Differences between Linux Su and Su-

The su user retains the original exported environment variables, while the Su-user reinitializes the environment variables just as if they were logged in as user users.
For example:
# Su mishuang
# Cd
# Pwd
/Export/home/root
# Su-mishuang
# Cd
# Pwd
/Export/home/mishuang

Comments
: 1. Use the su command to temporarily switch user identities
1. Conditions and power of Su
The su command is a tool for switching users. How can this problem be solved? For example, if we log on as a normal user beinan, but want to add a user task and execute useradd, The beinan user does not have this permission, and this permission is exactly owned by the root user. There are two solutions. One is to quit the beinan user.

I. Use the su command to temporarily switch user identities

1. Conditions and power of Su

The su command is a tool for switching users. How can this problem be solved? For example, if we log on as a normal user beinan, but want to add a user task, execute useradd
The beinan user does not have this permission, and this permission is exactly owned by the root user. There are two solutions. One is to log out of the beinan user and log in again as the root user.
It is not the best. Second, we do not need to exit the beinan user. We can use Su to switch to the root user to add the user, and then exit the root user after the task is completed. We can see that, of course
Su switching is a good method;

Su allows users to switch between users. If the super-Permission User Root switches to a common or virtual user without a password, what is power? That's it! The password verification is required for normal users to switch to other users;

2. Su usage:

Su [Option option parameter] [user]

-,-L, -- log on to login and change to the switched user environment;

-C, -- commmand = command: execute a command and then exit the switched user environment;

For more details, see Man Su;

3. Examples of SU:

Su switches to the root user by default without adding any parameters, but does not go to the root user's home directory. That is to say, it is switched to the root user, however, the root logon environment is not changed. You can find the default logon environment in/etc/passwd, including the Home Directory and shell definition;

[Beinan @ localhost ~]? $ Supassword: [root @ localhost beinan] # PWD/home/beinan

Su adds the parameter-, indicating that the system switches to the root user by default and changes to the root user environment;

[Beinan @ localhost ~]? $ PWD/home/beinan [beinan @ localhost ~]? $ Su-Password: [root @ localhost ~] # PWD/root

Su parameter-User Name

[Beinan @ localhost ~]? $ Su-root note: this is the same as Su;

Password:

[Root @ localhost ~] # Pwd

/Root

[Beinan @ localhost ~]? $ Su-linuxsir Note: switching to linuxsir user

Password: enter the password here;

[Linuxsir @ localhost ~]? $ PWD Note: view the current user location;

/Home/linuxsir

[Linuxsir @ localhost ~]? $ Id Note: Check the UID and GID information of the user, mainly to see whether the switch is over;

Uid = 505 (linuxsir) gid = 502 (linuxsir) groups = 0 (Root), 500 (beinan), 502 (linuxsir)

[Linuxsir @ localhost ~]? $

[Beinan @ localhost ~]? $ Su--C ls Note: This is a combination of Su parameters, indicating that the system switches to the root user and changes to the root environment. Then, it lists the files in the root directory and exits the root user;

Password: Enter the root password here;

Anaconda-ks.cfg desktop install. Log install. log. syslog testgroup testgroupbeinan testgrouproot

[Beinan @ localhost ~]? $ PWD Note: view the current user's location;

/Home/beinan

[Beinan @ localhost ~]? $ Id Note: view the current user information;

Uid = 500 (beinan) gid = 500 (beinan) groups = 500 (beinan)

4. Advantages and Disadvantages of Su;

Su
It is indeed convenient for management. By switching to the root, all system management tools can be completed. As long as the root password is handed over to any common user, he can switch to the root to complete all the systems.
Management work; however, after Su is switched to root, there are also insecure factors. For example, there are 10 users in the system and they all participate in management. If these 10 users involve the use of super permissions
If you want other users to switch to the super-privileged root through Su, you must notify the 10 users of the root-authorized password. If all the 10 users have the root permission, you can use the root permission.
In order to do anything, this has caused a threat to system security to a certain extent; think about Windows, it is a nightmare; "there is no insecure system, there are only insecure people. "We absolutely cannot guarantee this.
10 users can manage the system according to the normal operation process. Any major mistake made by one of them on the system operation may lead to system crash or data loss. Therefore, Su
Tools are not the best choice in system management involving multiple people. Su is only applicable to systems where one or two people are involved in management. After all, Su cannot be used by common users; super User Root Password should be palm
In the hands of a few users, this is absolutely the truth! Therefore, the existence of centralized governance still makes sense;

II. The su authorized by sudo is also restricted.

1. Applicable Conditions for sudo

Due to Su's unrestricted permissions after switching to the super-Permission User Root, Su cannot act as a system managed by multiple administrators. If Su is used
To switch to the Super User to manage the system, it is not clear which jobs are operated by which administrator. Especially when many people are involved in server management, it is best to focus on the technical expertise and
It is necessary to use sudo to manage the scope and grant specific permissions to them, and specify the tools they are used to complete their work.

