su Command in Linux: Syntax, Options & Practical Examples

Deepak Prasad
Tested on Ubuntu 25.04 (Plucky Puffin)
Package su from util-linux 2.40.2
su from util-linux 2.40.2
Applies to Ubuntu, Debian, RHEL, Fedora
Privilege sudo or root
Man page su(1)
Scope su runs a shell or single command with another user and group ID. On Ubuntu it uses PAM for authentication; login mode (-) resets the environment and home directory like a real login.
Related guides How to create user in Linux
Linux wheel group
Where to set environment variables in Linux
adduser
useradd

su — quick reference

User switch

Start an interactive shell as another account. With no username, su assumes root.

When to use Command
Switch to root (default target user) su
Switch to a named user su root
Same — run one command as that user su -c 'whoami' root

Login shell

Use login mode when you want the target user's home directory, PATH, and USER/LOGNAME — like logging in at a console.

When to use Command
Login shell (short form — a lone - implies -l) su -
Login shell — long option su -l alice
Login shell — GNU-style spelling su --login alice

Single command

Run one command as another user without staying in an interactive shell.

When to use Command
Run a single command (-c passes it to the shell) su -c 'id' root
Same — long option su --command='id' root
Run one command without creating a new session (discouraged in man page) su --session-command='whoami' root

Environment

Control whether su clears or keeps your current environment variables.

When to use Command
Keep caller environment (HOME, SHELL, USER, LOGNAME) su -m -c 'echo $USER' root
Same — -p alias su -p -c 'echo $USER' root
Same — long option su --preserve-environment -c 'echo $USER' root
On login shell, keep extra variables (comma-separated list) su -w TERM,PATH --login -c 'echo $TERM' root
Same — long whitelist spelling su --whitelist-environment=TERM,PATH --login -c 'echo $TERM' root

Shell and groups

Pick a shell or override primary/supplementary groups (group options are root-only).

When to use Command
Run a specific shell if /etc/shells allows it su -s /bin/sh -c 'whoami' root
Same — long option su --shell /bin/sh -c 'whoami' root
Pass -f to the shell (mainly csh/tcsh) su -f -c 'whoami' root
Same — long option su --fast -c 'whoami' root
Set primary group (root only) su -g nogroup -c 'id' root
Same — long option su --group nogroup -c 'id' root
Set supplementary group (root only) su -G nogroup -c 'id' root
Same — long option su --supp-group nogroup -c 'id' root

Terminal security

Allocate or skip a pseudo-terminal — su defaults vary; --pty is safer for interactive use.

When to use Command
Create a pseudo-terminal for the session su -P -c 'whoami' root
Same — long option su --pty -c 'whoami' root
Do not create a pseudo-terminal (security risk — man page warns) su -T -c 'whoami' root
Same — long option su --no-pty -c 'whoami' root

Help and version

When to use Command
Show built-in usage text su --help
Show util-linux version su -V
Same — long option su --version

su — command syntax

Synopsis from su --help on Ubuntu 25.04 (util-linux 2.40.2):

text
su [options] [-] [<user> [<argument>...]]

su does not edit /etc/passwd — it starts a process with another UID/GID after PAM authentication. Root can switch to any local user; unprivileged users need the target account's password unless your admin workflow uses sudo instead.

su — command examples

Essential Login shell vs non-login — environment and working directory

Most confusion around su comes from whether you pass login mode (- or --login). Without it, su keeps your current working directory and only adjusts a few variables. With login mode, you land in the target user's home with a clean environment — closer to a real console login.

Compare non-login su (note PWD stays where you were):

bash
sudo su -c 'echo USER=$USER HOME=$HOME PWD=$PWD' root

Sample output:

output
USER=root HOME=/root PWD=/root/golinuxcloud-static

Now try login mode — PWD moves to the target home:

bash
sudo su - -c 'echo USER=$USER HOME=$HOME PWD=$PWD' root

Sample output:

output
USER=root HOME=/root PWD=/root

Use su - (or su --login) when you want the target account's full login environment; use plain su when you only need root privileges but want to stay in the current directory.

