The Need for Alternate Identities
When you log into a Linux system, you are assigned a specific user account. Everything you do—creating files, running scripts, deleting directories—is tied directly to the permissions granted to that specific user.
Often, you will need to perform an action that your current user account is not allowed to do. You might need to edit a global system configuration file (which requires the root administrator account), or you might need to test a script to see if a guest user (like www-data) has the correct permissions to run it.
Instead of logging completely out of the server and logging back in as the other user, you can use the su (Substitute User) command. This command allows you to instantly switch your identity within the current terminal session, assuming the privileges and environment of the target user.
Step 1: The Basic User Switch
The syntax for the su command is simple. You type su followed by the username you want to switch to.
Assume you are currently logged in as john, and you want to switch to a user named developer.
su developer
The terminal will pause and ask you for a password. Crucially, you must enter the password for the target user (developer), not your own password.
Once authenticated, your terminal prompt will change to reflect your new identity (e.g., developer@server:~$). If you run the whoami command, it will print developer. Any file you create now will be owned by the developer account.
Step 2: The Importance of the Hyphen (-)
When you run the command as shown in Step 1, you switch your identity, but you do not switch your environment.
This means you retain your original user’s PATH variables, aliases, and working directory. You are technically the developer user, but you are still sitting in john‘s home directory, using john‘s customized terminal settings. This often leads to confusing “command not found” errors.
To completely assume the target user’s identity—including their home directory, their PATH variables, and their specific shell configuration—you must use the login hyphen (- or -l).
su - developer
This simulates a full login process. Your working directory will instantly change to the developer‘s home folder, and all of their specific environment variables will be loaded.
Step 3: Switching to Root (The Superuser)
The most common use of the su command is to switch to the root account (the system administrator), which has unlimited power to modify the operating system.
If you execute the command without specifying a target username, Linux automatically assumes you want to become root.
su -
You will be prompted for the root password. Upon success, your prompt will usually change from a dollar sign ($) to a hash symbol (#), indicating that you now have unrestricted, dangerous privileges.
(Note: On many modern systems like Ubuntu, the root account is locked by default and has no password, meaning su - will fail. Instead, you must use sudo su -, which authenticates using your own user’s password, provided you have sudo privileges.)
Step 4: Executing a Single Command as Another User (-c)
Sometimes you only need to run one specific command as another user. Switching accounts, running the command, and switching back is inefficient.
You can use the -c (command) flag to execute a single instruction as the target user and instantly return to your own account.
For example, to list the contents of a restricted directory as the root user without remaining in the root shell:
su -c "ls -la /root/secrets" root
The system will ask for the root password, execute the ls command, print the output, and immediately return you to your normal user prompt.
Step 5: Exiting the Substitute Session
When you are finished working as the substitute user, you need to return to your original identity. Do not close the terminal window, as that terminates the entire session.
Simply type:
exit
The substitute shell will close, and you will “drop back down” into your original user account and environment.