So I've been reading into the differences between using su
and sudo
, and everyone seems to be in agreement that the sudo
approach is safer than allowing access to the root account itself. They say that with the root account you could break your entire system with just a single command. This I understand. BUT the initial user created on the system also has access to all commands using sudo. This I can find out by running su -l
. If this is the case, then I can simply run sudo <game-ending command>
to ruin my system. So how is this approach better or safer then allowing me direct access to the super user account? I can run all of the same commands…
Is it because using sudo
on the command line I am explicitly telling the computer I think I know what I am doing? Do they think people will forget they are under the super user account unless they explicitly say so?
People also state that if the system were compromised and entered by someone foreign, being under the root account would allow them to do terrible things to my system. But it seems to me if they already have access to my account, and know my password, they can do these same terrible things by using sudo and entering my password since they don't even need to know the super user's password. What am I not getting here?
Best Answer
Personally I do not necessarily consider it safer and most of the benefits (of sudo) are on a multi user system. On a single user system it probably is a wash.
The benefits are (in no particular order):
sudo -i
is probably the best method to isolate root's environmental variables from your user. This comes up from time to time but is moderately esoteric. See https://help.ubuntu.com/community/RootSudo#Special_notes_on_sudo_and_shellsThere are probably more benefits , but, those are the major ones, IMHO.
See also - https://help.ubuntu.com/community/RootSudo
To try to answer some of your other thoughts:
So while you have observed problems or flaws with sudo, su has the exact same vulnerabilities and su is not superior to sudo in those aspects, IMHO