Through sudo, We can delegate certain super permissions to specific users without requiring common users to know the root password. Therefore, sudo is safer than Su with unrestricted permissions, therefore, sudo can also be referred to as restricted Su. In addition, sudo requires authorization, so it is also called the authorization permission Su;

The sudo command execution process is that the current user switches to the root (or another specified user), and then runs the command as root (or another specified user). After the command is executed, directly return to the current user. The premise is that the sudo configuration file/etc/sudoers must be used for authorization;

For example, if we want to use the beinan ordinary user to pass the content of the more/etc/shadow file, the following may occur;

[Beinan @ localhost ~]? $ More/etc/shadow: insufficient Permissions

In this case, we can use sudo more/etc/shadow to read the file content. We need to authorize beinan in/etc/soduers.

So we can first Su to the root user to change/etc/sudoers through mongodo; (for example, we use the beinan user to log on to the system)

[Beinan @ localhost ~]? $ Su

Password: Note: Enter the root password here.

Run visodu below;

[Root @ localhost beinan] # mongodo Note: Run mongodo to modify/etc/sudoers.

Add the following line to exit and save. Exit and save. Here, VI is used, and the VI editor is used for doing so. As for VI usage, I will not talk about it much; beinan all =/bin/more indicates that beinan can switch to root and execute more to view the file;

Return to the beinan user and run the exit command;

[Root @ localhost beinan] # exit

Exit

[Beinan @ localhost ~]? $

View what commands can beinan execute through sudo?

[Beinan @ localhost ~]? $ Sudo-l

Password: Note: enter the password of the beinan user here.

User beinan may run the following commands on this host:
Note: here we clearly describe that on this host, beinan users can run more with the root permission; more with the root permission can view the content of any text file;

(Root)/bin/more

Finally, let's see if the beinan user can see the content of the/etc/shadow file;

[Beinan @ localhost ~]? $ Sudo more/etc/shadow

Beinan can not only view the content of the/etc/shadow file, but also the content of other files that can only be viewed under root permissions, such;

[Beinan @ localhost ~]? $ Sudo more/etc/gshadow

For the beinan user to view and read all the system files, I just want to view the/etc/shadow content for him; you can add the following line;

Beinan all =/bin/more/etc/shadow

Digress: some brothers will say that I use Su
Switch to the root user to view all the content you want to see. Haha, right. But aren't we talking about sudo's usage now? If the host has multiple users and does not know the password of the root user,
However, if you want to view some files that they cannot see, the Administrator must authorize them. This is the benefit of sudo;

Example 5: The exercise user group is written in/etc/sudoers;

If the user group appears in/etc/sudoers, add the "%" sign before it. For example, % beinan cannot contain spaces. % beinan all =/usr/sbin/*,/sbin /*

If we add the above line in/etc/sudoers, it indicates all the members in the beinan user group, under all possible host names, all commands under the/usr/sbin and/sbin directories can be switched to the root user;

Example 6: cancel the execution of a program:

To cancel the execution of a program, you must add it before the command action! In this example, the wildcard * usage is also displayed;

Beinan all =/usr/sbin/*,/sbin /*,! /Usr/sbin/fdisk Note: add this rule to/etc/sudoers. However, you must have the beinan user group and beinan is in this group;

This rule indicates that the beinan user runs all programs under/usr/sbin and/sbin on all hosts with all possible host names, except for the fdisk program;

[Beinan @ localhost ~]? $ Sudo-l

Password: Note: enter the password of the beinan user;

User beinan may run the following commands on this host :( root)
/Usr/sbin/* (Root )! /Sbin/fdisk [beinan @ localhost ~]? $ Sudo
/Sbin/fdisk-lsorry, user beinan is not allowed to execute '/sbin/fdisk
-L 'as root on localhost.

Note: you cannot switch to the root user to run the fdisk program;

If you have sudo permission but do not have Su permission: sudo Su;