Switching Users

Switching Users in Ubuntu

In multi-user environments and when administering Ubuntu servers, you frequently need to switch between accounts — switching to a service account to test permissions, switching to root to run a sequence of administrative commands, or switching to another user to debug their environment. Ubuntu provides two main tools: su (requires target user’s password) and sudo -u (requires your own password and sudo permission).

su vs sudo -i

On Ubuntu, root has no password by default, so su - does not work unless a root password is explicitly set. Always use sudo -i instead.

Switching with su

# Switch to another user (requires their password)
su - otheruser

# Switch without the dash (keeps your environment — usually wrong)
su otheruser     # Avoids this: wrong PATH, wrong HOME

# The dash (-) is crucial: it starts a full login shell with the target user's env
su - otheruser   # Correct: changes to /home/otheruser, loads .bashrc, .profile

# Switch to a service account (they may have nologin shell)
sudo su - www-data    # Use sudo since www-data has no password

# Exit back to the original user
exit    # or Ctrl+D

Switching with sudo

# Open a full root login shell (preferred over su -)
sudo -i

# Open a root shell inheriting your current environment
sudo -s

# Run a single command as root without dropping to a shell
sudo command

# Switch to a specific non-root user (if allowed in sudoers)
sudo -u www-data bash
sudo -u postgres psql

Running commands as another user

# Run a command as www-data (web server user) to test file permissions
sudo -u www-data ls -la /var/www/html/
sudo -u www-data cat /var/www/html/config.php

# Run as a service account to test the application
sudo -u myapp /opt/myapp/bin/myapp --test

# Run a command as another user preserving their full environment
sudo -H -u www-data bash -c "cd /var/www/html && php artisan cache:clear"

# Check what user you are currently running as
whoami
id
echo $USER

SSH agent and environment forwarding

# When switching users with su, SSH agent is NOT forwarded
# This means git push or ssh to another server won't work with your keys

# Check if ssh-agent is available in the new shell
echo $SSH_AUTH_SOCK    # Empty if not forwarded

# Workaround: pass the socket explicitly
SSH_AUTH_SOCK=$SSH_AUTH_SOCK sudo -E -u deploy git push

# Or use ssh-agent forwarding and sudo while preserving env
# In /etc/sudoers (via visudo), add:
# Defaults env_keep += "SSH_AUTH_SOCK"

# With that set:
sudo -u deploy git push    # Inherits SSH agent from your session

Conclusion

Use sudo -i to get a root shell on Ubuntu — it is audited under your username and does not require a root password. Use su - username to switch to a regular user account when you know their password. Use sudo -u username command to run individual commands as a different user without requiring that user’s password. Always use the dash (-) flag with su to get the target user’s proper environment.