How do I run a command as the system administrator (root)

Question

I need to run a command with administrative privileges. Someone said I should run a command as root. How do I do this?

Answer 1

The main two possibilities are:

• Use su and enter the root password when prompted.
• Put sudo in front of the command, and enter your password when prompted.

---

Running a command as root

sudo

This is the preferred method on most multi-user systems and on Ubuntu. If you don't know a separate root password, use this method.

Sudo requires that you type your own password. (The purpose is to limit the damage if you leave your keyboard unattended and unlocked.) It is often configured to not ask again for a few minutes so you can run several sudo commands in succession.

Example:

sudo service apache restart

If you need to run several commands as root, prefix each of them with sudo. Sometimes, it is more convenient to run an interactive shell as root. You can use sudo -i for that:

$ sudo -i
# command 1
# command 2
...
# exit

Instead of sudo -i, you can use sudo -s. The difference is that -i reinitializes the environment to sane defaults, whereas -s uses your configuration files for better or for worse.

For more information, see the sudo website, or type man sudo on your system. Sudo is very configurable; for example it can be configured to let a certain user only execute certain commands as root. Read the sudoers man page for more information; use sudo visudo to edit the sudoers file.

su

The su command exists on most unix-like systems. It lets you run a command as another user, including root, provided you know that user's password.

Example:

su -c 'service apache restart'

The command to run must be passed using the -c option. Note that you need quotes so that the command is not parsed by your shell, but passed intact to the root shell that su runs.

To run multiple commands as root, it is more convenient to start an interactive shell.

$ su
# command 1
# command 2
...
# exit

On some systems, you need to be in group number 0 (called wheel) to use su. (The point is to limit the damage if the root password is accidentally leaked to someone.)

Logging in as root

If authorized, you can simply type root at the login prompt and enter the root password. Be very careful, and avoid running complex applications as root as they might do something you didn't intend. Logging in directly as root is mainly useful in emergency situations, such as disk failures or when you've locked yourself out of your account.

Single User Mode

Single user mode, or run-level 1, also gives you root privileges. This is intended primarily for emergency maintenance situations where booting into a multi-user run-level is not possible. You can boot into single user mode by passing single or emergency on the kernel command line. Note that booting into single-user mode is not the same as booting the system normally and logging in as root. Rather, the system will only start the services defined for run-level 1. Typically, this is the smallest number of services required to have a usable system.

You can also get to single user mode by using the telinit command: telinit 1; however, this command requires root privileges to run.

On many systems booting into single user mode will give the user access to a root shell without prompting for a password.

Other programs

Calife

Calife lets you run commands as another user by typing your own password, if authorized. It is similar to the much more widespread sudo (see above). Calife is more light-weight than sudo but also less configurable.

Emacs

Thanks to Tramp, you can run commands as root through su or sudo within Emacs. See the section on editing root-owned files below.

In eshell, type cd /sudo:: or cd /su:: to become root. Type cd / to go back to your own user. The idea is that the current directory is on a “remote” host, which is in fact the same host but accessed as a different user.

You can also have M-! (shell-command) or M-x shell run as root. First visit a directory using the su or sudo tramp method, e.g., C-x C-f /sudo::/ RET (find-file "/sudo::/"). Then run M-! or M-x shell from the resulting dired buffer.

Op

Op lets you run commands as another user, including root. This not a full-blown tool to run arbitrary commands: you type op followed by a mnemonic configured by the system administrator to run a specific command.

Super

Super lets you run commands as another user, including root. The command must have been allowed by the system administrator.

Graphical frontends

A few other applications that use sudo or su:

Gksu, Gksudo

gksu and gksudo are graphical front-ends to su and sudo respectively. They allow you to run X Window programs as root with no hassle. They are part of Gnome. Type

gksu command --option argument

and enter the root password, or type

gksudo command --option argument

and enter your password (if authorized to run sudo).

KdeSu, KdeSudo

kdesu and kdesudo are graphical front-ends to su and sudo respectively. They allow you to run X Window programs as root with no hassle. They are part of KDE. Type

kdesu -c 'command --option argument'

and enter the root password, or type

kdesudo -c 'command --option argument'

and enter your password (if authorized to run sudo). If you check the “keep password” option in KdeSu, you will only have to type the root password once per login session.

Ktsuss

Ktsuss (“keep the su simple, stupid”) is a graphical version of su.

Beesu

Beesu is a graphical front-end to the su command that has replaced Gksu in Red Hat-based operating systems. It has been developed mainly for RHEL and Fedora.

See also Wikipedia.

Running a graphical command as root

Depending on your system, su and sudo might not let the commands you run as root to access your X Window display.

The easiest solution is to use a graphical wrapper such as gksu, kdesu, beesu, or their sudo siblings.

To achieve this manually, you'll at least need to make sure you retain the DISPLAY environment variable in the environment, as well as XAUTHORITY if present.

Editing a file as root

Obviously, if you know how to run any command as root, you can run an editor. But that's not the most convenient or the safest method.

Note: There are a few files that you should not edit directly:

• Never edit the sudoers directly. Always use the visudo command for that. If you make a mistake in the syntax of the sudoers file, you could be locked out of the root account! When you run visudo, it lets you edit a temporary copy of the file and performs a syntax verification before replacing the actual file by your edits.
• The same principle applies to the user and group databases, /etc/passwd and /etc/group. On systems where they are available, use the vipw and vigr commands respectively.

sudoedit

sudoedit (or its synonym sudo -e) is a mode of sudo where you edit a temporary copy of a file in your favorite editor, and that copy is moved into place when you finish editing.

sudoedit /etc/fstab

Emacs

You can use Emacs's remote access mechanism (Tramp) to edit files as another user. Use the su or sudo method. For example, to edit /etc/fstab, use one of the following file names:

/su::/etc/fstab
/sudo::/etc/fstab

Answer 2

Use su:

$ su -c command

or

$ su
# command
# exit

In either case, you will be prompted for the root password. For more information, see the manual page.

Answer 3

Since the question was not Linux specific, here's how you achieve the same goal in Solaris 9+ (or Trusted Solaris 8):

Solaris, since version 9, has included a suite of tools affectionately referred to as RBAC, or Role Based Access Control.

The gist of RBAC is that through the granting of Authorizations and Rights, to Users and/or Role, or the granting of Roles to Users, you can create incredibly fine grained models for who can run what with which privileges.

Essentially, you identify authorization in /etc/security/auth_attr, then grant them to users or roles in /etc/user_attr.

You define profiles in /etc/security/prof_attr. You then associate commands with those profiles in /etc/security/exec_attr, followed by assigning those profiles to users in the /etc/user_attr file.

Once those things are done, you actually run pfexec <command> to execute the command with privileged or authorizations that are granted to that user for that command.

The nice thing about RBAC is that there are no additional privileges granted to the command itself, or the user, only to the combination of user + command. So it's safer than making a binary +s, or just using sudo to make a user be able to execute pretty much anything. (I know that you can lock down sudo, but in my experience most people don't)

Another advantage of RBAC is that you can make root a role account, and assign that role to users who are able to become root with the 'su' command and the root password. The root user will also be able to log in in Single User Mode, which is better (in my opinion) than the Linux model where you can disable the root password passwd -d root, or lock the root account passwd -l root, both of which make logging in as root quite hard when something goes wrong.

Ben Rockwood has a great blog post on RBAC that can be read at Using RBAC on (Open)Solaris.

Answer 4

Or you can give some commands a superpower. I'm talking about special permissions in which commands are executed with the permission of owner.

Get the path of command by #which <command> and set SUID or SGID for that path.

P.S. - SUID and SGID bits should be given with care. They can make your system insecure.

Answer 5

use : su - root and passwd of root.