Dit deel is nog niet vertaald. Je ziet de Engelse tekst.
Wat het doet
su means "substitute user". Without a name it switches to root. You must know the password of the target user — only root can switch without a password.
Always use su - (or su -l): it starts a full login shell with the environment and home folder of the new user. Without the dash you keep your own PATH and variables, which can give strange results.
On RHEL, sudo is the better tool for admin work: it uses your own password and logs every command. su is still useful for root itself, to test what another user sees.
Zo schrijf je het
su [OPTION]... [-] [USER [ARGUMENT]...]Opties 12
Meest gebruikt
Niets past bij dit filter.
Voorbeelden 11
$ als gewone gebruiker# als root (of met sudo)
1Become root with a full login shell
su - Password: pwd /rootType the root password.
exitbrings you back.2Switch to another user
su - lisaYou need lisa's password (root does not).
3Run one command as root
su -c 'dnf -y update' -Runs the command and returns to your normal shell.
4Test what a user can see
su - lisa -c 'ls -l /srv/share'root can check permissions as the user without knowing the password.
5Use a shell for an account with nologin
su -s /bin/bash -c 'whoami; id' apache apacheService accounts have /sbin/nologin; -s gives a shell for a test.
6See the difference with and without the dash
Without
-you stay in your folder with your environment.7Check which accounts may not log in
su - carol This account is currently not available.The shell /sbin/nologin refuses the login.
8Keep one variable with a login shell
su - -w HTTPS_PROXY lisaUseful when a proxy setting must be kept.
9Start the session in its own terminal (more secure)
su -P - lisaProtects against tricks where a program writes into your terminal (TIOCSTI).
10Find failed su attempts (security)
Many failures for root can mean somebody guesses passwords.
11Allow su to root only for wheel members
grep pam_wheel /etc/pam.d/su #auth required pam_wheel.so use_uidRemove the
#to allowsuonly for members of wheel (hardening).
Niets past bij dit filter.
Let op
- Without
-the environment is not changed. Usesu -. - On many cloud images root has no password, so
su -fails. Usesudo -i.
Bestanden
/etc/pam.d/su- PAM rules for su (like pam_wheel).
/var/log/secure- Log of su and sudo use.
Tips om te onthouden
- su = password of the target user; sudo = your own password.
sudo -igives the same root login shell assu -.
Exitcodes
0 :: The command ran (or the exit code of the command run with -c). 1 :: Error (for example a wrong password). 126 :: The command could not be run. 127 :: The command was not found.