sudo vs. su

One of the things that makes Linux more secure than some operating systems is a permission system and separate logins. This adds the complication that some administrative tasks must be done using the administrator login (called root) but that is a small price to pay for the added level of security.

Different Linux distributions offer different ways to become root to perform these administrative tasks. The differences are not complicated to understand and there are valid reasons for each approach. In this article TUX explains these differences and how to get the job done using the various approaches.

If your system presents you with a graphical login screen (SuSE and Debian are two examples) then you would expect that logging in as root instead of your personal login would be the approach. While it can be done, it is the most dangerous approach from a security point of view.

Once you have logged in you will be running your typical graphical interface but with system-wide permissions. This means an inadvertent mistake could have systemwide consequences. For example, you could drag an important system file or program to the trash can. Without your typical user-level restrictions, the file would be removed and the system could quickly come to a grinding halt.

SuSE systems warn you that you are the root user by displaying a red background with bombs on it but this is just a warning to you to be careful. The system isn't checking your work so it is up to you not to make a mistake or you will just pay the consequences. A better solution would be to have you use your normal login for most of the work but be able to temporarily become the administrator as needed.

YAST, SuSE's graphical administration program offers a level of protection. You can start YAST from the menu and it prompts you for the root password and then keeps you within its graphical environment. Thus, you at least have the level of hand-holding that YAST offers before you can make a fatal mistake. But, besides still having the ability to make a mistake, a bug in the YAST software itself could result in system damage.

The real goal is to do the various tasks with the minimum permissions that allow the task to be performed. For geeks, Linux (and UNIX) has always had the su or substitute user command. This means that from the command line, you could become the administrator or any other user as long as you had the appropriate password. No need to log out and back in.

The most common place where this capability would be used in in building new software from source code. Typically, this is done by running three commands, ./configure, make and make install. Only the last one of these commands (make install) needs to be run as the administrator. Thus, from the command line, the user can use the su command before running make install to run only the one command as root. Not much overhead for a large amount of added security.

While this approach is a lot safer than just logging in as root, you still must remember to exit the administrator level with either exit or Control-D to get you back to your own user permissions. That means forgetting a step or just being lazy can be dangerous. A safer approach would be to require you to take action each time you want to run a command as root.

Enter the sudo command. Unlike su, sudo changes your permissions for only a single command. Once that command completes your permissions revert back to the ones you had when you logged in. Note that while sudo has additional capabilities, 99% of the time this is all you want. For the geeks out there, read the sudo man page by entering man sudo in a terminal window.

Using sudo, the build sequence described above just becomes ./configure, make and sudo make install. No other changes other than adding sudo to the third command and no need to exit to get back to your normal user permissions.

Both the Knoppix and Ubuntu/Kubuntu distributions don't include the su command nor do the have root logins. The only way to get administrator privileges at the command-line level is to use sudo. With Knoppix running from a live CD there are no user logins so sudo happens with no questions asked.

With Kubuntu, it works a bit different. When you enter the sudo command for the first time, you will be prompted for a password. What password? Yours. That is, the password you normally use to log in. This is to prevent someone walking over to an unattended system from getting root access. In order to make it more convenient to do a series of commands as root, Kubuntu remembers that you have run as root recently and doesn't require the password. But, after a short idle period, you will be asked for it again.

Hopefully this article has filled in your knowledge on how to get administrator access. The most important information in this article is, however, to always try to do as much as possible without administrator permissions. Using this approach you will find that you say "Oops!" a lot less often.