55

I want to be able to 'su' to a specific user, allowing me to run any command without a password being entered.

For example:

If my login were user1 and the user I want to 'su' to is user2:

I would use the command:

su - user2

but then it prompts me with

Password:

Improve this question
7
  • Ask the other user for the password. At least the other user knows what's been done under his/her id.
    – Global nomad
    Feb 17, 2013 at 13:17
  • 1
    This is nothing to do with another physical user. Both ID's are mine. I know the password as I created the account. I just don't want to have to type the password every time.
    – zio
    Feb 17, 2013 at 13:24
  • Would it be ok to ssh to at user or do you need to inherit one shell in particular and need su to work?
    – bmike ♦
    Feb 17, 2013 at 15:32
  • 1
    @zio Great use case. Does open -na Skype not work for you?
    – bmike ♦
    Feb 17, 2013 at 23:59
  • 1
    You could also try copying the application bundle and changing CFBundleIdentifier.
    – Lri
    Feb 18, 2013 at 4:50

2 Answers 2

Reset to default
77

sudo can do just that for you :)

It needs a bit of configuration though, but once done you would only do this:

sudo -u user2 -s

And you would be logged in as user2 without entering a password.

Configuration

To configure sudo, you must edit its configuration file via: visudo. Note: this command will open the configuration using the vi text editor, if you are unconfortable with that, you need to set another editor (using export EDITOR=<command>) before executing the following line. Another command line editor sometimes regarded as easier is nano, so you would do export EDITOR=/usr/bin/nano. You usually need super user privilege for visudo:

sudo visudo

This file is structured in different section, the aliases, then defaults and finally at the end you have the rules. This is where you need to add the new line. So you navigate at the end of the file and add this:

user1    ALL=(user2) NOPASSWD: /bin/bash

You can replace also /bin/bash by ALL and then you could launch any command as user2 without a password: sudo -u user2 <command>.

If you want to be able to switch to any user just use

user1    ALL=(ALL) NOPASSWD: /bin/bash

Update

I have just seen your comment regarding Skype. You could consider adding Skype directly to the sudo's configuration file. I assume you have Skype installed in your Applications folder:

user1    ALL=(user2) NOPASSWD: /Applications/Skype.app/Contents/MacOS/Skype

Then you would call from the terminal:

sudo -u user2 /Applications/Skype.app/Contents/MacOS/Skype
Improve this answer
4
  • This is far less complicated than the ssh keys idea, so use this unless you need the ssh keys for remote access as well.
    – bmike ♦
    May 28, 2014 at 16:04
  • 2
    One thing to note from a security-perspective is that specifying a specific command implies that it should be a read-only command for user1; Otherwise, they can overwrite the command with something else and run that as user2. And if you don't care about that, then you might as well specify that user1 can run any command as user2 and therefore have a simpler sudo config.
    – Stan Kurdziel
    Oct 26, 2015 at 16:56
  • @StanKurdziel good point! Although it is something to be aware of, it's really seldom to have system executables writable by users unless you're root but in this case you don't need sudo ;-) But you're right to add this comment because it's so seldom that I've probably overlooked it more than one time.
    – Huygens
    Oct 26, 2015 at 19:24
  • To get it nearer to the behaviour su - user2 instead of su user2, the commands should probably all involve sudo -u user2 -i, in order to simulate an initial login as user2
    – Gert van den Berg
    Aug 10, 2016 at 14:24
4

I would set up public/private ssh keys for the second account and store the key in the first account.

Then you could run a command like:

 ssh user@localhost -n /Applications/Skype.app/Contents/MacOS/Skype &

You'd still have the issues where Skype gets confused since two instances are running on one user account and files read/written by that program might conflict. It also might work well enough for your needs and you'd not need an iPod touch to run your second Skype instance.

Improve this answer
5
  • 1
    This is a good secure solution for the general case of password-free login to any account on any host, but I'd say it's probably overkill when both accounts are on the same host and belong to the same user.
    – calum_b
    Feb 18, 2013 at 9:54
  • @scottishwildcat It's far more secure than the alternative of scripting the password and feeding it in clear text or using a variable and storing the password in the keychain and using a tool like expect to script the interaction. I just use sudo su - blah and type my password. I think the other answer covers sudo well enough to keep this as a comment.
    – bmike ♦
    Feb 18, 2013 at 14:02
  • Oh, I certainly wasn't suggesting your answer should be removed… I didn't even down-vote, it's a perfectly good answer.
    – calum_b
    Feb 18, 2013 at 17:47
  • We appear to be in total agreement - thanks for the addition - feel free to edit it into the answer if you can improve on it.
    – bmike ♦
    Feb 18, 2013 at 18:46
  • The accepted solution (sudo -u user2 <...>) does have the advantage that it can't be used remotely, which might help for security - there is no private key for user1 that can be stolen.
    – Gert van den Berg
    Aug 10, 2016 at 14:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .