What it does
su means "substitute user". Without a name it switches to root. You must know the password of the target user — only root can switch without a password.
Always use su - (or su -l): it starts a full login shell with the environment and home folder of the new user. Without the dash you keep your own PATH and variables, which can give strange results.
On RHEL, sudo is the better tool for admin work: it uses your own password and logs every command. su is still useful for root itself, to test what another user sees.
How to write it
su [OPTION]... [-] [USER [ARGUMENT]...]Options 12
Most used
Nothing matches this filter.
Examples 11
$ run as a normal user# run as root (or with sudo)
1Become root with a full login shell
su - Password: pwd /rootType the root password.
exitbrings you back.2Switch to another user
su - lisaYou need lisa's password (root does not).
3Run one command as root
su -c 'dnf -y update' -Runs the command and returns to your normal shell.
4Test what a user can see
su - lisa -c 'ls -l /srv/share'root can check permissions as the user without knowing the password.
5Use a shell for an account with nologin
su -s /bin/bash -c 'whoami; id' apache apacheService accounts have /sbin/nologin; -s gives a shell for a test.
6See the difference with and without the dash
Without
-you stay in your folder with your environment.7Check which accounts may not log in
su - carol This account is currently not available.The shell /sbin/nologin refuses the login.
8Keep one variable with a login shell
su - -w HTTPS_PROXY lisaUseful when a proxy setting must be kept.
9Start the session in its own terminal (more secure)
su -P - lisaProtects against tricks where a program writes into your terminal (TIOCSTI).
10Find failed su attempts (security)
Many failures for root can mean somebody guesses passwords.
11Allow su to root only for wheel members
grep pam_wheel /etc/pam.d/su #auth required pam_wheel.so use_uidRemove the
#to allowsuonly for members of wheel (hardening).
Nothing matches this filter.
Watch out
- Without
-the environment is not changed. Usesu -. - On many cloud images root has no password, so
su -fails. Usesudo -i.
Files
/etc/pam.d/su- PAM rules for su (like pam_wheel).
/var/log/secure- Log of su and sudo use.
Tips to remember
- su = password of the target user; sudo = your own password.
sudo -igives the same root login shell assu -.
Exit codes
0 | The command ran (or the exit code of the command run with -c). |
1 | Error (for example a wrong password). |
126 | The command could not be run. |
127 | The command was not found. |