1

I see a lot of posts out there that say you type in sudo su to get an interactive prompt with root privileges, and I see equally many posts debating the pros and cons over sudo -i vs sudo su.

Here I'm sitting scratching my head over why people don't just write su... After all su is short for subsitute user and switches to root by default, so is there really any need at all to write sudo su?

2

If you can use simply su, you should.

But, in most modern (desktop-) Linux distributions (for example Ubuntu) the root user is disabled and has no password set. Therefore you cannot switch to the root user with su (you can try). You have to call sudo with root privileges: sudo su.

  • I guess this is enabled on ubuntu servers.. because I can do it just fine on mine – Electric Coffee Aug 25 '15 at 20:37
  • 1
    @ElectricCoffee I don't know the ubuntu server version, but in the desktop version it's disabled. – chaos Aug 25 '15 at 20:39
  • -1 for "If you can simply use su, you should"; this is subjective at best, and bad advice at worst. Ideally, the use of sudo instead of su allows significantly more control over what a user is able to do with elevated privileges; and su without an extra dash is generally bad practice as it preserves the environment. – Rob Dec 31 '15 at 20:55
1

Both programs are suid root. There is no reason to ever type sudo su except for the situation where one is unfamiliar with the -i and -E options to sudo, or otherwise in the habit of doing things as root without understanding why they're done. The su commands passes through a few hard-coded environment vars (or, on recent Linux, can use -p to pass through the entire environment), while sudo can control exactly which variables pass through (try $DISPLAY for a useful example). The su command can only prompt for the target user's password (assuming a default pam stack), while sudo can be configured to authenticate as the source or target user, or neither, or always root - and can do so per command. The su command resets $HOME, while sudo can decide based on the ruleset available. And that's one more forked process that doesn't need to exist. Meanwhile, sudo logs the commands that it runs, so as long as you're not just doing sudo -i or otherwise launching a shell, you can get a way better audit trail with sudo. When you run a command using sudo, it removes both . and empty elements in $PATH and then checks those last if they were present, preventing people from sticking a shell script named "ls" in /tmp and similar shenanigans. :)

Basically, sudo su is like nailing one hand behind sudo's back and gaining nothing. :)

0

On some systems, su to root is not enabled for normal users, so sudo su is required.

  • it's worked just fine on all the systems I've tested it on.. Linux and BSD alike, hence the confusion – Electric Coffee Aug 25 '15 at 20:33
  • Why sudo su and not sudo -i? – roaima Aug 25 '15 at 21:00
  • @roaima sudo -i does not inherit the root PATH. Try echo $PATH and then sudo -i echo $PATH, then do sudo -i and once at a root prompt, do echo $PATH. – Klaatu von Schlacker Aug 25 '15 at 22:03
  • 1
    @Klaatu but sudo -i echo $PATH is evaluating $PATH in the user's context, not root's. – roaima Aug 25 '15 at 22:25
  • [user@host] /home/user$ sh -c 'echo $PATH' /usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/opt/quest/bin:/usr/local/sec:/var/cfengine/bin [user@host] /home/user$ sudo -i sh -c 'echo $PATH' /usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/opt/quest/bin:/usr/local/sec:/var/cfengine/bin:/var/cfengine/bin:/root/bin – dannysauer Aug 31 '15 at 17:45
0

sudo su, sudo -i and all other sudo requires the users password.

su requires the root password.

  • wouldn't that make sudo su highly unsafe compared to simply using su? – Electric Coffee Aug 25 '15 at 21:40
  • @ElectricCoffee Both are unsafe: Having a root shell is unsafe; One slip of the fingers can cause a lot of damage. sudo is more secure that su, as sudo uses users password (note only those with appropriate privileges can use sudo), therefore we do not have to distribute a new root password every time someone leaves the group. – ctrl-alt-delor Aug 26 '15 at 7:14
  • 1
    @ElectricCoffee: Someone who has a sudo rule to run "su" with no password (or with their own password) has been explicitly given that permission by the sudoers configuration. The argument would be that a user's password is more secure than a shared root password. The same complexity rules can be enforced in both cases, but with each user having their own password, rotation does not require communicating the password out to those who need that password. One could use the rootpw or targetpw option on a sudo rule if one really wanted to retain classic su behavior with sudo's benefits. – dannysauer Aug 31 '15 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.