7

sudo su - will elevate any user(sudoer) with root privilege.

su - anotheruser will switch to user environment of the target user, with target user privileges

What does sudo su - username mean?

3 Answers 3

14

Just repeating both @dr01 and @OneK's answers because they are both missing some fine details:

  • su - username - Asks the system to start a new login session for the specified user. The system will require the password for the user "username" (even if its the same as the current user).
  • sudo su - username will do the same, but first ask the system to be elevated to super user mode, after which su will not ask for "username"'s password because a super user is allowed to change into any other user without knowing their password. That being said, sudo in itself enforces security by by checking the /etc/sudoers file to make sure the current user is allowed to gain super user permissions,and possibly verifying the current user's password.

I would also like to comment that to gain a super user login session, please use sudo -i (or sudo -s) as sudo su - is just silly: its asking sudo to give super user permissions to su so that su can start a login shell for the super user - when sudo can achieve the same result better it by itself.

7
  • So.. what should be the entry in /etc/sudoers file? for sudo su - foo working... Sep 19, 2018 at 14:00
  • The default on Debian style OS of giving members of the admin group permissions to do anything (as long as they know their own password) is: %admin ALL=(ALL) ALL. If you want to give specifically permission to run su - foo, then it should be username ALL=/usr/bin/su - foo and there are various features you can set or limit - see man sudoers for the full spiel and some useful examples.
    – Guss
    Sep 20, 2018 at 7:05
  • @Guss - What are the differences between sudo -i and sudo -s and why choose one over another? Secondly, why use sudo -i for example when there is the option to use su -?
    – Motivated
    Jan 16, 2019 at 19:07
  • 2
    @Motivated: -i is a "login shell", while -s is an "interactive shell". There's a very delicate difference between the two which is mostly shell implementation dependant and has to do with initialization sequence and which setting files are loaded. Read your shell's manual page for exact details, but its also a good idea to consult man sudo.
    – Guss
    Jan 17, 2019 at 14:31
  • 1
    Secondly: sudo -i and su - do the same thing (su - is equivalent to su --login), using different authorization mechanism: su verifies the password for the root account, while sudo verifies the password for your current user account and also verifies that your current user account is allowed to run administrative operations according to the /etc/sudoers policy. This is the reason sudo is prefered: it doesn't require your system to have a root password (which is considered insecure) and usage is subject to a finer grained security policy.
    – Guss
    Jan 17, 2019 at 14:35
6

Having superuser rights, sudo su - username will log you in (in a login shell) as $username without asking for a password, while su - username will ask for the password of $username.

5
  • 2
    No need to be super user to su - username, if you know the passwd Aug 22, 2018 at 14:04
  • From my understanding that is what I answered? You don't need to be superuser to su, but being super user, it won't ask you for a password of the user you want to become.Edit: after your edit, @overexchange, it makes more sense to me.
    – OneK
    Aug 22, 2018 at 14:06
  • Does that mean... sudo is used to just give privilege as sudoer without a need of passwd? or something more than that... Aug 22, 2018 at 14:07
  • sudo will execute the command that follows as the user with elevated rights. Hence, you might as well change the password for the $username, so you can become the user as well without being asked for a password.
    – OneK
    Aug 22, 2018 at 14:09
  • As a sudoer...switching to target user without a passwd, but still getting elevated rights of that target user.... Aug 22, 2018 at 14:15
3

sudo su - username does the same as su - username: runs a login shell as username.

su - username run as root and sudo su - username do not require to know username's password (as they are run with elevated privileges), while su - username run as a normal user requires to know it.

5
  • For a user(user1) to run with appropriate sudo rights, What are the changes required for achieving this sudo rights? Aug 22, 2018 at 13:58
  • Sudo rights are defined in /etc/sudoers
    – dr_
    Aug 22, 2018 at 13:59
  • 1
    We would not require password in former case unlike latter case Aug 22, 2018 at 14:02
  • for your point: "can only be run by the superuser" If current user has passwd, then you would not need to be superuser.. Isn't it? Aug 22, 2018 at 14:04
  • Apologies, what I wrote was wrong. Caffeine abstinence probably... I corrected my answer.
    – dr_
    Aug 22, 2018 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .