Difference Between su and sudo in Linux

In the Linux operating system, both su and sudo are critical command-line utilities used to execute tasks with elevated or administrative privileges. While they achieve similar administrative results, they operate on fundamentally different security models. This article explains what each command does, compares how they authenticate users and manage access, highlights their security and logging implications, and outlines when to use each in daily administration.

What is su?

The su command stands for "substitute user" or "switch user." It allows you to switch from your current user account to another account in a new shell session. By default, running su without any arguments attempts to switch directly to the root (superuser) account.

• Authentication: To use su, you must know and enter the target account's password (e.g., the root password).
• Session behavior: It creates an entirely new shell session as the target user. Any command run afterward is executed as that user until you type exit to return to your original shell.
• Environment variables: Running su preserves some of the original user's environment, whereas running su - (or su -l) creates a fresh login environment matching the target user.

What is sudo?

The sudo command stands for "superuser do." It is designed to run a single command with root privileges (or the privileges of another specified user) without switching to a persistent root shell.

• Authentication: To use sudo, the user enters their own password, not the root password.
• Access control: Access is managed through a central configuration file located at /etc/sudoers (edited using visudo). Administrators can grant users specific rights down to the individual command level.
• Session behavior: Elevated privileges apply only to the command prepended with sudo. Once the command completes, the terminal immediately returns to standard user permissions.

Key Differences

1. Password Management and Security

• su: Requires sharing the root password with anyone who needs administrative access. If an employee leaves or access must be revoked, the root password must be changed across the entire system.
• sudo: Users never need to know the root password. Administrative access is granted or revoked per user simply by modifying the sudoers file or managing group memberships (such as sudo or wheel).

2. Scope of Access

• su: Grants complete, unrestricted access to the target account. There is no native mechanism to restrict which commands a user can run once they have switched accounts.
• sudo: Implements the principle of least privilege. Administrators can configure permissions so that certain users can only run specific commands (e.g., restarting a service or editing a specific config file) without gaining full root capabilities.

3. Accountability and Logging

• su: Logging is minimal. System logs record that a user switched to root, but they do not track the individual commands executed inside the root shell.
• sudo: Every command executed via sudo is logged with the user's original username, timestamp, working directory, and the exact command executed. This creates a detailed audit trail.

Comparison Table

Best Practices: Which Should You Use?

Modern Linux distributions (including Ubuntu, Debian, Fedora, and CentOS/RHEL) recommend using sudo for almost all administrative work. It enforces better security hygiene, prevents accidental system-wide changes, preserves an audit trail, and eliminates the need to distribute the root password.

The su command is generally reserved for environments where a dedicated, prolonged session as another user is explicitly required, or for legacy systems where sudo is not configured.