LFCS 40 🐧 Switching Users — su - KandZ

⏱️ Estimated read: 16 min | |

The su command starts a new shell as a different user. It is the traditional way to become root, or to become any other account on the system, and it is one of the first commands a Linux administrator learns. It differs from sudo in a fundamental way: sudo runs a single command with elevated privileges and then returns, while su starts a whole new interactive session as the target user. The distinction matters for how privileges are audited, how the environment is set up, and how the session ends.

Key point: su requires the target user’s password by default. A regular user who runs su alice must know alice’s password. The root user is exempt from the password check, which is why su from root to any user works without a prompt.

Why su exists

The multiple-identity problem. A Linux system has many accounts. An administrator needs to act as root, a developer needs to test as another user, and a support engineer needs to reproduce a customer’s issue. The su command provides the identity switch without requiring the user to log out and log back in.

The environment problem. A new shell as another user must have that user’s environment: the HOME, the PATH, the USER, and the rest. The su - form (with a hyphen) starts a login shell and sets the environment as if the user had logged in. The su form without the hyphen keeps the current environment, which is sometimes what the user wants and sometimes a source of subtle bugs.

The audit problem. A command run with sudo is logged with the invoking user and the command. A session started with su is logged as the target user, and the audit trail of what the user did inside the session is harder to reconstruct. The distinction matters for compliance.

The password problem. su requires the target user’s password by default. This means that a regular user who wants to become root must know root’s password, which is why many distributions disable the root password and use sudo instead. The su command still works from root, because root is not prompted.

The su -c problem. A single command can be run without starting an interactive session with the -c flag. The command is run as the target user, and the session ends when the command completes. The flag is the closest su equivalent to sudo.

The group problem. su also changes the effective group to the target user’s primary group. The -g flag overrides the group, and the -G flag sets the supplementary groups. The options are rarely used, but they exist.

The shell problem. The -s flag sets the shell to run. The default is the target user’s login shell from /etc/passwd. A user who needs a different shell uses the flag.

a. The su command

The su command has a small set of options and a simple syntax. The options that matter for the exam are -, -c, -l, -s, and -g.

The basic syntax

su [options] [username]

Without a username, su becomes root. With a username, it becomes that user.

The become root

su
# Password:
# root@host:~#

The command prompts for root’s password. When the password is correct, the shell is now root.

The become another user

su alice
# Password:
# alice@host:/home/bob$

The command prompts for alice’s password. The $ prompt indicates a regular user, and the # prompt indicates root.

The login shell

The - flag (or -l, or --login) starts a login shell. The environment is reset to the target user’s login environment, the HOME is set, the PATH is set, and the shell’s login scripts are sourced.

su - alice
# or
su -l alice
# or
su --login alice

The three forms are equivalent. The login shell is what a user would get if they logged in directly.

The environment difference

The su without the hyphen keeps the current environment, including the current HOME and PATH.

pwd
# /home/bob

su alice
pwd
# /home/bob    (the current directory is unchanged)
echo $HOME
# /home/bob    (the HOME is unchanged)

su - alice
pwd
# /home/alice  (the login shell changes to the HOME)
echo $HOME
# /home/alice

The difference is the source of most of the confusion with su. The su - form is almost always the right one.

The -c flag

The -c flag runs a single command and exits.

su -c 'whoami' alice
# alice

The command is run as the target user, and the shell exits when the command completes. The -c form is the closest su equivalent to sudo.

The -s flag

The -s flag sets the shell to run.

su -s /bin/bash alice

The target user’s login shell is used by default. The -s flag overrides it. The /usr/sbin/nologin shell is the common case: a user whose login shell is nologin cannot log in, but su -s /bin/bash can still start a shell for them.

The -g flag

The -g flag sets the primary group.

su -g developers alice

The primary group is set to developers instead of the target user’s primary group.

