Can I combine the security of
su (which is in my view, and broadly speaking: not everybody can be root) and the convenience of
sudo (password timeout) if I:
- create a user "admin" (for example)
- give ONLY this user full sudo (
admin ALL=(ALL:ALL) ALL)
- instead of using
su(when logged in as "johndoe") I use
sudo -u admin mycommand
Wouldn't that combine both advantages or do I forget something?
Recently I read that there are disadvantages of
sudo in terms of security (here and elsewhere) and it made me think about my approach.
I don't want to get into the topic whether to prefer
sudo in general (or vice versa).
In my opinion it's convenient that
sudo lets you run commands for some minutes without having to enter the password and after timeout requests it again.
In contrast, you can forget to close the shell where you've run
su; it shouldn't be, but people forget -- that's reality.