Linux CLI 19 🐧 su and sudo commands - KandZ

Two commands for running things as another user — usually as root. They look similar but serve different purposes and have different security models.

Overview

Command	Full Name	Purpose
`su`	Substitute User	Switch to another user (usually root)
`sudo`	SuperUser DO	Run a single command with elevated privileges

Key difference:

su — needs the target user’s password (e.g., root’s password)
sudo — needs your own password (and you must be authorized in sudoers)

The `su` Command

Switches to another user — usually root.

ls /root
su -
su -l
exit
su -c 'ls /root'

Command	Description
`su`	Switch to root (but keeps current environment)
`su -`	Switch to root with a login shell (full environment)
`su -l`	Same as `su -`
`su -l username`	Switch to a specific user
`exit`	Return to your original user
`su -c 'command'`	Run one command as root

`su` vs `su -` — Why the Dash Matters

Without `-`	With `-`
Keeps your current environment	Loads target user’s environment
Stays in your current directory	Changes to target user’s home
Uses your `PATH`, `$HOME`, etc.	Uses target’s `PATH`, `$HOME`, etc.

Visual:

su :     Your env ────→ Root shell (same env)
su -  :  Login shell ──→ Root shell (root's env)

su -:
  HOME=/root
  PWD=/root
  PATH=/usr/sbin:/usr/bin:/sbin:/bin
  USER=root

su (without -):
  HOME=/home/kronos        ← still yours!
  PWD=/home/kronos         ← still yours!
  USER=kronos              ← env not updated!

Best practice: Use su - — not plain su. It gives you a proper login shell with the correct environment.

Examples

Check what’s in /root:

$ ls /root
ls: cannot open directory '/root': Permission denied

Switch to root:

$ su -
Password: ************
root@olympos:~#
# Prompt changes from $ to #

Run one command as root:

$ su -c 'ls /root'
Password:
# (shows contents of /root)
# Returns to your normal user afterward

Switch to another user:

$ su -l alice
Password:
alice@olympos:~$

Exit back:

root@olympos:~# exit
$

How to Spot You’re Root

Prompt	User
`$`	Regular user
`#`	Root

kronos@olympos:~$          ← regular user
root@olympos:~#            ← root

The `sudo` Command

SuperUser DO — run a single command with root privileges.

sudo ls /bin
sudo -l
sudo nano /etc/sudoers

Command	Description
`sudo command`	Run `command` as root
`sudo -l`	List what privileges you have
`sudo -i`	Open an interactive root shell
`sudo -s`	Open a root shell (keeps env)
`sudo -u user command`	Run command as another user
`sudo !!`	Rerun last command with sudo
`sudo -k`	Forget cached password

Why `sudo` Is Preferred

Feature	`su`	`sudo`
Password needed	Target’s (root’s)	Your own
Audit trail	❌ No	✅ Logged
Granular permissions	❌ All or nothing	✅ Per-command rules
Time-limited	Until `exit`	5–15 min timeout
Session scope	Whole session	Single command
Recommended	⚠️ Legacy	✅ Modern practice

Examples

Run a command as root:

$ sudo ls /bin
[sudo] password for kronos:
# (lists /bin contents)

Check your privileges:

$ sudo -l
User kronos may run the following commands on olympos:
    (ALL : ALL) ALL

Open a root shell:

$ sudo -i
root@olympos:~#
# Same as "su -" but using your own password

Rerun last command with sudo:

$ apt update
Permission denied
$ sudo !!
sudo apt update
# ✅

Run as another user:

$ sudo -u alice whoami
alice

The `sudoers` File

Controls who can use sudo and what they can do.

sudo nano /etc/sudoers

⚠️ Always edit with visudo — not a plain editor!

sudo visudo

Why? visudo checks syntax before saving. A broken sudoers file can lock you out of root access entirely.