The -G flag

The -G flag sets the supplementary groups.

su -G developers,auditors alice

The supplementary groups are set to the specified list.

The -p flag

The -p flag preserves the environment.

su -p alice

The flag is the explicit form of the behavior of su without the hyphen.

The -w flag

The -w flag preserves the PATH environment variable only.

su -w alice

The flag is rarely used.

b. The su versus sudo

The two commands are often confused. The distinction matters for the audit and for the security model.

The session versus the command

su starts a new shell session. The user stays as the target user until they exit the shell. sudo runs a single command and returns.

# su: a new session
su - alice
# (interactive session as alice)
exit
# (back to the original user)

# sudo: a single command
sudo -u alice whoami
# alice
# (back to the original user)

The password

su prompts for the target user’s password. sudo prompts for the invoking user’s password.

# su: the target user's password
su - alice
# Password: (alice's password)

# sudo: the invoking user's password
sudo -u alice whoami
# [sudo] password for bob: (bob's password)

The difference is the security model. su requires the user to know the target’s password, which is why the root password must be shared if su is used. sudo requires the user’s own password, and the permission is granted by the sudoers configuration.

The audit

sudo logs the command, the invoking user, and the timestamp. su logs the session start and the target user, but the commands run inside the session are not individually logged.

# sudo logs the command
sudo -u alice whoami
# (logged in /var/log/auth.log)

# su logs the session
su - alice
# (logged in /var/log/auth.log)
# (the commands inside are not logged individually)

The configuration

sudo is configured in /etc/sudoers. su is not configured; the permission to use it comes from the password.

# /etc/sudoers
alice ALL=(ALL:ALL) ALL

The line grants alice the right to run any command as any user with sudo. There is no equivalent for su; the permission is the password.

The security model

The su model requires the root password to be shared among the administrators. The sudo model grants the specific users the right to run the specific commands, and the root password can be disabled. Most modern distributions use sudo for this reason.

The common pattern

A user who runs su - becomes root and stays root until they exit. A user who runs sudo becomes root for one command. The pattern is the difference between a session and a command.

The comparison table

Aspect	`su`	`sudo`
Session	New shell	Single command
Password	Target user’s	Invoking user’s
Configuration	None (the password)	`/etc/sudoers`
Audit	Session start	Each command
Root password	Required	Not required
Default shell	The target user’s	The invoking user’s
Environment	Kept, unless `-`	Reset by default

c. The common scenarios

The su command is used in specific scenarios. The scenarios are the common tasks that the exam tests.

The become root

The most common use is to become root.

su -
# Password:
# root@host:~#

The - flag is the right form. Without it, the current HOME and PATH are kept, which produces the wrong environment for the root shell.

The run a command as root

A single command is run without an interactive session.

su -c 'systemctl restart nginx' -
# Password:

The - at the end is the target user (root). The command is run as root and the session exits.

The become a service account

A service account has /usr/sbin/nologin as its shell. The su -s flag runs a shell for the account.

sudo su -s /bin/bash - postgres

The command becomes the postgres user with a bash shell, even though the postgres user’s login shell is nologin. The sudo is required because a regular user does not know the postgres password.

The become a user without a password

A user whose password is disabled or not set cannot log in. The root user can still su to the account without a password.

# As root:
su - alice
# (no password prompt)

The root user is exempt from the password check.

The run a command as another user

A single command is run as another user.

su -c 'whoami' alice
# Password:
# alice

The password is alice’s. The command is run as alice and the session exits.

The run a command as another user without a password

The root user can run a command as any user without a password.

# As root:
su -c 'whoami' alice
# alice

No password is prompted.

The switch to a different shell

A user with a different login shell is accessed with -s.

su -s /bin/zsh alice

The shell is zsh instead of the login shell from /etc/passwd.

The switch with a different group

A user is switched to with a different primary group.

su -g developers alice

The primary group is developers.

