root login vs. su (set user) to root--what are the differences?

[Dee_3]

I have a person in Application Development that is experiencing sporadic problems having users run a script (that requires root permissions) while su'd to root, but the problems disappear when we have them actually log on as root instead. Does this make any sense? Has anyone seen anything like this before?

Can any shed some light on this for me? From what I found, there is a difference in root using /sbin and vs. /usr/bin and /usr/sbin.
Thanks, Terri Christensen.

[Christopher McCray_1 · Accepted solution]

When you "su" to root, you are in effect root, but you only have enough of root's environment to give you the horsepower you need. By logging in directly as root, you are getting any and all settings root has. Another alternative is you can try this:

# su - root

which actually takes and reads in root's .profile and may solve your problem.

Hope this helps

Chris

[Uday_S_Ankolekar]

This could be dur to the profile gets loaded during login directly as root.

When you want to su as root and wants to use profile of root then you could try as
su - root ( There is space between - and root)

Goodluck
-USA..

[Anil C. Sedha]

Hi Terri,

Try this. I believe you have root permissions on the script and are not doing a su - in the script just before the command.

If you are doing a su - in the script then do this.

su root instead of su -


or the alternate thing as

su - instead of su
(if it is already the first case in your script)

Otherwise, put your script in debug mode and check where it stops.

#!/usr/bin/sh -x

instead of #!/usr/bin/sh (the above one will give error or stop/pause at a place where the command is unable to execute)

Please let us know of more issues after this.

Regards,
Anil

[Dee_3]

Thanks. It sounds like that is what we needed.
Thanks for the quick response. Terri Christensen.

[Olivier ROBERT]

Hi Terri,

There can be many differences, depending on how you "su". The closest to a true login is a "su -". If you use "su - root" instead of just "su root" (in either case, "root" can be omitted), a true login is simulated, by telling the shell to behave like a login shell (i.e. sourcing the system and user profile files), and clearing the previous environment. But there still are the following differences:
- The user's tty doesn't change and still belongs to the logged in user
- The system logins files (/etc/utmp* and /var/adm/wtmp*) are not updated. This is normal, since it's just a user change and not a system login (entrance into the system). There's already an entry for the current login, think twice before tampering with those files...

As far as I know, those are the only differences. You can use the command "logname" to determine the login user name, which doesn't change across "su"s.
HTH!
Regards,

Olivier

[Darrell Allen]

Hi Terri,

I expect you have your answer: use "su -" instead of simply "su".

Now for the soapbox: don't give out unrestriced root access to anyone outside the UNIX system administration group.

Try to set up the app where superuser priviledges are not needed. If there's no way to get by without the user running something as superuser, you should use restricted SAM or sudo.

You can find a lot of info on these tools by searching the forums.

Darrell

[Dee_3]

I apologize for the delay in assigning points. Thanks to everyone for their help. Terri Christensen, JDIS.

[Wodisch]

Hi Terri,

maybe I am tto late, but there is an important difference between "su -" and "login":
some process attributes are NOT reset due to "su -", like your "logname", so you are still logged in as somebody else (not "root"), and this piece of information is e.g. used for your eMail address - don't expect mail to be sent to your "root" account, but to the one you logged in with!

FWIW,
Wodisch