restart apache but not to root. It can also include other options such as whether the users password is required before switching (this is the default).
An example line might be:
joe ALL=(ALL) ALL
which means: let joe run any command on any host as any user. A tighter line might be:
joe ALL=(operator) /usr/local/ops/
which means: let joe run any command in the /usr/local/ops directory as the user "operator".
There are lots of examples at the end of the sudoers man page.
You should edit
/etc/sudoers with the command
visudo. This checks that the file is legal and helps prevent you from accidently breaking it.