su

Overview

su (“substitute user”) starts a shell or runs a command as another user. On modern Ubuntu, prefer sudo for policy-controlled elevation; su still matters for switching to service accounts, recovering systems without sudo, and older procedures. runuser is a non-setuid alternative used in scripts from root.

Syntax

su [options] [-] [user [argument...]]
su [options] -c command [user]

Common Options

Option	Description
- / -l / --login	Login shell (loads target profile, resets env)
-c cmd	Run command then exit
-s shell	Use alternate shell
-w / --whitelist-environment	Preserve listed vars (util-linux)
-p / -m	Preserve environment (careful)

Safety

• su - vs su differs wildly in environment (HOME, PATH). Prefer login form for interactive admin.
  
• From an unprivileged user, su asks for the target user’s password (root password on many systems) — not your sudo password.
  
• Avoid su -c with unquoted complex scripts; quoting bugs become root bugs.

Examples with Explanations

Become root (login)

su -
# or
su - root

Run one command as root

su -c 'systemctl status ssh' root

Switch to a service user

sudo su - postgres
sudo -u postgres -i          # usually better when sudo is available

Preserve selected environment

su -w LANG,TERM - alice

Notes & Pitfalls

• Many Ubuntu systems (including Server) have no root password by default — su to root fails; use sudo -i.
  
• PAM modules may restrict su even if the password is known.
  
• sudo su works but obscures audit trails compared to sudo -i / direct sudo cmd.

Related Commands

• sudo — policy-based elevation
  
• runuser — switch user from root without setuid su
  
• login — full login path
  
• machinectl shell — containers/machines

Additional Resources

• man su
  
• man runuser