Su - Revision history

209.242.26.125: removed redundant info

2005-06-06T20:51:08Z

removed redundant info

Jimbo at 06:43, 5 January 2005

2005-01-05T06:43:29Z

Simon: security tip

2005-01-04T17:00:48Z

security tip

Dave: /* Common Flags */

2004-10-07T19:28:26Z

Common Flags

Dave at 19:27, 7 October 2004

2004-10-07T19:27:31Z

Dave at 05:35, 25 August 2004

2004-08-25T05:35:40Z

Jimbo at 02:34, 25 August 2004

2004-08-25T02:34:20Z

New page

[[su]] is acronymic for [[super-user]], and is the system command used under FreeBSD and other unix-like operating systems to change your [[user context]] without having to log out and log back in as a different user.

If you just type in [[su]] at the shell prompt and do not supply an argument, [[su]] assumes that you are asking to change context to [[root]]. Attempting to assume [[root]] context is something of a special case under FreeBSD - unlike many other unix-like operating systems, just having the root password is not enough! FreeBSD's default behavior is to only allow users who are members of the special group [[wheel]] the privilege of [[su]]-ing to [[root]]. If you ''are'' a member of [[wheel]], you will be presented with a password challenge; if not, you will simply be told "sorry."

However, [[su]] is useful for more than just assuming [[root]] context. You can assume ''any'' user context with the [[su]] application, making it an excellent troubleshooting tool to instantly check on any permissions or other security-related issues as well as issues related to the user-specific shell environment. Simply supply [[su]] the name of the user whose context you want to assume as an argument; if you are already [[root]] it will quietly do so without asking for a password. If you are ''not'' root and you ask to [[su]] to a non-[[root]] user, it will allow you attempt to, but will require you to supply that user's password before actually changing context.

One thing to remember about using [[su]] to change [[user context]] is that it actually opens a new [[shell]] without ever closing your old one - so when you're tired of being whoseever identity you have taken with [[su]], simply [[exit]] to get back to your old shell.

It is somewhat sloppy, but convenient on reasonably resourceful machines, to occasionally just [[su]] to your own user context rather than logging off and back on again in order to make a user environment change immediately active; for instance after altering or placing new files in your [[directory path]].

[[Category:System Commands]]

← Older revision		Revision as of 20:51, 6 June 2005
Line 1:		Line 1:
−	[[su]] is acronymic for '''switch user''' ~~-- if no username is supplied to /sbin/su the [[super-user]] account is assumed~~, and is the system command used under FreeBSD and other unix-like operating systems to change your [[user context]] without having to log out and log back in as a different user.	+	[[su]] is acronymic for '''switch user''', and is the system command used under FreeBSD and other unix-like operating systems to change your [[user context]] without having to log out and log back in as a different user.

	If you just type in [[su]] at the shell prompt and do not supply an argument, [[su]] assumes that you are asking to change context to [[root]]. Attempting to assume [[root]] context is something of a special case under FreeBSD - unlike many other unix-like operating systems, just having the root password is not enough! FreeBSD's default behavior is to only allow users who are members of the special group [[wheel]] the privilege of [[su]]-ing to [[root]]. If you ''are'' a member of [[wheel]], you will be presented with a password challenge; if not, you will simply be told "sorry."		If you just type in [[su]] at the shell prompt and do not supply an argument, [[su]] assumes that you are asking to change context to [[root]]. Attempting to assume [[root]] context is something of a special case under FreeBSD - unlike many other unix-like operating systems, just having the root password is not enough! FreeBSD's default behavior is to only allow users who are members of the special group [[wheel]] the privilege of [[su]]-ing to [[root]]. If you ''are'' a member of [[wheel]], you will be presented with a password challenge; if not, you will simply be told "sorry."

@@ Line 7: / Line 7: @@
 One thing to remember about using [[su]] to change [[user context]] is that it actually opens a [[shell]] without ever closing your old one - so when you're tired of being whoseever identity you have taken with [[su]], simply [[exit]] to get back to your old shell. If the "-" switch is passed to [[su]] then a new shell is opened, using any [[shell]] configuration file ([[.profile]], [[.cshrc]], etc) in the root account's home directory. If no "-" switch is passed to [[su]], it will use the shell configuration file of the user you [[su]]'d from (assuming sanity: if the originating user is using .bashrc and the root user is using .tcshrc, the .bashrc file won't be used.)
-It is somewhat sloppy, but convenient on reasonably resourceful machines, to occasionally just [[su]] to your own user context rather than logging off and back on again in order to make a user environment change immediately active; for instance after altering or placing new files in your [[PATH|directory path]].
+Many new sysadmins occasionally just [[su]] to their own user context in order to make a user environment change immediately active; for instance after altering or placing new files in your [[PATH|directory path]].  This is intuitive, and works (although it's sloppy since it eats up system resources for a new shell without freeing the resources for the old one), but it's unnecessary if you know about the [[rehash]] command.
 User accounts who have su disabled are less vulnerable to certain [[rootkit]]s, but it can also be inconvenient. This is why some users have a personal account (no su allowed, a bit safer if you frequent seedy web sites) separate from their work account where getting the job done quickly (su allowed) and not taking risks has priority.