Essential Run one command as another user with -c

When you only need a single command as root or another user, -c avoids opening an interactive shell.

Run:

bash
sudo su -c 'whoami; id -gn' root

Sample output:

output
root
root

For a non-root target, replace root with the username. The target account must allow shell access — system users with /usr/sbin/nologin return This account is currently not available.

Essential Check installed util-linux version

Confirm the su build on the host before relying on newer flags like --whitelist-environment.

Run:

bash
su --version

Sample output:

output
su from util-linux 2.40.2

Built-in option list:

bash
su --help

Sample output (first lines):

text
Usage:
 su [options] [-] [<user> [<argument>...]]

Change the effective user ID and group ID to that of <user>.
A mere - implies -l.  If <user> is not given, root is assumed.
Common sudo su - — switch to root with your password

On Ubuntu, members of the sudo group often run sudo su - to become root using their own password instead of the root password (which may be locked).

Run:

bash
sudo su - -c 'whoami; echo HOME=$HOME' root

Sample output:

output
root
HOME=/root

This pattern is common on desktops; for scripted admin work, prefer sudo command or sudo -i — see the sudo command.

Common Run a different shell with -s

If /etc/shells lists the shell, -s runs that interpreter instead of the target user's default from /etc/passwd.

Run:

bash
sudo su -s /bin/sh -c 'echo shell=$0; whoami' root

Sample output:

output
shell=-sh
root

Restricted shells in /etc/passwd are ignored unless the caller is root — check getent passwd user for the default shell before relying on -s.

Common Preserve caller environment with -m or -p

-m, -p, and --preserve-environment tell su not to reset HOME, SHELL, USER, and LOGNAME. This is ignored when you also pass login mode (- / --login).

From /tmp, preserve the caller's PWD:

bash
sudo sh -c 'cd /tmp && su -p -c "echo PWD=\$PWD USER=\$USER" root'

Sample output:

output
PWD=/tmp USER=root

Use this when a script exports variables you still need after switching user; for a clean admin session, prefer su - instead.

Advanced Override primary group as root with -g

Only root may set the primary group with -g. Supplementary groups can be set with -G.

Run:

bash
sudo su -g nogroup -c 'id' root

Sample output:

output
uid=0(root) gid=65534(nogroup) groups=65534(nogroup)

Verify the group exists first:

bash
getent group nogroup

Sample output:

output
nogroup:x:65534:
Advanced Allocate a pseudo-terminal with --pty

--pty (-P) gives the new session its own terminal, which the man page recommends for interactive use and some security scenarios.

Run:

bash
sudo su -P -c 'tty; whoami' root

Sample output (device name varies):

text
/dev/pts/2
root

Compare without --pty when stdin is not a terminal — behaviour differs for pipelines and background jobs.

su — when to use / when not

Use su when Use something else when
  • You know the target user's password and need an interactive shell as that account
  • You are on a minimal system or recovery shell without sudo configured
  • A script or admin habit expects classic `su -` / `su -c` semantics
  • You must run as root and the root password is set (legacy servers)
  • Your distro grants admin rights through sudoers — use sudo for logging and per-command policy
  • You are root running a script that should not prompt — use runuser or setpriv (see man page)
  • You need LDAP/SSO identities — directory login tools, not local su
  • The account uses /usr/sbin/nologin — pick a login-capable user or use sudo -u

su vs sudo

su sudo
Authentication Target user's password (or root's password for su) Caller's password (sudoers policy)
Scope Full shell or one -c command as target user Per-command elevation with logging
Environment Login - resets env; -m preserves Configurable via sudoers and flags
Typical on Ubuntu Legacy / recovery Default admin path

See the sudo command for -u, -i, and sudoers workflows.

su — interview corner

What does the su command do in Linux?

su (substitute user) starts a shell or runs one command with another user's UID and GID. It is part of util-linux and on Ubuntu it authenticates through PAM — you usually need the target account's password unless you are already root.

