su Command: su vs su -, sudo su vs sudo -i, and How to Switch Accounts

To run commands as another account in Linux without logging out of the current one, use the su command. Running su from the root account of an AlmaLinux 9 server into daemon, a system account that cannot log in, showed that a single hyphen changed the working folder and PATH, and that a shell had to be specified before the command would run.

The output below comes from an AlmaLinux 9.8 server (root account) and a Debian 12 server (regular account). The password prompts and sudo were not run on a production server and are summarized from the official manuals, and part of the PATH value and the util-linux patch version number in the simulator were replaced with example values.

1️⃣ How to use the su command

The basic form is [su username], and if you leave out the username, su switches to root. Typing exit in the new shell ends that shell and returns you to the shell of the original account that ran su.

When you run it from a regular account, you type the target account's password at the Password: line (based on the default PAM settings). On this server, /etc/pam.d/su skips authentication when the person running it is root, so no password was asked when switching from the root account to daemon.

su --help

Usage:
 su [options] [-] [<user> [<argument>...]]

Change the effective user ID and group ID to that of <user>.
A mere - implies -l.  If <user> is not given, root is assumed.

Options:
 -m, -p, --preserve-environment      do not reset environment variables
 -w, --whitelist-environment <list>  don't reset specified variables

 -g, --group <group>             specify the primary group
 -G, --supp-group <group>        specify a supplemental group

 -, -l, --login                  make the shell a login shell
 -c, --command <command>         pass a single command to the shell with -c
 --session-command <command>     pass a single command to the shell with -c
                                   and do not create a new session
 -f, --fast                      pass -f to the shell (for csh or tcsh)
 -s, --shell <shell>             run <shell> if /etc/shells allows it
 -P, --pty                       create a new pseudo-terminal

 -h, --help                      display this help
 -V, --version                   display version

For more details see su(1).

As the help text says, the hyphen [-] is the login option, the same as [-l], and arguments written after the username are passed to the target account's shell. On the AlmaLinux 9 server su came from the util-linux 2.37 package, and on the Debian 12 server from the 2.38 package.

su --version

su from util-linux 2.38.1

Whether the account you want to switch to can open a shell shows in the last field of its line from getent passwd.

getent passwd daemon

daemon:x:2:2:daemon:/sbin:/sbin/nologin

The shell of daemon was /sbin/nologin. For an account that has nologin instead of a login shell, su does not open a shell even after switching.

2️⃣ su vs su -

With a hyphen (-), su opens the same shell you would get by logging in as the target account. In the /tmp folder, the same command was run once without the hyphen and once with it.

su -s /bin/sh -c pwd daemon

/tmp

su - -s /bin/sh -c pwd daemon

/usr/sbin

Without the hyphen the working folder stayed at /tmp, while [su -] moved to daemon's home folder /sbin. On this server /sbin is a link to /usr/sbin, so pwd printed /usr/sbin.

For environment variables, only five lines of the env output were compared: HOME, USER, SHELL, PATH, and LOGNAME.

su -s /bin/sh -c env daemon | grep -E '^(HOME|USER|SHELL|PATH|LOGNAME)='

SHELL=/bin/sh
LOGNAME=daemon
HOME=/sbin
USER=daemon
PATH=/root/.local/bin:/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin

su - -s /bin/sh -c env daemon | grep -E '^(HOME|USER|SHELL|PATH|LOGNAME)='

SHELL=/bin/sh
LOGNAME=daemon
HOME=/sbin
USER=daemon
PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin

HOME, USER, and LOGNAME changed to daemon's values in both cases. Without the hyphen, PATH kept the value of root, which ran su, and with [su -] it was set anew by the login settings.

According to the official manual, su without a hyphen changes only HOME and SHELL, and also changes USER and LOGNAME only when the target account is not root. So if you switch to root from a regular account without a hyphen, USER keeps the original account name.

[$0], which prints the shell name, was also different.

su -s /bin/sh -c 'echo $0' daemon

sh

su - -s /bin/sh -c 'echo $0' daemon

-sh

With [su -], a hyphen was added in front of the shell name and -sh was printed. A shell whose name starts with a hyphen acts as a login shell and reads the login configuration files (according to the official manual). The differences between the two forms are as follows.

The official manual recommends always adding the login option so that environments do not mix, and writing [--login] instead of the hyphen. su without a hyphen keeps the current folder and PATH, so when you want to check a command with another account's settings, the result can differ from [su -].

3️⃣ su -c and su -s options

To run just one command as another account without opening a shell, write the command after -c. Running id on the nologin account with [su -c] printed a refusal message instead of the command's output.

su -c id daemon

This account is currently not available.

A command passed with -c is also run by the account's shell, so if the shell is nologin, the command is never reached. In that case, use -s to specify the shell to run.

su -s /bin/sh -c id daemon

uid=2(daemon) gid=2(daemon) groups=2(daemon)

With /bin/sh specified, id ran as daemon's UID 2. Use this form to check file permissions or command results as a service account.

If the target account's shell is a restricted shell not listed in /etc/shells, such as nologin, only root can change the shell with -s. According to the official manual, -s and the SHELL variable given by a non-root user are ignored in that case.

If the command after -c contains spaces, wrap it in quotes so it is passed as one piece. su returns the exit code of the command it ran, 126 if the command could not be run, and 127 if it was not found (according to the official manual).

📌 Main options: results from this article

📎 Other options: per the official manual

🔲 su command simulator

The simulator below starts as the regular account user1, and you can try su, [su -], and sudo yourself and come back with exit. Accounts and passwords are example values.

4️⃣ sudo su vs sudo -i

sudo su runs su with root privileges through sudo. Because root runs su, the root password is not asked, and sudo asks for the password of the person running it first (according to the official documentation).

Which accounts can run sudo is defined by the /etc/sudoers settings. If an account that is not allowed runs sudo, it is refused with [user1 is not in the sudoers file.] (based on the message in the program).

The password asked and the working folder for each command that opens a root shell are as follows. The commands in this section were not run on a production server and are summarized from the su(1) and sudo(8) manuals.

[sudo -i] and [sudo su -] both end in a root login shell. [sudo -i] has sudo start root's shell directly as a login shell, while [sudo su -] goes through su once more in between.

[sudo -s] runs the shell in the SHELL variable with root privileges and does not move to the home folder. Once you enter the password correctly, sudo does not ask again in the same terminal for 5 minutes by default (according to the sudoers manual).

The difference between su and sudo is like the difference between borrowing someone's house key and writing your name at the management office to get in.

5️⃣ su command errors

If you switch to an account that cannot log in, nologin runs instead of a shell and [This account is currently not available.] appears. Running [su daemon] as root printed only this one line, and the exit code was 1.

su daemon

This account is currently not available.

This message is printed by the nologin program set in the last field of the account line, and the same text was found inside /usr/sbin/nologin on the server. As root, you can specify a shell with -s and run commands as that account.

If the password is wrong, [su: Authentication failure] appears. This text is the message the PAM library returns for an authentication failure. According to the official manual, if su fails before running the command, the exit code is 1.

If su refuses even though you typed your own account password correctly, first check whether the prompt is asking for the target account's password. sudo asks for the password of the person running it, while su asks for the password of the account you are switching to.

If you type an account name that does not exist, [su: user user9 does not exist or the user entry does not contain all the required fields] appears (based on the message in the program). The cause and what to check for each error are as follows.

🔢 FAQ & Recommended Content

🔗 Recommended Reading

Creating accounts Linux: useradd Command & passwd Command Commands that create, with useradd, the user account you switch into with su and set that account's password with passwd. Read post →

Permissions · ownership Linux permissions (4,2,1) and ownership | chmod, chown, umask commands An article on how to check and change the read, write, and execute permissions and owners of files and directories. Users and access Linux who, w Commands & user Command Commands that show which users are logged in to the server now and what they are running. Network and access SSH command: options and how to use it An article on the basic form and options of the ssh command, which connects to a remote server with a user account.

ℹ️ Affiliate Disclosure
This site's content contains affiliate links. When a visitor buys a product or service through one of them, the site receives a commission from the seller. The amount the buyer pays^{(it goes down during event discounts ↓)}does not go up. Posted prices, discounts, and stock reflect the time of writing and may differ, so confirm with the seller before buying. Products are chosen and reviewed by our own standards, and commissions do not affect the order or content of reviews.