So roll up, roll up, roll up!
It's your first demonstration!
And as always, we really encourage you to join in and follow through.
Your hands‑on experience is going to solidify your knowledge.
We're going to begin by taking a look at the su command.
We'll look at the difference between a login and a non‑login shell,
and we'll look at why we might use the su command.
If I'm advocating it's such a bad thing,
why is the su command there, and why would we use it?
Come on, let's go and find out.
And here we are on the command line of my AlmaLinux 8 system.
This is a fresh system.
Each time I start a new module,
I can revert my Vagrant virtual machine back to the original box,
so we're not carrying forward any of the
customizations that we might have made before.
I'm just making sure that my Vagrant user does have a password,
that my Vagrant user is a member of the
administrative group in Enterprise Linux,
the wheel group, and then you can see on line three and four,
we just exit out and then run the history once we've logged back in again,
just so you know where we're up to.
The other thing I'm going to need to do is make sure
that the root account has a password.
To do this, I'm going to have to then go through and use sudo, and passwd root.
I can't use the su command because the su command would
require that we had a root password.
These virtualbox systems with Vagrant do not have a root password by default.
So we then have to go through and set up a root password.
We can do that with the sudo command, more on configuring sudo later, and
I can go through then and set a password, so long as I've got the
privileges to use sudo. I'm setting up a password.
Don't worry about it being a simple password.
It needs to be simple for a simple person like me.
But obviously, in your own environment, manage this root account
really carefully. So our root user now has a password.
If I use the su command by itself, and if I don't specify any options,
and if I don't specify any arguments, then we are switching or
substituting our user ID to the user ID 0, and we're being prompted
for the password of the root account.
Now you can see then that I am root. I have a different prompt.
The directory that I'm in when I do pwd is the Vagrant user directory.
I haven't reset everything.
If I run the id command, we can see that I'm user ID 0, so all looks good.
But if I look at some of my environment variables, if I go through and say,
look at $user, we can see the $user variable is still set to vagrant so there
may be some things such as mail that still looks in the Vagrant user's mail
and doesn't check the root user's mail.
Now the idea of using this is typically if I've moved through to a directory,
I want to use su, but I don't want to leave the directory that I've moved to.
So it is possible that we do it, but you are not fully the
root user without doing a full login shell.
Don't forget to exit out.
If I run the ps command at the moment,
you can see then that I'm running a bash shell inside of an su environment.
If I su to switch back, let's say, to the Vagrant account,
I'm building shell upon shell upon shell.
So we really want to exit out, so we return back then to my Vagrant user, and
now when I look at ps, you can see that I'm just running ps inside of a bash
shell, and there's nothing above that bash shell level.
Now we can compare the same activity, so su ‑. Su ‑
is exactly the same as su = l.
Generally, I don't put the l in, but this is then for a full login
shell. As we then go through and run through that same process, when
we look at pwd, we can see now that I'm in the root user's home
directory, and if we go back and check the environment, so if I go
through and look at, let's say, the user variable,
the user variable now is set to root.
So we have a full and operating environment representing our
root account. Whilst we're here as our root account, why don't
we go through and quickly do a useradd ‑m to create the home
directory, and we can have, let's say, a user called bob. Hit the big Enter key.
So Bob is up and running, but as yet we haven't set the password for
the Bob user. If we wanted to check though that Bob was operational
and he did have items in his home directory, one of the things that we
can do is use the su command.
If we use the su command as root,
we are never prompted for a password, so it doesn't
matter that the password is not there.
I can do an su ‑ and bob, and then hit Enter, and we can see now
that I've been able to get into the Bob user account without
having configured a password for the bob.
If I exit out of this, you might think then it's a bit
strange to have to go through and do this.
Well, we can do the same thing, if I do a sudo and su ‑ and
bob, I don't have to go in as root first.
If I operate the su command using the sudo command, then I'm
running as root, and the root user doesn't need to enter the
password for the bob account.
So again, it becomes very easy that I can check it without
having to know the root user's password.
Once I have finished with this, I'm going to just exit out, and if we want
to secure our root account for the moment, one of the things that we can
do is then go and do our sudo passwd ‑l for lock and then the root
account. So the password is still there, but it's now an invalid password
so we can't use it to log in.
We can see this if I do an su ‑ and try and get in as the root account. I'll
put in the correct password, we're unable to authenticate.
So just a quick summary of what we've seen in this lab. We've seen the use of
the su command. So we can use it to gain administrative privileges and we've
seen the difference between the su and the su‑. Su ‑ is a full login shell, and
we can see there that we then have a complete environment that is set up
including the $user environment variable.
If we want to switch to a different user, we can use then the same
commands, su or su ‑, and specify the username. Here, we saw that
we could do it with the bob account.
One reason for swapping to another account is maybe we
haven't yet configured the password,
but we just want to make sure that the home directory is in place with everything that we need for the newly created user.