> For the complete documentation index, see [llms.txt](https://moharat.gitbook.io/cylabs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://moharat.gitbook.io/cylabs/101-series/operating-systems/linux-101/su-and-sudo.md).

# su and sudo

In Unix-like operating systems, `su` (substitute user or switch user) and `sudo` (superuser do) are two different commands that allow users to run tasks with the security privileges of another user, by default the superuser (root).

**`su`:**

* The `su` command is used to switch the current user to another user account. When executed it prompts for the password of the target user.
* By default, without any arguments, `su` switches to the root user.
* It does not inherit the environment of the target user which can lead to path issues or other environment-specific problems.

**`sudo`:**

* The `sudo` command allows a permitted user to execute a command as the superuser or another user, as specified by the security policy.
* `sudo` is generally considered safer than `su` because it grants limited administrative rights rather than full root access.
* `sudo` can also be set up to require a password (the user's password, not the root password), but it can also be configured to not require a password.

**User Access Control (UAC) security:**

* UAC is a security component in many Unix-like operating systems. UAC allows users to perform common tasks as non-privileged users and as administrators without having to switch users, log off, or use `su`.
* UAC is designed to prevent unauthorized changes to the operating system.

**`Sudo` user group:**

* In many systems, users who are allowed to use the `sudo` command are members of the `sudo` group.
* Being part of this group is often synonymous with having administrative privileges.

**`sudo -l`:**

* This command lists the allowed (and forbidden) commands for the invoking user on the current host. It's a way to check which commands you can run with `sudo`.

**`sudo -s`:**

* This option runs a shell specified by the `SHELL` environment variable or the shell as specified in the passwd file. It allows a user to start a new shell with root privileges.

**`sudo -I` (capital i):**

* This initiates a login shell. This means the environment will be similar to that of the target user, with some exceptions like `PATH` which is specified in the `sudoers` file.

**`sudoers` permissions:**

* The `sudoers` file is where permissions are defined for users and groups. It specifies who can run what commands as which users on which machines and with what privileges.

**`visudo`:**

* This is the command used to edit the `sudoers` file. It locks the file against multiple simultaneous edits and provides basic sanity checks and validation for syntactic correctness.

It is recommended to always use `visudo` to edit the `sudoers` file to prevent syntax errors that could potentially lock out all sudo users, which can be very problematic especially on systems where root access is not available by default.