Plain su switches to root by default. su alice switches to alice. The login form su - alice (or su --login) clears most environment variables, sets HOME, USER, LOGNAME, and PATH, and cds to the target home — behaviour closer to a real login.

A strong answer is:

"su runs a shell or single command as another user after PAM checks the target password. su - gives a login environment; plain su keeps more of the caller's cwd and env. On modern Ubuntu admin work, sudo is more common because it logs commands and uses the caller's password."

What is the difference between su and su -?

Without a hyphen, su keeps your current working directory and only adjusts a subset of identity variables. With su - (login mode), su clears the environment (except TERM and --whitelist-environment entries), sets standard login variables, and moves to the target user's home.

Example as root via sudo:

bash
sudo su -c 'echo PWD=$PWD' root
sudo su - -c 'echo PWD=$PWD' root

Non-login might show your project path; login shows /root for root.

A strong answer is:

"su - is a login shell — new HOME, USER, PATH, and the target's home directory. Plain su switches UID but leaves me in the same directory with a lighter environment reset. I use su - for admin sessions that should look like a fresh login."

When would you use su instead of sudo?

sudo reads /etc/sudoers and lets permitted users run specific commands (or shells) as root or another user while logging the action. su needs the target password and traditionally opens a full shell as that user.

Use su when sudo is not installed, in single-user recovery, or when you genuinely need the target account's full interactive session with their password. Use sudo for day-to-day Ubuntu admin — least privilege, audit trail, and no shared root password.

A strong answer is:

"sudo for policy-based elevation with logging on Ubuntu; su when I have the target user's password and need their full shell, or when sudo isn't configured. I avoid sudo su - in scripts — I use sudo -u or runuser instead."

How do you run a single command as another user with su?

Pass -c or --command with a quoted command string:

bash
su -c 'whoami' root

su invokes the target user's shell with -c. For root-only group overrides, combine flags:

bash
su -g nogroup -c 'id' root

--session-command is similar but avoids a new session — the man page marks it discouraged.

A strong answer is:

"su -c 'command' user runs one command in the target's shell without an interactive session. I quote the command for the shell and check the account isn't nologin if it fails."

Why does su say 'This account is currently not available'?

That message usually means the account's login shell in /etc/passwd is /usr/sbin/nologin or /bin/false — common for nobody, www-data, and service users. su cannot start an interactive session for them.

Check:

bash
getent passwd nobody

Sample line:

text
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin

Use a login-capable user, sudo -u serviceuser command, or change the shell only if policy allows.

A strong answer is:

"The account has a nologin shell — su can't open an interactive session. I verify with getent passwd and use sudo -u for one-off commands against service accounts."

Troubleshooting

Symptom Likely cause Fix
su: Authentication failure Wrong target password Retry password; root can passwd user to reset
This account is currently not available /usr/sbin/nologin or /bin/false shell Use a login user or sudo -u user command
su: warning: cannot change directory Home directory missing (nobody → /nonexistent) Expected for some system users; use su - only when home exists
Environment variables unchanged after su - Used -m / --preserve-environment with login Drop preserve flags for login mode
su: System error / PAM errors PAM misconfiguration Check /etc/pam.d/su and system logs (journalctl)
Unknown option Flag not in your util-linux build Run su --help on the host — this page matches 2.40.2
Rohan Timalsina

is a technical writer and Linux enthusiast who writes practical guides on Linux commands and system administration. He focuses on simplifying complex topics through clear explanations.

Expertise
  • Linux
  • HTML5
  • JavaScript
  • Web Design
  • Front-end Web Development

Related Articles

linux

How to List Users in Linux (getent, passwd, who, id)

List users in Linux with getent, /etc/passwd, who, and id. Filter normal and system accounts, see logged-in …

7 min readcheatsheet

adduser Command in Linux: Syntax, Options & Practical Examples (Ubuntu/Debian)

On Ubuntu and Debian, adduser is a high-level wrapper that creates and manages local users and groups. It …

16 min readcheatsheet

usermod Command in Linux: Syntax, Options & Practical Examples

usermod changes an existing local user account — login name, UID, primary or supplementary groups, home …

10 min read