10

My computer has user1 and user2, both administrators.

While I'm logged in as user1 I'm trying to:

  • "su - user2" -> prompts me for the users2 password, then I can type commands
  • "sudo --user=user2 [command]" -> prompts me for the password. If I type user2's password I get a "Sorry, try again." error message as if the password is incorrect. If I type user1's password it runs correctly.

Shouldn't the sudo command require the user's password that I define in the "--user" parameter?

2
  • 2
    Sudo (super user do) is asking for the pword of the user invoking the sudo command. Su (switch user) is asking for the pword of the user being switched to.
    – MmmHmm
    Mar 31, 2017 at 9:46
  • See also: apple.stackexchange.com/q/49873/216401
    – MmmHmm
    Mar 31, 2017 at 9:55

1 Answer 1

22

This is expected behaviour.

  • The purpose of su is to switch user. It's called the substitute user identity tool. su takes the other user's password since you are switching to that user.

    The su utility requests appropriate user credentials via PAM and switches to that user ID (the default user is the superuser). A shell is then executed.

    Source: Man page

  • The purpose of sudo is to execute a command as another user. The -u or --user option for sudo specifies that user. You're not logging in as that user, just running a command. sudo takes your password to verify your identity for performing such a task.

3
  • So if user1 is not in the sudoers file I wouldn't be able to sudo, just "su"?
    – Pablo
    Mar 31, 2017 at 9:50
  • 1
    @Pablo That's true
    – grg
    Mar 31, 2017 at 9:50
  • @Pablo "switch user" versus "super user do". One requires you to authenticate as the other user; the other requires you to authenticate as the superuser. Apr 1, 2017 at 9:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .