> ## Content Index > Fetch the complete content index at: https://snubmonkey.com/llms.txt > Use this file to discover other available public pages before exploring further. # Linux sudo vs. su: Understanding Privileges, Differences, and Best Practices. - URL: https://snubmonkey.com/linux-sudo-vs-su/ - Published: 2021-12-17T06:26:00.000Z - Updated: 2026-10-16T21:43:32.000Z - Description: Understand the differences between sudo and su in Linux, how they manage user privileges, authentication, and root access, and when to use each command for safer, more effective system administration. - Author: yannick Coffi - Tags: linux 🐧, how to 🪄 # Managing user privileges is fundamental to Linux system administration. Two commands commonly used to perform administrative tasks are `sudo` and `su`. Although both allow users to operate with elevated privileges, they differ in how they authenticate users, grant access, and manage administrative sessions. Understanding these differences helps you maintain better security, minimize unnecessary root access, and administer Linux systems more effectively. ## 1\. What Is Root? In Linux, `root` is the **superuser account**, equivalent to the system administrator with unrestricted privileges. Unlike ordinary users, root can access and modify virtually any file, change system configurations, manage user accounts, and control system services. With root privileges, you can: - Create, modify, and delete files regardless of their ownership or permissions. - Install, update, and remove software. - Manage users, groups, and access permissions. - Configure system services and networking. - Mount and unmount filesystems. - Modify storage devices and filesystems. - Change critical system settings. This level of access makes root essential for system administration, but it also introduces significant risks. **Linux does not automatically protect you from every destructive action performed as root**. A command executed with unrestricted privileges can damage the system without providing an additional confirmation prompt. For example: ``` $ sudo rm -rf /some/directory ``` This command recursively deletes the specified directory and its contents without prompting for confirmation. If executed against the wrong path, it can destroy important data. The risk is even greater when running commands as root because ordinary filesystem permission restrictions no longer provide the same protection. **Best practice**: Use administrative privileges only when necessary, verify destructive commands before executing them, and avoid running your entire working environment as root. ## 2\. What Is `sudo`? `sudo`, traditionally expanded as *superuser do*, allows authorized users to execute commands with the privileges of another user, usually `root`. Instead of switching to the root account, you can execute individual administrative commands from your existing user session. For example, to update the package lists on Ubuntu or Debian: ``` $ sudo apt update ``` The command typically prompts for **your own password**, not the root password. Depending on the system configuration, you may not be prompted again for a short period after successful authentication. The command runs with root privileges when permitted by the applicable `sudoers` policy. ### Key characteristics of `sudo` - **Command-level privilege escalation**: Execute individual commands with elevated privileges. - **Configurable access control**: Administrators can specify which users may execute which commands. - **Auditability**: Sudo records information about privileged command execution, typically in system logs. - **Reduced exposure**: You can perform administrative tasks without maintaining a persistent root shell. - **Flexible execution**: Commands can run as root or as another permitted user. For example, to edit a system configuration file: ``` $ sudo nano /etc/ssh/sshd_config ``` To restart the SSH service: ``` $ sudo systemctl restart ssh ``` Each command is executed with the privileges required for that operation, subject to the configured policy. **Important**: `sudo` does not inherently guarantee that every command is safe. An authorized user can still damage a system, and granting unrestricted sudo access effectively gives that user root-level control. ### Useful `sudo` options | Command | Purpose | | ------------------------ | ---------------------------------------------------------------------------------------------- | | sudo command | Execute a command with the configured target user's privileges, usually root. | | sudo -i | Start an interactive login shell as root. | | sudo -s | Start a shell with root privileges, using a shell environment that differs from a login shell. | | sudo -u username command | Execute a command as a specified user. | | sudo -l | List commands the current user is permitted to execute through sudo. | | sudo -k | Invalidate cached authentication credentials for the current user. | For example, to inspect a command's permitted sudo access: ``` $ sudo -l ``` This is particularly useful when troubleshooting administrative permissions. ## 3\. What Is `su`? `su`, short for *substitute user*, allows you to switch to another user account. When used without specifying a username, it attempts to switch to `root`. ``` $ su ``` On a typical Linux system, you will be prompted for the **root password**. If authentication succeeds, you obtain a shell running as root. Unlike running a single command through `sudo`, this shell can remain active while you execute multiple commands. For example: ``` $ su $ apt update $ systemctl status ssh $ exit ``` The commands between `su` and `exit` run as root, assuming the switch was successful and you have not changed identities again. ### Switching to another user You can also use `su` to switch to a specific account: ``` $ su rover ``` This starts a shell as `rover`, normally retaining aspects of the current environment. To start a login shell for that user, use: ``` $ su - rover ``` The `-` option initializes the target user's login environment, including the appropriate environment variables and working directory. If you are switching from an ordinary account, you generally need the target user's password. However, root can normally switch to another user without supplying that user's password. ### Key characteristics of `su` - **User switching**: Switch to root or another user account. - **Persistent sessions**: Remain in the target user's shell until you exit. - **Authentication**: Typically requires the target user's password when switching from an ordinary account. - **Environment control**: The `-` option initializes the target user's login environment. - **Broad administrative access**: A root shell allows multiple administrative operations without repeatedly invoking sudo. **Important distinction**: `su` does not inherently provide root privileges. The privileges you receive depend on the account you switch to. ## 4\. `sudo` vs. `su`: Key Differences Although both commands can provide access to root privileges, their behavior differs. | Feature | sudo | su | | ------------------ | ----------------------------------------------- | ------------------------------------------------------------------------------ | | Primary purpose | Execute commands with another user's privileges | Switch to another user | | Typical usage | sudo command | su | | Authentication | Usually the invoking user's password | Usually the target user's password | | Default target | Usually root | Root when no username is specified | | Privilege duration | Normally limited to the command's execution | Persists throughout the target user's shell session | | Access control | Configurable through sudoers policies | Controlled by account authentication and system policies | | Logging | Typically records privileged command execution | Typically records authentication events; individual commands may not be logged | | Environment | Depends on sudo options and configuration | Depends on whether a login shell is requested | | Best suited for | Individual administrative operations | Switching accounts or maintaining a dedicated user session | One important clarification: `sudo` can also start a persistent root shell through `sudo -i`, while `su` can switch to ordinary users without granting root privileges. The distinction is therefore not simply that one command is temporary and the other is permanent. **The key difference is how they authenticate, authorize, and establish the target user's execution context**. ## 5\. When Should You Use `sudo` or `su`? ### Use `sudo` when: - You need to execute an individual administrative command. - You want to avoid entering a persistent root shell. - You need access controlled by a centralized sudoers policy. - You want privileged command execution to be more easily auditable. - You are administering Ubuntu, Debian, or another system configured around sudo. For example: ``` $ sudo apt update $ sudo apt upgrade $ sudo systemctl restart nginx ``` Each command runs with the necessary privileges, assuming your sudo policy permits it. ### Use `su` when: - You need to switch to another user account. - You need a persistent shell under a different identity. - You are working on a system where root authentication is the established administrative method. - You need to test a user's login environment or troubleshoot account-specific behavior. For example: ``` $ su - www-data ``` This attempts to start a login shell as `www-data`, subject to the account's configuration and shell restrictions. If you need a root login shell instead: ``` $ su - ``` This starts a root login shell after successful authentication. **Practical recommendation**: For routine administration, prefer `sudo` where it is properly configured. Use `su` when switching identities is the actual objective or when a persistent shell is justified. ## 6\. Security Considerations Both commands can be used securely, but neither eliminates the risks associated with privileged access. ### Why `sudo` is often preferred **1\. Granular authorization** Administrators can restrict sudo access to specific commands or operations rather than granting unrestricted root access. For example, a user might be permitted to restart a particular service without being allowed to modify the entire system. **2\. Better command-level auditing** Sudo commonly records privileged command execution, providing useful information for troubleshooting and security investigations. However, logging behavior depends on the configuration. Standard sudo logs do not necessarily capture every detail of a command's activity or everything displayed in its terminal. **3\. Reduced exposure to accidental damage** Running administrative commands individually reduces the time spent working in a privileged shell. This is particularly valuable when managing production servers, remote infrastructure, and systems containing sensitive data. ### Risks associated with both commands Regardless of which command you use: - Avoid executing commands from untrusted sources with elevated privileges. - Do not grant unrestricted sudo access without a legitimate operational requirement. - Protect root credentials and user passwords. - Review sudoers rules and remove unnecessary privileges. - Avoid leaving privileged shells open when they are no longer needed. - Verify filesystem paths and command arguments before performing destructive operations. On systems that support it, review sudo permissions with: ``` $ sudo -l ``` Administrators can inspect the sudo policy using: ``` $ sudo visudo ``` Use `visudo` rather than editing `/etc/sudoers` directly. It validates the configuration before saving changes, helping prevent syntax errors that could disrupt administrative access. ## 7\. Why `su` May Not Work on Ubuntu A common source of confusion is that Ubuntu installations typically do not assign a usable password to the root account by default. Consequently, attempting: ``` $ su - ``` may fail because root password authentication has not been configured. This does not mean root is disabled or inaccessible. An authorized user can normally obtain root privileges through sudo: ``` $ sudo -i ``` This starts an interactive root login shell using sudo authorization. When finished, leave the root shell with: ``` $ exit ``` You can also run a single command as root without opening a persistent shell: ``` $ sudo command ``` **Security recommendation**: On Ubuntu, there is generally no need to enable root password authentication simply to perform administrative tasks. The default sudo-based model is sufficient for most administration workflows. ## Both `sudo` and `su` are essential Linux tools for managing user privileges. - **`sudo`** executes commands with another user's privileges, usually root. - **`su`** switches to another user and starts a shell under that account. - **`sudo -i`** opens a root login shell using sudo authorization. - **`su -`** opens a root login shell when root authentication is available. For routine administration, `sudo` generally offers better access control and accountability. Regardless of the method, follow the principle of least privilege to minimize security risks. We hope this was helpful!