← Older revision		Revision as of 17:00, 4 January 2005
Line 8:		Line 8:

	It is somewhat sloppy, but convenient on reasonably resourceful machines, to occasionally just [[su]] to your own user context rather than logging off and back on again in order to make a user environment change immediately active; for instance after altering or placing new files in your [[PATH\|directory path]].		It is somewhat sloppy, but convenient on reasonably resourceful machines, to occasionally just [[su]] to your own user context rather than logging off and back on again in order to make a user environment change immediately active; for instance after altering or placing new files in your [[PATH\|directory path]].
		+
		+	User accounts who have su disabled are less vulnerable to certain [[rootkit]]s, but it can also be inconvenient. This is why some users have a personal account (no su allowed, a bit safer if you frequent seedy web sites) separate from their work account where getting the job done quickly (su allowed) and not taking risks has priority.

	==Common Flags==		==Common Flags==

@@ Line 10: / Line 10: @@
 ==Common Flags==
-  - or -l will give you a new login shell. On most systems, this is assumed, but using the flag will ensure that you don't get made root with a shell you're not expecting.
+  - see -l below
-  -m "leave me alone, just make me root". You'll stay in your current directory, have your current [[PATH]] and shell stay the same.
+ -l will give you a new login shell. On most systems, this is assumed,
-  -c change the class of a command. This is complex and will not be used by novices, but if you need to run commands limited by user group class or limited to the abilities of a particular user, it can be useful. Consult the manpage for more details.
+    but using the flag will ensure that you don't get made root with a
 [[Category:System Commands]]

@@ Line 7: / Line 7: @@
 One thing to remember about using [[su]] to change [[user context]] is that it actually opens a [[shell]] without ever closing your old one - so when you're tired of being whoseever identity you have taken with [[su]], simply [[exit]] to get back to your old shell. If the "-" switch is passed to [[su]] then a new shell is opened, using any [[shell]] configuration file ([[.profile]], [[.cshrc]], etc) in the root account's home directory. If no "-" switch is passed to [[su]], it will use the shell configuration file of the user you [[su]]'d from (assuming sanity: if the originating user is using .bashrc and the root user is using .tcshrc, the .bashrc file won't be used.)
-It is somewhat sloppy, but convenient on reasonably resourceful machines, to occasionally just [[su]] to your own user context rather than logging off and back on again in order to make a user environment change immediately active; for instance after altering or placing new files in your [[directory path]].
+It is somewhat sloppy, but convenient on reasonably resourceful machines, to occasionally just [[su]] to your own user context rather than logging off and back on again in order to make a user environment change immediately active; for instance after altering or placing new files in your [[PATH|directory path]].
 [[Category:System Commands]]

@@ Line 1: / Line 1: @@
-[[su]] is acronymic for [[super-user]], and is the system command used under FreeBSD and other unix-like operating systems to change your [[user context]] without having to log out and log back in as a different user.
+[[su]] is acronymic for '''switch user''' -- if no username is supplied to /sbin/su the [[super-user]] account is assumed, and is the system command used under FreeBSD and other unix-like operating systems to change your [[user context]] without having to log out and log back in as a different user.
 If you just type in [[su]] at the shell prompt and do not supply an argument, [[su]] assumes that you are asking to change context to [[root]].  Attempting to assume [[root]] context is something of a special case under FreeBSD - unlike many other unix-like operating systems, just having the root password is not enough!  FreeBSD's default behavior is to only allow users who are members of the special group [[wheel]] the privilege of [[su]]-ing to [[root]].  If you ''are'' a member of [[wheel]], you will be presented with a password challenge; if not, you will simply be told "sorry."
@@ Line 5: / Line 5: @@
 However, [[su]] is useful for more than just assuming [[root]] context.  You can assume ''any'' user context with the [[su]] application, making it an excellent troubleshooting tool to instantly check on any permissions or other security-related issues as well as issues related to the user-specific shell environment.  Simply supply [[su]] the name of the user whose context you want to assume as an argument; if you are already [[root]] it will quietly do so without asking for a password.  If you are ''not'' root and you ask to [[su]] to a non-[[root]] user, it will allow you attempt to, but will require you to supply that user's password before actually changing context.
-One thing to remember about using [[su]] to change [[user context]] is that it actually opens a new [[shell]] without ever closing your old one - so when you're tired of being whoseever identity you have taken with [[su]], simply [[exit]] to get back to your old shell.
+One thing to remember about using [[su]] to change [[user context]] is that it actually opens a [[shell]] without ever closing your old one - so when you're tired of being whoseever identity you have taken with [[su]], simply [[exit]] to get back to your old shell. If the "-" switch is passed to [[su]] then a new shell is opened, using any [[shell]] configuration file ([[.profile]], [[.cshrc]], etc) in the root account's home directory. If no "-" switch is passed to [[su]], it will use the shell configuration file of the user you [[su]]'d from (assuming sanity: if the originating user is using .bashrc and the root user is using .tcshrc, the .bashrc file won't be used.)
 It is somewhat sloppy, but convenient on reasonably resourceful machines, to occasionally just [[su]] to your own user context rather than logging off and back on again in order to make a user environment change immediately active; for instance after altering or placing new files in your [[directory path]].
 [[Category:System Commands]]