What is the difference between the su and sudo commands in Linux?
Learn the difference between su and sudo in Linux: how each elevates privileges, which password they use, sudoers configuration, and why sudo is safer to audit.
Expected Interview Answer
su switches your entire session to another user (usually root) by opening a new shell as that user, while sudo runs a single command with elevated privileges and then returns you to your own account.
With su you authenticate using the target user's password and inherit their full environment, so every command afterwards runs as that user until you exit. With sudo you authenticate with your own password, and an administrator controls exactly which commands you may run through the /etc/sudoers file. sudo also logs each elevated command, giving auditability and least-privilege access that plain su does not.
- sudo grants least-privilege, per-command access
- sudo logs every elevated action for auditing
- sudo uses your own password, not the root password
- su gives a full interactive shell as another user
- sudoers allows fine-grained, per-user rules
AI Mentor Explanation
su is like the twelfth man swapping in and playing the whole rest of the innings as a full batter, taking over completely. sudo is like calling for a runner for one single delivery: you get help for that one ball, then you are right back to batting as yourself, and the scorer notes exactly when the runner was used.
Step-by-Step Explanation
Step 1
Understand identity switching
su starts a new shell running as the target user; every later command runs as that user until you exit.
Step 2
Understand privilege elevation
sudo runs one command as another user (root by default) and then drops back to your normal identity.
Step 3
Check which password is used
su asks for the target user's password; sudo asks for your own password (unless configured otherwise).
Step 4
Configure permissions
Edit sudo access safely with visudo, granting specific users or groups specific commands in /etc/sudoers.
Step 5
Review the audit trail
Inspect sudo usage in logs such as /var/log/auth.log or via journalctl to see who ran what.
What Interviewer Expects
- Clear distinction between switching users and elevating one command
- Knowledge that sudo uses your password and su uses the target's
- Awareness of /etc/sudoers and visudo
- Understanding of auditing and logging with sudo
- The principle of least privilege
Common Mistakes
- Saying sudo and su are interchangeable
- Claiming sudo always needs the root password
- Editing /etc/sudoers directly instead of using visudo
- Not knowing su leaves you in the target user's environment
- Forgetting that sudo actions are logged
Best Answer (HR Friendly)
“su logs you in fully as another user, usually root, so everything you do afterwards runs as them. sudo just lets you run one command with extra permission using your own password, and it keeps a record of what you did, which is safer and easier to audit.”
Code Example
# Switch fully to root (asks for root's password)
su -
# Run a single command as root (asks for YOUR password)
sudo systemctl restart nginx
# Grant a user limited sudo access safely
sudo visudo
# Example line inside sudoers:
# deploy ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginxFollow-up Questions
- What is the purpose of the /etc/sudoers file?
- Why should you always use visudo to edit sudo rules?
- What does the -i flag do with sudo?
- How can you see a log of sudo commands that were run?
- What is the difference between su and su -?
MCQ Practice
1. Which password does sudo ask for by default?
By default sudo authenticates the invoking user with their own password, not root's, then checks /etc/sudoers for permission.
2. What is the correct way to edit sudo permissions?
visudo locks and syntax-checks the sudoers file before saving, preventing a broken file that could lock out administrators.
Flash Cards
What does su do? — Starts a new shell as another user (root by default), inheriting their environment until you exit.
What does sudo do? — Runs a single command with elevated privileges using your own password, then returns to your identity.
Which file controls sudo access? — /etc/sudoers, edited safely with the visudo command.
Why is sudo safer than su for admin tasks? — It enforces least privilege, uses per-user rules, and logs every elevated command for auditing.