su vs sudo: Choosing the Right Linux Privilege Escalation Tool

1. The su Command

The su (switch user) command changes the current user identity to another user, typically root. It requires the target user's password (e.g., the root password) to authenticate. After entering the password, the user gains a full shell with that user's privileges. su Once authenticated, the user operates entirely as the target user with all associated permissions.

2. The sudo Command

The sudo (superuser do) command executes a single command with elevated privileges (usually root) without switching the entire shell. The invoking user authenticates with their own password, not the root password. The command to run is prefixed with sudo. sudo apt-get update After password verification, only that specific command runs with elevated rights.

3. Key Differences

3.1 User Identity

su

requires the target user's password (e.g., root password) and fully switches the user context. sudo allows a permitted user to run commands as another user (default root) using their own password.

3.2 Permission Scope

su

grants the complete permission set of the target user. sudo can be finely controlled via the sudoers file to restrict which commands a user may run and as which user.

3.3 Security

su

necessitates sharing the root password among administrators, increasing exposure risk. sudo avoids root password sharing; each user authenticates with their own credentials, reducing the attack surface.

3.4 Audit Logging

sudo

logs every privileged command execution, including the command itself and the invoking user, enabling security auditing and traceability. su lacks built-in logging of commands run after the switch.

3.5 Usage Style

su

is invoked directly, then prompts for the target user's password. sudo prefixes the intended command and prompts for the current user's password.

4. Applicable Scenarios

su : Suitable for extended sessions where multiple commands must run under another user's environment (e.g., working in a service account's shell for a prolonged period).

sudo : Ideal for one-off privileged tasks such as package installation, system updates, or targeted maintenance commands.

5. Conclusion

Both su and sudo provide privilege escalation in Linux, but they differ fundamentally in authentication, scope, security, and auditability. sudo is generally preferred for routine administration because it avoids root password sharing, enforces least privilege via sudoers, and produces an audit trail. su remains useful when a full interactive session as another user is required. Choose based on the specific operational need and security policy.