Question about login logs using “sudo su - username”?
While doing my Linux training I found this curiosity:
If I do "sudo su - username" and log into that username account, it doesn't count as login when I do "finger username"
Take this image where "jonathan" it's me (current user) and alumne2 is another account I created to test basic commands on it.
Why it doesn't show up the last logging (finger alumne2) if from jonathan I "log in" as "sudo su - alumne2"?
linux command learning
edited 6 mins ago
Rui F Ribeiro
39.5k1479132
asked Nov 30 '18 at 16:06
WhiteGloveWhiteGlove
124
add a comment |
While doing my Linux training I found this curiosity:
If I do "sudo su - username" and log into that username account, it doesn't count as login when I do "finger username"
Take this image where "jonathan" it's me (current user) and alumne2 is another account I created to test basic commands on it.
Why it doesn't show up the last logging (finger alumne2) if from jonathan I "log in" as "sudo su - alumne2"?
linux command learning
edited 6 mins ago
Rui F Ribeiro
39.5k1479132
asked Nov 30 '18 at 16:06
WhiteGloveWhiteGlove
124
1
Neithersudonorsuare login programs. That's why they don't show up in the "last login" output; you're not logging in as that user; you're assuming that user's identity... a different function, entirely.
– Stephen Harris
Nov 30 '18 at 16:09
So you access an account but don't log in? Can you explain me that in a solution? Thanks
– WhiteGlove
Nov 30 '18 at 16:10
Related: Is there ever a good reason to run sudo su?
– Kusalananda
Nov 30 '18 at 16:52
1
Please, don't post images of text.
– Kusalananda
Nov 30 '18 at 16:53
add a comment |
While doing my Linux training I found this curiosity:
If I do "sudo su - username" and log into that username account, it doesn't count as login when I do "finger username"
Take this image where "jonathan" it's me (current user) and alumne2 is another account I created to test basic commands on it.
Why it doesn't show up the last logging (finger alumne2) if from jonathan I "log in" as "sudo su - alumne2"?
linux command learning
edited 6 mins ago
Rui F Ribeiro
39.5k1479132
asked Nov 30 '18 at 16:06
WhiteGloveWhiteGlove
124
While doing my Linux training I found this curiosity:
If I do "sudo su - username" and log into that username account, it doesn't count as login when I do "finger username"
Take this image where "jonathan" it's me (current user) and alumne2 is another account I created to test basic commands on it.
Why it doesn't show up the last logging (finger alumne2) if from jonathan I "log in" as "sudo su - alumne2"?
linux command learning
linux command learning
edited 6 mins ago
Rui F Ribeiro
39.5k1479132
asked Nov 30 '18 at 16:06
WhiteGloveWhiteGlove
124
edited 6 mins ago
Rui F Ribeiro
39.5k1479132
asked Nov 30 '18 at 16:06
WhiteGloveWhiteGlove
124
edited 6 mins ago
Rui F Ribeiro
39.5k1479132
edited 6 mins ago
Rui F Ribeiro
39.5k1479132
edited 6 mins ago
Rui F Ribeiro
39.5k1479132
39.5k1479132
asked Nov 30 '18 at 16:06
WhiteGloveWhiteGlove
124
asked Nov 30 '18 at 16:06
WhiteGloveWhiteGlove
124
asked Nov 30 '18 at 16:06
WhiteGloveWhiteGlove
124
124
1
Neithersudonorsuare login programs. That's why they don't show up in the "last login" output; you're not logging in as that user; you're assuming that user's identity... a different function, entirely.
– Stephen Harris
Nov 30 '18 at 16:09
So you access an account but don't log in? Can you explain me that in a solution? Thanks
– WhiteGlove
Nov 30 '18 at 16:10
Related: Is there ever a good reason to run sudo su?
– Kusalananda
Nov 30 '18 at 16:52
1
Please, don't post images of text.
– Kusalananda
Nov 30 '18 at 16:53
add a comment |
1
Neithersudonorsuare login programs. That's why they don't show up in the "last login" output; you're not logging in as that user; you're assuming that user's identity... a different function, entirely.
– Stephen Harris
Nov 30 '18 at 16:09
So you access an account but don't log in? Can you explain me that in a solution? Thanks
– WhiteGlove
Nov 30 '18 at 16:10
Related: Is there ever a good reason to run sudo su?