The switch with supplementary groups

A user is switched to with supplementary groups.

su -G developers,auditors alice

The supplementary groups are developers and auditors.

The su to a user from a script

A script that must run as another user uses su -c.

#!/bin/bash
su -c '/usr/local/bin/backup.sh' backup

The script runs as the backup user.

The scenario table

Scenario	Command
Become root	`su -`
Run a command as root	`su -c 'command' -`
Become a service account	`su -s /bin/bash - postgres`
Become a user without a password	`su - alice` (as root)
Run a command as another user	`su -c 'command' alice`
Switch to a different shell	`su -s /bin/zsh alice`
Switch with a different group	`su -g developers alice`
Switch with supplementary groups	`su -G developers,auditors alice`

Complete Example Session

# ============================================
# PART 1: THE BECOME ROOT
# ============================================

whoami
# bob

su -
# Password:
# root@host:~#

whoami
# root

exit
# bob

# ============================================
# PART 2: THE BECOME ANOTHER USER
# ============================================

su alice
# Password:
# alice@host:/home/bob$

pwd
# /home/bob    (the current directory is unchanged)

exit

su - alice
# Password:
# alice@host:~$

pwd
# /home/alice  (the login shell changes to the HOME)

exit

# ============================================
# PART 3: THE RUN A COMMAND
# ============================================

su -c 'whoami' alice
# Password:
# alice

# ============================================
# PART 4: THE ROOT EXEMPTION
# ============================================

# As root:
su -c 'whoami' alice
# alice
# (no password prompt)

# ============================================
# PART 5: THE SERVICE ACCOUNT
# ============================================

getent passwd postgres
# postgres:x:26:26:PostgreSQL Server:/var/lib/postgresql:/bin/bash

# If the shell is nologin:
su -s /bin/bash - postgres
# (a bash shell as postgres)

# ============================================
# PART 6: THE ENVIRONMENT DIFFERENCE
# ============================================

echo $HOME
# /home/bob

su alice
echo $HOME
# /home/bob   (the environment is kept)

exit

su - alice
echo $HOME
# /home/alice (the login shell resets the environment)

exit

# ============================================
# PART 7: THE DIFFERENT SHELL
# ============================================

su -s /bin/zsh alice
# (a zsh shell as alice)

# ============================================
# PART 8: THE DIFFERENT GROUP
# ============================================

su -g developers alice
# (a shell as alice with the primary group developers)

id
# uid=1001(alice) gid=1002(developers) groups=1002(developers)

# ============================================
# PART 9: THE SU VERSUS SUDO
# ============================================

# su: the target user's password
su - alice
# Password: (alice's password)

# sudo: the invoking user's password
sudo -u alice whoami
# [sudo] password for bob: (bob's password)
# alice

# ============================================
# PART 10: THE SCRIPT
# ============================================

cat > /usr/local/bin/backup.sh << 'EOF'
#!/bin/bash
tar czf /backup/data.tar.gz /var/data
EOF
chmod 755 /usr/local/bin/backup.sh

# Run the script as the backup user.
su -c '/usr/local/bin/backup.sh' backup

The ten parts showed the become root, the become another user, the run a command, the root exemption, the service account, the environment difference, the different shell, the different group, the su versus sudo, and the script.

Quick Reference

The su Options

Option	Purpose
`-` or `-l`	Login shell
`-c COMMAND`	Run a single command
`-s SHELL`	Set the shell
`-g GROUP`	Set the primary group
`-G GROUPS`	Set the supplementary groups
`-p`	Preserve the environment
`-w`	Preserve the `PATH` only

The Common Commands

Command	Purpose
`su`	Become root
`su -`	Become root with a login shell
`su alice`	Become alice
`su - alice`	Become alice with a login shell
`su -c 'cmd' alice`	Run `cmd` as alice
`su -s /bin/bash - postgres`	Become postgres with bash
`su -g developers alice`	Become alice with the developers group
`su -G developers,auditors alice`	Become alice with two groups

