su (Unix)

From Wikipedia, the free encyclopedia

The Unix su (substitute user or switch user) command is used to assume the shell of another user without logging out. It is commonly used to change to root user permissions for administrative work without logging off and back on; it is also used to switch to other users in the same way. Desktop environments such as KDE and GNOME have programs that pop up a password query box before allowing a user to run commands that would typically require such access. Note: su is not an abbreviation for superuser.

[edit] Usage

When run from a terminal command line, as is typical, su asks for the target user's password, and, if accepted, grants the user access to that account. When run without any options or arguments the target user is assumed to be the root user, as if the command su root had been issued.

johndoe@klinger:~$ su
Password: 
root@klinger# exit
exit
johndoe@klinger:~$

Additionally, you can switch to another user who is not the superuser; e.g. su jane.

johndoe@klinger:~$ su jane
Password:
[jane@klinger /home/johndoe]$ exit
johndoe@klinger:~$

Optionally, you can use a hyphen with su to invoke a login shell and assume the target user's complete user environment:

johndoe@klinger:~$ su - jane
Password:
[jane@klinger ~]$

A related command called sudo executes a command as another user but observes a set of constraints about which users can execute which commands as which other users (generally in a configuration file named /etc/sudoers, best editable by the command visudo). Unlike su, sudo authenticates users against their own password rather than that of the target user (to allow the delegation of specific commands to specific users on specific hosts without sharing passwords among them and while mitigating the risk of any unattended terminals).

Great care must be taken by a system administrator to choose a suitable password for the root account, to prevent any possible takeover by a low level user running su. Some Unix-like systems have a wheel group of users, and only allow these users to su to root. This may or may not mitigate these security concerns, since an intruder might first simply break into one of those accounts. GNU su, however, does not support a wheel group; this was done for philosophical reasons.^[1]

[edit] See also

• Superuser
• Sudo
• Unix security
• Wheel war
• List of Unix programs
• Comparison of privilege authorization features

[edit] References

[edit] External links

• su — manual pages from GNU coreutils.
• su(1) – Linux man page
• The su command — by The Linux Information Project (LINFO)
• Definition of su — dictionary.die.net
• runas — Windows XP has a similar command

This Unix-related article is a stub. You can help by expanding it.