Mellan mardröm & verklighet!: Linux - Run Command As Another User

lördag 24 januari 2015

Linux - Run Command As Another User

The runuser command run a shell with substitute user and group IDs. This command is useful only when run as the root user:

Only
session PAM hooks are run, and there is no password prompt. If run as a
non-root user without privilege to set user ID, the command will fail
as the binary is not setuid. As runuser doesn’t run auth and account
PAM hooks, it runs with lower overhead than su.

The syntax is:
```
 
runuser -l  userNameHere -c 'command'
runuser -l  userNameHere -c '/path/to/command arg1 arg2'
 
```
For example, as a root user you may want to check shell resource limits for oracle user, enter:
# runuser -l oracle -c 'ulimit -SHa'
OR check nginx or lighttpd web server limitations:
# runuser -l nginx -c 'ulimit -SHa'
OR
# runuser -l lighttpd -c 'ulimit -SHa'
Sometime, a root user can not browse NFS mounted share due to permission (security) issue:
# ls -l /nfs/wwwroot/cyberciti.biz/http
OR
# cd /nfs/wwwroot/cyberciti.biz/http
Sample outputs:
```
-bash: cd: /nfs/wwwroot/cyberciti.biz/http/: Permission denied
```
However, apache user is allowed to browse or access nfs based system mouted at /nfs/wwwroot/cyberciti.biz/http/:
# runuser -l apache -c 'ls -l /nfs/wwwroot/cyberciti.biz/http/'
OR
# runuser -l apache -c 'cd /nfs/wwwroot/cyberciti.biz/http/; vi index.php'
No password is required to use runuser command and it must be run by root user only.

Options

The -l option : Make the shell a login shell, uses runuser-l PAM file instead of default one.

The -g group : Specify the primary group.

The -G group : Specify a supplemental group.

The -c COMMAND : Pass a single COMMAND to the shell with -c.

--session-command=COMMAND : Pass a single COMMAND to the shell with -c and do not create a new session.

-m : Do not reset environment variables.

#2: su command

The
su command allows you to become a super user or substitute user, spoof
user, set user or switch user. It allows a Linux user to change the
current user account associated with the running console or shell
provided that you know the target user's password. The syntax is as follows:

 
su -
su - username

Switching to root user

su command asks
for the target user's password. Type su - at your shell prompt to
switch to root user account (you must know the root user account
password):
vivek@wks01:~$ su -
OR
vivek@wks01:~$ su - root
Sample outputs:

Password:
root@wks01:/root# logout
vivek@wks01:~$

If the correct root password is provided, ownership of the
session is changed to root account. Type logout exit a root login shell.
Type whoami or id command to verify the owner of a session:
whoami
OR
id

Run command as root user

The syntax is:

 
su - root -c "command"
OR
su - -c "command arg1"

To view the contents of /root directory which is not accessible to normal users, run:

 
su - root -c "ls -l /root"

Please note that Linix and some Unix-like systems have a wheel group of users, and only allow these users to su to root.

Run command as another user using su command

The following command switches to user oracle's account and shows a list of limits:
$ su - oracle -c 'ulimit -aHS'

Again, if the correct oracle password is provided, ownership of the
session is changed to oracle account. The log of su command is kept in a
system log, typically in /var/log/auth.log (Debian/Ubuntu) or
/var/log/secure (RHEL/CentOS).

#3: sudo command

sudo
executes a command as another user but follows a set of rules about
which users can execute which commands as which other users. This is
configured in a filed named /etc/sudoers. Unlike su, sudo authenticates
users against their own password rather than that of the target user.
Sudo allows a system administrator to delegate authority to give
certain users (or groups of users) the ability to run some (or all)
commands as root or another user while providing an audit trail of the
commands and their arguments. This allow the delegation of specific
commands to specific users on specific hosts without sharing passwords
among them. The syntax is as follows:

 
sudo command

See the following links for more information:

How to configure and use sudo tool under Linux operating system.

sudo project home page.

A note about GUI tools ( GUI frontend for su and sudo )

gksu
command is a frontend to su and gksudo is a frontend to sudo. heir
primary purpose is to run graphical commands that need root without the
need to run an X terminal emulator and using su directly. The syntax is
as follows:

 
gksu [-u <user>] [options] <command>
gksudo [-u <user>] [options] <command>

Just type gksu and you will be prompted as follows:

Fig.01: gksu in action

You will be prompted for root user's account password:

Fig.02: Gnome gksu authentication box for the target user

You can run command directly as follows:
gksu -u root 'ls /root'
OR run command as oracle user:
gksu -u oracle 'ulimit -aHS'
OR
OR login as root:
gksu -u root -l

Summary: runuser vs su vs sudo

Command	Root to user	User to root	Any to any user	Auth type	Log file	Remark
runuser	Y	N	N	None	N/A	As runuser doesn't run auth and account PAM hooks, it runs with lower overhead than su.
su	Y	Y	Y	Target user's password	/var/log/auth.log or /var/log/secure	You must share your password or root password with other users.
sudo	Y	Y	Y	Authenticates users against their own password rather than that of the target user.	/var/log/auth.log or /var/log/secure	Allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands.

See man pages for more information about su, sudo, gksu, and gksudo commands.

Sincerely,
nixCfraft

Tagged as: Linux, runuser command, su command, sudo command

8 comments

nixCraft Blog

Sort by Best

Favorite

gregf

•

3 years ago

Where does runuser come from? None of my boxes seem to have it.
4

•

Reply

•

Share ›

ScholesC

•

2 years ago

god doc :)
runuser is good ...
we can use it in script
#!/sbin/runuser username
1

•

Reply

•

Share ›

cpss454

•

a year ago

A caution about using runuser: Any command executed with runuser gets
placed in the background by default. This means multiple runuser
commands ran one after the other will each run in parallel. Use the -l
(minus el) option to force runuser to run the command inside a shel, and
thus wait for it to finish.
•

Reply

•

Share ›

cpss454

•

a year ago

Just a tip: When issuing the runuser command I usually use the -c
option, and I always use double quotes instead of single quotes around
the command to be ran. This allows me to use single quotes within the
double-quoted command to pass a quoted argument.
For example, the following will not work because of nested single quotes:
runuser -l fred -c 'find /foo/foobar -name '*.txt''
(two single quotes at the end of the line)
This example uses double quotes and it works fine:
runuser -l fred -c "find /foo/foobar -name '*.txt'"
(a double-quote before "find", single quotes around '*.txt' and a double quote at the end of the line)
If
you want to know WHY this works, the shell processes command lines with
double quotes twice. The first pass lets the interpreter know that
anything within double quotes is an argument and that any single quotes
within the double qutes are to be taken literally.
•

Reply

•

Share ›

Prasad

•

2 years ago

Best doc.
•

Reply

•

Share ›

Pierre B.

•

2 years ago

I personnaly use the su - -c as an administrator, but the sudo is a very handy tool for end-users when correctly configured.
•

Reply

•

Share ›