The su versus sudo

Aspect	`su`	`sudo`
Session	New shell	Single command
Password	Target user’s	Invoking user’s
Configuration	The password	`/etc/sudoers`
Audit	Session start	Each command
Root password	Required	Not required
Default shell	The target user’s	The invoking user’s

The Environment Forms

Form	Environment
`su alice`	The current environment
`su - alice`	The login environment
`su -p alice`	The current environment
`su -w alice`	The current environment, `PATH` preserved

The Prompt

User	Prompt
Regular user	`$`
root	`#`

Best Practices

✅ Do This:

# Use su - for a login shell.
su - alice  # ✅

# Use su -c for a single command.
su -c 'whoami' alice  # ✅

# Use su -s for a user with nologin.
su -s /bin/bash - postgres  # ✅

# Use sudo for one-off commands.
sudo -u alice whoami  # ✅

# Verify the identity after switching.
whoami && id  # ✅

# Exit the session when done.
exit  # ✅

❌ Don’t Do This:

# Don't use su without the hyphen.
su alice  # ❌ The environment is wrong

# Don't share the root password.
su -  # ❌ The password is shared

# Don't forget the target user in -c.
su -c 'whoami'  # ❌ The target is root

# Don't use su in a script when sudo works.
su -c 'command' user  # ⚠️ The password is required

# Don't leave a root session open.
su -
# (do not walk away)  # ❌

# Don't use su to run a single command if sudo is configured.
su -c 'systemctl restart nginx' -  # ⚠️ Use sudo instead

Common Pitfalls

Pitfall	Why It Happens	Fix
Environment is wrong	`su` without the hyphen	Use `su -`
The prompt does not change	The user is not switched	Check `whoami`
The target user cannot log in	nologin shell	Use `su -s /bin/bash`
The password is rejected	Wrong password	The target user’s password
The command fails	The target user lacks the permission	Check the target
The session is not logged	`su` logs the start only	Use `sudo` for the commands
The `-c` command is not found	The `PATH` is wrong	Use the full path

Real-World Examples

1. Become Root

su -

2. Become a User

su - alice

3. Run a Command

su -c 'whoami' alice

4. Run a Command as Root

su -c 'systemctl restart nginx' -

5. Service Account

su -s /bin/bash - postgres

6. Different Shell

su -s /bin/zsh alice

7. Different Group

su -g developers alice

8. Supplementary Groups

su -G developers,auditors alice

9. The Root Exemption

# As root:
su - alice  # No password prompt

10. The Script

su -c '/usr/local/bin/backup.sh' backup

Visual

The su Process

┌────────────────────────────────────────────────────────────┐
│  THE su PROCESS                                            │
│                                                            │
│  bob@host:~$                                               │
│  ┌──────────────────────────────────────────────────┐     │
│  │  su - alice                                       │     │
│  │    ↓                                              │     │
│  │  Password: (alice's password)                     │     │
│  │    ↓                                              │     │
│  │  alice@host:~$                                    │     │
│  │    ↓                                              │     │
│  │  (interactive session as alice)                   │     │
│  │    ↓                                              │     │
│  │  exit                                             │     │
│  │    ↓                                              │     │
│  │  bob@host:~$                                      │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  The session replaces the current shell.                   │
└────────────────────────────────────────────────────────────┘