– Kusalananda
Nov 30 '18 at 16:52
1
Please, don't post images of text.
– Kusalananda
Nov 30 '18 at 16:53
1
1
Neither
sudo nor su are login programs. That's why they don't show up in the "last login" output; you're not logging in as that user; you're assuming that user's identity... a different function, entirely.– Stephen Harris
Nov 30 '18 at 16:09
Neither
sudo nor su are login programs. That's why they don't show up in the "last login" output; you're not logging in as that user; you're assuming that user's identity... a different function, entirely.– Stephen Harris
Nov 30 '18 at 16:09
So you access an account but don't log in? Can you explain me that in a solution? Thanks
– WhiteGlove
Nov 30 '18 at 16:10
So you access an account but don't log in? Can you explain me that in a solution? Thanks
– WhiteGlove
Nov 30 '18 at 16:10
Related: Is there ever a good reason to run sudo su?
– Kusalananda
Nov 30 '18 at 16:52
Related: Is there ever a good reason to run sudo su?
– Kusalananda
Nov 30 '18 at 16:52
1
1
Please, don't post images of text.
– Kusalananda
Nov 30 '18 at 16:53
Please, don't post images of text.
– Kusalananda
Nov 30 '18 at 16:53
add a comment |
2 Answers
2
active
oldest
votes
There are multiple ways of gaining access to a user account; for example you may login on a console, or ssh to a server, or ftp to get files, or have a cron job or...
Not all of these methods are considered "login".
sudo and su are ways of assuming an account identity, but neither of these are considered login methods.
So if you do a finger or last or look at the lastlogin records then you may not see activity under that account being reported there.
You may only see it in things like /var/log/auth.log (exact file name will depend on your OS).
answered Nov 30 '18 at 16:14
Stephen HarrisStephen Harris
25.4k24477
I tested that and you are right! For a moment I thought I discovered some flaw in security.
– WhiteGlove
Dec 1 '18 at 15:55
add a comment |
As stated by Stephen Harris in the comments, su is not a login command. Rather, you are substituting your shells current identity with another one.
This is nicely explained in OpenBSD's man page for su.
The su utility allows a user to run a shell with the user and group ID
of another user without having to log out and in as that other user.
By default, the environment is unmodified with the exception of
LOGNAME, HOME, SHELL, and USER. HOME and SHELL are set to the target
login's default values. LOGNAME and USER are set to the target login,
unless the target login has a user ID of 0 and the -l flag was not
specified, in which case it is unmodified. The invoked shell is the
target login's. This is the traditional behavior of su.
answered Nov 30 '18 at 16:15
PeschkePeschke
2,523924
It's an augmentation rather than a substitution, as the original account remains available. jdebp.eu./FGA/dont-abuse-su-for-dropping-privileges.html
– JdeBP
Dec 1 '18 at 10:52
Thanks a lot for the info, I will take a look!
– WhiteGlove
Dec 1 '18 at 15:53
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f485187%2fquestion-about-login-logs-using-sudo-su-username%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
There are multiple ways of gaining access to a user account; for example you may login on a console, or ssh to a server, or ftp to get files, or have a cron job or...
Not all of these methods are considered "login".
sudo and su are ways of assuming an account identity, but neither of these are considered login methods.
So if you do a finger or last or look at the lastlogin records then you may not see activity under that account being reported there.
You may only see it in things like /var/log/auth.log (exact file name will depend on your OS).
answered Nov 30 '18 at 16:14
Stephen HarrisStephen Harris
25.4k24477
I tested that and you are right! For a moment I thought I discovered some flaw in security.
– WhiteGlove
Dec 1 '18 at 15:55
add a comment |
There are multiple ways of gaining access to a user account; for example you may login on a console, or ssh to a server, or ftp to get files, or have a cron job or...
Not all of these methods are considered "login".
sudo and su are ways of assuming an account identity, but neither of these are considered login methods.
So if you do a finger or last or look at the lastlogin records then you may not see activity under that account being reported there.
