7 ms·

A simpler explanation is that many Linux distributions discourage the use of su altogether in favor of sudo, which gives you finer grained control over this sor

• sudonim 15y ago
  Ironically, "sudo su" works really well if you do need to get to root. But yeah, "sudo" is a much safer practice.
  • akent 15y ago
    "sudo -i", please!
    • spc476 15y ago
      sudo vi^Mpassword^M:shell Years ago a friend of mine asked my help in securing a Unix system with sudo. I bascially told him it was nearly impossible because there were (and still are) too many ways to escape back to a root shell with sudo, so, in my humble opinion, gives a false sense of security.
      • marshray 15y ago
        But as far as letting people run a root shell goes, sudo is a handy way to do it.
      • chousuke 15y ago
        I don't think the point is "more secure" root access. Rather, sudo is just a convenient way to invoke superuser privileges only when necessary. If you need a longer session with uid 0, use sudo -i. Having a separate root login is pretty much pointless. I doubt having separate passwords helps security either, since local privilege escalation vulnerabilities are common anyway. I've used sudo to restrict root access to specific command line invocations for certain users. With due care (ie. no access to software with shell escapes) it is secure. In any case, distributions seem to be moving towards eliminating the superuser altogether in common use cases. I think advocating sudo was just the beginning.
      • graywh 15y ago
        start by disallowing vi through sudo and tell people to use sudo -e instead
  • kwantam 15y ago
    I sudo su very frequently because I'm almost always executing more than one command as root. Standard warnings apply, but my approach for being sure that I am who I think I am is to put my username in my prompt and color code it so that when I'm root the username turns red. I also color code the hostname so that I can tell at a glance what machine I'm on. For example, export PS1='[\[\033[1;34m\]\u\[\033[0m\]@\[\033[1;30m\]\h\[\033[0m\] $newPWD]\$ ' where $newPWD is a friendly, shortened $PWD. On that same machine, the root prompt is identical except that the color is set to 1;31m instead of 1;34m, which makes it bright red.
    • silvestrov 15y ago
      No need for 'su' to get a root shell. You can use 'sudo -s' for that, and you still set a root-specific PS1 in the bashrc file.
      • thwarted 15y ago
        This doesn't always run the same rc scripts (depending on the shell and local convention). I'm used to typing sudo su - (with optional username) to get the environment as close as possible to what it would be if I logged in as the target user.
        • deleted 15y ago
          [deleted]
        • silvestrov 15y ago
          alias ssu='sudo /bin/bash -login'
        • pilif 15y ago
          sudo -s launches a shell in non interactive mode (which goes through .bashrc or .zshenv and .zshrc depending on your shell) whereas sudo -i emulates a usrer login which puts the shell in interactive mode (.profile, .zshenv) Also -i does more stuff to simulate a login like setting $HOME and cd'ing there. Usually you might want to use sudo -i or 'su -' which both simulate a login. But sudo su - really isn't needed any more since -i has been added
  • nkassis 15y ago
    If you have a saddist sysadmin he wouldn't allow you to use su or any other dangerous command that are not approved. Sudo is a rather impressive tool. If you need to give someone access to root for one or two commands, it can do that. It's logging ability is lost when you do sudo su. You should avoid it as much as possible on servers with many admins. That log trail can be a real butt saver.
  • jacques_chester 15y ago
    sudo $YOUR_SHELL_NAME_HERE achieves the same purpose.
  • pdmccormick 15y ago
    `sudo -s` works nicely too.
  • deleted 15y ago
    [deleted]
  • tincholio 15y ago
    Or you can just use "sudo -i"
• sambeau 15y ago
  While this may be true today you cannot use it to explain the history of this decision. My recollection is that when OSX came on the scene without a root password and administration through sudo, Linux distributions were still tied to root and su and many Linux users were both disapproving and condescending about it.
  • cookiecaper 15y ago
    Many still feel this way. Don't let the pre-eminence of Ubuntu fool you -- most Linux distros, afaik anyway, still include root as a first-class citizen with its own password and everything.
    • sambeau 15y ago
      I do think that the disapproving and condescending attitude to sudo has changed though.
  • deleted 15y ago
    [deleted]
• ciupicri 15y ago
  Many Linux distributions being Ubuntu & friends? Fedora or RHEL don't promote sudo like Ubuntu does.
• jeza 15y ago
  If someone wants to work in a root shell, I think it's fine provided they understand the damage they can potentially do. It could certainly be possible to habitually prepend commands with sudo, particularly if you need to type many of them. Though certainly it's safer to do some tasks as non-root as well, such as compiling software, then switch to root/sudo to install it. Just remember to double/triple check each command you type in a root shell or after the sudo command. Particularly when using commands such as rm with arguments such as -rf! Sudo also does provide some extra flexibility when you are delegating tasks to someone who doesn't necessarily need full root access.