The Environment Difference

┌────────────────────────────────────────────────────────────┐
│  THE ENVIRONMENT DIFFERENCE                                │
│                                                            │
│  su alice (no hyphen)                                      │
│  ┌──────────────────────────────────────────────────┐     │
│  │  HOME=/home/bob      ← unchanged                  │     │
│  │  PATH=...            ← unchanged                  │     │
│  │  USER=bob            ← unchanged                  │     │
│  │  pwd=/home/bob       ← unchanged                  │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  su - alice (with hyphen)                                  │
│  ┌──────────────────────────────────────────────────┐     │
│  │  HOME=/home/alice    ← reset                      │     │
│  │  PATH=...            ← reset                      │     │
│  │  USER=alice          ← reset                      │     │
│  │  pwd=/home/alice     ← reset                      │     │
│  │  The login scripts are sourced.                   │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  The hyphen is the difference.                             │
└────────────────────────────────────────────────────────────┘

su versus sudo

┌────────────────────────────────────────────────────────────┐
│  su versus sudo                                            │
│                                                            │
│  su                                                        │
│  ┌──────────────────────────────────────────────────┐     │
│  │  bob@host:~$                                      │     │
│  │    su -                                            │     │
│  │      → a new shell as root                         │     │
│  │      → stays root until exit                       │     │
│  │      → root's password required                    │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  sudo                                                      │
│  ┌──────────────────────────────────────────────────┐     │
│  │  bob@host:~$                                      │     │
│  │    sudo command                                    │     │
│  │      → the command runs as root                    │     │
│  │      → the shell returns immediately               │     │
│  │      → bob's password required                     │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  su is a session. sudo is a command.                       │
└────────────────────────────────────────────────────────────┘

The Common Scenarios

┌────────────────────────────────────────────────────────────┐
│  THE COMMON SCENARIOS                                      │
│                                                            │
│  BECOME ROOT                                               │
│  ┌──────────────────────────────────────────────────┐     │
│  │  su -                                             │     │
│  │  (root's password)                                │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  RUN A COMMAND                                             │
│  ┌──────────────────────────────────────────────────┐     │
│  │  su -c 'systemctl restart nginx' -                │     │
│  │  (root's password)                                │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  BECOME A SERVICE ACCOUNT                                  │
│  ┌──────────────────────────────────────────────────┐     │
│  │  su -s /bin/bash - postgres                       │     │
│  │  (no password, as root)                           │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  BECOME A USER                                             │
│  ┌──────────────────────────────────────────────────┐     │
│  │  su - alice                                       │     │
│  │  (alice's password)                               │     │
│  └──────────────────────────────────────────────────┘     │
└────────────────────────────────────────────────────────────┘

Summary

Item	Value
`su`	Switch user
`su -`	Switch with a login shell
`su -c`	Run a single command
`su -s`	Set the shell
`su -g`	Set the primary group
`su -G`	Set the supplementary groups
`su -p`	Preserve the environment
Password	The target user’s
Root exemption	No password prompt
Prompt	`$` for users, `#` for root

Key takeaways:

su starts a new shell as another user. The session replaces the current shell, and the user stays as the target until they exit. The sudo command runs a single command and returns.
The - flag starts a login shell. Without it, the current HOME, PATH, and other environment variables are kept, which produces the wrong environment for the target user. The su - form is almost always the right one.
su requires the target user’s password. The root user is exempt, which is why su from root to any user works without a prompt.
The -c flag runs a single command. The command is run as the target user, and the session exits when the command completes. The form is the closest su equivalent to sudo.
The -s flag sets the shell. The flag is required for a user whose login shell is /usr/sbin/nologin, because the default shell cannot be used.
The -g and -G flags set the groups. The -g sets the primary group, and the -G sets the supplementary groups. The options are rarely used.
sudo and su have different security models. su requires the target user’s password, which means the root password must be shared. sudo requires the invoking user’s password, and the permission is configured in /etc/sudoers.
sudo logs each command; su logs the session. The audit trail is more granular with sudo. The distinction matters for compliance.

Remember: The su command switches the current shell to another user. The - flag starts a login shell with the target user’s environment, the -c flag runs a single command, and the -s flag sets the shell. The password is the target user’s, and the root user is exempt. The command is the traditional way to become root, and it is the mechanism behind sudo -i and the service-account shells. The result is an identity switch that is simple, direct, and audited at the session level, and a system where an administrator can become any user without logging out and back in.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!