Template to Add a User

username ALL=(ALL:ALL) ALL

Part	Meaning
`username`	The user to authorize
`ALL`	From any host
`(ALL:ALL)`	As any user, as any group
`ALL`	Run any command

Example:

kronos ALL=(ALL:ALL) ALL

More Restrictive Examples

Allow only specific commands:

kronos ALL=(ALL) /usr/bin/apt, /usr/bin/systemctl

No password required:

kronos ALL=(ALL) NOPASSWD: ALL

Group-based:

%sudo ALL=(ALL:ALL) ALL
# Any user in the "sudo" group can run everything

Applying Changes

On most modern systems, sudoers changes are immediate. But if you need to reload:

sudo systemctl daemon-reload

For older systems:

sudo visudo -c     # Check syntax
sudo systemctl restart sudo

Complete Example Session

# ============================================
# PART 1: SU COMMAND
# ============================================

# Try to access /root as regular user
$ ls /root
ls: cannot open directory '/root': Permission denied

# Switch to root with su
$ su -
Password: ************
root@olympos:~# ls /root
# (shows contents)

# Exit back to user
root@olympos:~# exit
logout
$

# Switch to root with su -l (same as su -)
$ su -l
Password:
root@olympos:~#

# Execute one command as root
$ su -c 'ls /root'
Password:
# (shows /root contents, then returns)

# Switch to a specific user
$ su -l alice
Password:
alice@olympos:~$

# ============================================
# PART 2: SUDO COMMAND
# ============================================

# Run a command with sudo
$ sudo ls /bin
[sudo] password for kronos:
# (lists /bin)

# Check privileges
$ sudo -l
User kronos may run the following commands on olympos:
    (ALL : ALL) ALL

# Open root shell
$ sudo -i
root@olympos:~#

# Run as another user
$ sudo -u alice whoami
alice

# Rerun last command with sudo
$ apt update
Permission denied
$ sudo !!
sudo apt update
# ✅

# ============================================
# PART 3: SUDOERS FILE
# ============================================

# Edit safely with visudo
$ sudo visudo

# Add a new user
# At the end of the file:
kronos ALL=(ALL:ALL) ALL

# Save: Ctrl+X, then Y, then Enter

# Apply changes (usually automatic)
$ sudo systemctl daemon-reload

# Verify new user can sudo
$ sudo -l -U alice

# ============================================
# PART 4: PRACTICAL EXAMPLES
# ============================================

# Install software
$ sudo apt install nginx

# Edit a system file
$ sudo nano /etc/hosts

# Restart a service
$ sudo systemctl restart nginx

# View system logs
$ sudo tail -f /var/log/syslog

# Manage users
$ sudo useradd alice
$ sudo passwd alice

# Change file ownership
$ sudo chown root:root /etc/important.conf

# ============================================
# PART 5: SUDO VS SU — WHICH TO USE?
# ============================================

# ✅ PREFER: sudo for single commands
$ sudo apt update

# ⚠️ USE SPARINGLY: sudo -i for a root shell
$ sudo -i
# ... work as root ...
# exit

# ❌ AVOID: su - as root (uses root's password)
$ su -
# Only when sudo isn't available

Quick Reference

`su` Options

Option	Description
`su`	Switch to root (keeps env)
`su -`	Switch to root with login shell
`su -l`	Same as `su -`
`su -l user`	Switch to specific user
`su -c 'cmd'`	Run one command
`exit`	Return to previous user

`sudo` Options

Option	Description
`sudo cmd`	Run command as root
`sudo -l`	List privileges
`sudo -i`	Interactive root shell
`sudo -s`	Root shell (keeps env)
`sudo -u user cmd`	Run as another user
`sudo -k`	Forget cached password
`sudo !!`	Rerun last with sudo

`sudoers` Syntax

Part	Meaning
`username`	User or `%group`
`ALL`	Any host
`(ALL:ALL)`	Any user, any group
`ALL`	Any command
`NOPASSWD:`	No password required

Best Practices

✅ Do This:

# Use sudo for one-off commands
sudo apt update

# Use sudo -i for multiple root commands
sudo -i
# ... do work ...
exit

# Use sudo !! after "permission denied"
apt update
sudo !!

# Edit sudoers with visudo
sudo visudo

# Check your privileges first
sudo -l

# Use specific commands in sudoers (least privilege)
kronos ALL=(ALL) /usr/bin/apt, /usr/bin/systemctl

❌ Don’t Do This:

# Don't edit sudoers with a regular editor
sudo nano /etc/sudoers      # ⚠️ Might break it
sudo visudo                 # ✅ Safe

