When run from the command line, su asks for the target user's password, and if authenticated, grants the operator access to that account and the files and directories that account is permitted to access. john@localhost:~$ su jane Password: jane@localhost:/home/john$ exit logout john@localhost:~$ When used with a
hyphen () it can be used to start a login shell. In this mode users can assume the user environment of the target user. john@localhost:~$ su - jane Password: jane@localhost:~$ The command
sudo is related, and executes a command as another user but observes a set of constraints about which users can execute which commands as which other users (generally in a configuration file named , best editable by the command ). Unlike , authenticates users against their own password rather than that of the target user (to allow the delegation of specific commands to specific users on specific hosts without sharing passwords among them and while mitigating the risk of any unattended terminals). Some
Unix-like systems implement the user group
wheel, and only allow members to become root with . This may or may not mitigate these security concerns, since an intruder might first simply break into one of those accounts.
GNU , however, does not support the group
wheel for philosophical reasons.
Richard Stallman argues that because the group would prevent users from utilizing root passwords leaked to them, the group would allow existing admins to ride roughshod over ordinary users. == See also ==