Can I combine the security of su (which is in my view, and broadly speaking: not everybody can be root) and the convenience of sudo (password timeout) if I:

  1. create a user "admin" (for example)
  2. give ONLY this user full sudo (admin ALL=(ALL:ALL) ALL)
  3. instead of using su (when logged in as "johndoe") I use sudo -u admin mycommand

Wouldn't that combine both advantages or do I forget something?

Recently I read that there are disadvantages of sudo in terms of security (here and elsewhere) and it made me think about my approach.

I don't want to get into the topic whether to prefer su over sudo in general (or vice versa).

In my opinion it's convenient that sudo lets you run commands for some minutes without having to enter the password and after timeout requests it again. In contrast, you can forget to close the shell where you've run su; it shouldn't be, but people forget -- that's reality.

  • Wouldn't sudo -u admin foo run foo as admin, and not as root? Was that what you wanted? Or did you mean you'd do sudo -u admin sudo something...? I'm not sure what you mean with "not everybody can be root" as a feature of su in specific: doesn't sudo give you more fine-grained control on what commands your users can run? – ilkkachu May 29 '17 at 10:41
  • yes, sudo is fine grained, but sometime to fine grained?! As simplified example - in private: I dont want to whitelist every command, but don't want to work as root either. My thinking is: I have to use a different password, but NOT the root password (as it would be with su) (maybe I have to say, I'm starting with Linux administration and want to get a grip on that whole topic. Thats why I searched and read some articles but didn't found an really good bestPractice/explaination on this, so if you got links I would be grateful) – eli May 29 '17 at 10:47
  • What is the advantage of not using the root password, if you're granting access to privileged commands such as passwd -u root? – sourcejedi May 29 '17 at 10:50
  • ... and I thought "sudo -u admin COMMAND" would be sufficient, but yes, maybe it has to be "sudo -u admin sudo COMMAND" (maybe this could be aliased) – eli May 29 '17 at 10:51
  • 4
    I don't get the part about "a different a password but not the root password" either if you want to allow running arbitrary commands as root anyway. Just set Defaults rootpw or Defaults targetpw and have sudo ask for the password of the user whose powers you're going to use, and not the password of the user using those powers (running sudo) – ilkkachu May 29 '17 at 11:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.