# Don't give NOPASSWD: ALL without thinking
kronos ALL=(ALL) NOPASSWD: ALL   # ⚠️ Security risk

# Don't use "su -" for every task
su -
# Use "sudo" instead — better audit trail

# Don't stay logged in as root forever
sudo -i
# ... hours later ...
# Better: log out when done

# Don't share your sudo password
# Never share passwords or credentials!

# Don't use sudo for everything
sudo ls           # ⚠️ Unnecessary
ls                # ✅ Use sudo only when needed

Common Pitfalls

Pitfall	Problem	Solution
Forgot sudo password	Can’t run admin commands	Ask admin for access
Broken sudoers file	Locked out of sudo	Boot recovery mode, fix with `pkexec`
`su -` without `-`	Wrong environment	Always use `su -`
Not in sudo group	“Not in sudoers file”	Admin adds you to sudo
Password timeout	Prompts again	Normal after 5–15 min
`sudo` on every command	Bad habit	Only elevate when needed

Real-World Examples

1. System Update

$ sudo apt update
$ sudo apt upgrade

2. Edit System Config

$ sudo nano /etc/nginx/nginx.conf
$ sudo systemctl restart nginx

3. Install Software

$ sudo apt install docker.io
$ sudo systemctl enable docker

4. Manage Users

$ sudo useradd -m alice
$ sudo passwd alice
$ sudo usermod -aG sudo alice

5. Add a User to sudo Group

$ sudo usermod -aG sudo alice
# Verify
$ groups alice
alice : alice sudo users

6. Run GUI App as Root

$ sudo -H gparted
# -H sets HOME to /root (safer for GUI apps)

7. Check Who Has sudo Access

$ sudo -l -U alice
User alice may run the following commands:
    (ALL : ALL) ALL

$ getent group sudo
sudo:x:27:kronos,alice,bob

8. Emergency — Fix Broken sudoers

# If you broke sudoers, boot into recovery mode
# Then:
$ mount -o remount,rw /
$ visudo
# Fix the problem, save, reboot

Visual: su vs sudo

SU:
  User ──[su -]──→ Root shell
         password: root's
         
         ┌──────────────────────────┐
         │  Full root shell          │
         │  (until "exit")           │
         │  No per-command logging   │
         └──────────────────────────┘

SUDO:
  User ──[sudo cmd]──→ Command runs as root
         password: your own
         
         ┌──────────────────────────┐
         │  Single command as root   │
         │  Logged in /var/log/auth  │
         │  5-15 min password cache  │
         └──────────────────────────┘

Summary

Command	Purpose	Password
`su -`	Switch to root	Root’s
`su - user`	Switch to another user	User’s
`su -c 'cmd'`	Run one command as root	Root’s
`sudo cmd`	Run one command as root	Your own
`sudo -i`	Interactive root shell	Your own
`sudo -l`	List privileges	Your own
`sudo visudo`	Edit sudoers safely	Your own

Key takeaways:

su switches user — needs target’s password
sudo runs one command as another user — needs your own password
su - (with dash) gives a proper login shell
sudo is preferred — better audit trail, granular control, time-limited
sudoers file controls who can use sudo — always edit with visudo
Template for new sudoer: username ALL=(ALL:ALL) ALL
Use sudo !! after “permission denied” — instant fix
Never use NOPASSWD: ALL without a very good reason
sudo doesn’t need root’s password — use it instead of su in modern workflows

Remember: su is the classic Unix way — all-or-nothing, session-wide, requiring the root password. sudo is the modern, safer alternative — per-command, audited, and using your own password. Use sudo for nearly everything, and use sudo -i (not su -) when you truly need a root shell. And when you accidentally forget sudo — just type sudo !! and get on with your day!

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!

Overview

The su Command

su vs su - — Why the Dash Matters

Examples

How to Spot You’re Root

The sudo Command

Why sudo Is Preferred

Examples

The sudoers File

Template to Add a User

More Restrictive Examples

Applying Changes

Complete Example Session

Quick Reference

su Options

sudo Options

sudoers Syntax

Best Practices

Common Pitfalls

Real-World Examples

1. System Update

2. Edit System Config

3. Install Software

4. Manage Users

5. Add a User to sudo Group

6. Run GUI App as Root

7. Check Who Has sudo Access

8. Emergency — Fix Broken sudoers

Visual: su vs sudo

Summary

Ads Blocker Detected!!!

The `su` Command

`su` vs `su -` — Why the Dash Matters

The `sudo` Command

Why `sudo` Is Preferred

The `sudoers` File

`su` Options

`sudo` Options

`sudoers` Syntax