You may only see it in things like /var/log/auth.log (exact file name will depend on your OS).
answered Nov 30 '18 at 16:14
Stephen HarrisStephen Harris
25.4k24477
I tested that and you are right! For a moment I thought I discovered some flaw in security.
– WhiteGlove
Dec 1 '18 at 15:55
add a comment |
There are multiple ways of gaining access to a user account; for example you may login on a console, or ssh to a server, or ftp to get files, or have a cron job or...
Not all of these methods are considered "login".
sudo and su are ways of assuming an account identity, but neither of these are considered login methods.
So if you do a finger or last or look at the lastlogin records then you may not see activity under that account being reported there.
You may only see it in things like /var/log/auth.log (exact file name will depend on your OS).
answered Nov 30 '18 at 16:14
Stephen HarrisStephen Harris
25.4k24477
There are multiple ways of gaining access to a user account; for example you may login on a console, or ssh to a server, or ftp to get files, or have a cron job or...
Not all of these methods are considered "login".
sudo and su are ways of assuming an account identity, but neither of these are considered login methods.
So if you do a finger or last or look at the lastlogin records then you may not see activity under that account being reported there.
You may only see it in things like /var/log/auth.log (exact file name will depend on your OS).
answered Nov 30 '18 at 16:14
Stephen HarrisStephen Harris
25.4k24477
answered Nov 30 '18 at 16:14
Stephen HarrisStephen Harris
25.4k24477
answered Nov 30 '18 at 16:14
Stephen HarrisStephen Harris
25.4k24477
answered Nov 30 '18 at 16:14
Stephen HarrisStephen Harris
25.4k24477
25.4k24477
I tested that and you are right! For a moment I thought I discovered some flaw in security.
– WhiteGlove
Dec 1 '18 at 15:55
add a comment |
I tested that and you are right! For a moment I thought I discovered some flaw in security.
– WhiteGlove
Dec 1 '18 at 15:55
I tested that and you are right! For a moment I thought I discovered some flaw in security.
– WhiteGlove
Dec 1 '18 at 15:55
I tested that and you are right! For a moment I thought I discovered some flaw in security.
– WhiteGlove
Dec 1 '18 at 15:55
add a comment |
As stated by Stephen Harris in the comments, su is not a login command. Rather, you are substituting your shells current identity with another one.
This is nicely explained in OpenBSD's man page for su.
The su utility allows a user to run a shell with the user and group ID
of another user without having to log out and in as that other user.
By default, the environment is unmodified with the exception of
LOGNAME, HOME, SHELL, and USER. HOME and SHELL are set to the target
login's default values. LOGNAME and USER are set to the target login,
unless the target login has a user ID of 0 and the -l flag was not
specified, in which case it is unmodified. The invoked shell is the
target login's. This is the traditional behavior of su.
answered Nov 30 '18 at 16:15
PeschkePeschke
2,523924
It's an augmentation rather than a substitution, as the original account remains available. jdebp.eu./FGA/dont-abuse-su-for-dropping-privileges.html
– JdeBP
Dec 1 '18 at 10:52
Thanks a lot for the info, I will take a look!
– WhiteGlove
Dec 1 '18 at 15:53
add a comment |
As stated by Stephen Harris in the comments, su is not a login command. Rather, you are substituting your shells current identity with another one.
This is nicely explained in OpenBSD's man page for su.
The su utility allows a user to run a shell with the user and group ID
of another user without having to log out and in as that other user.
By default, the environment is unmodified with the exception of
LOGNAME, HOME, SHELL, and USER. HOME and SHELL are set to the target
login's default values. LOGNAME and USER are set to the target login,
unless the target login has a user ID of 0 and the -l flag was not
specified, in which case it is unmodified. The invoked shell is the
target login's. This is the traditional behavior of su.
answered Nov 30 '18 at 16:15
PeschkePeschke
2,523924
It's an augmentation rather than a substitution, as the original account remains available. jdebp.eu./FGA/dont-abuse-su-for-dropping-privileges.html
– JdeBP
Dec 1 '18 at 10:52
Thanks a lot for the info, I will take a look!
– WhiteGlove
Dec 1 '18 at 15:53
add a comment |
As stated by Stephen Harris in the comments, su is not a login command. Rather, you are substituting your shells current identity with another one.
This is nicely explained in OpenBSD's man page for su.
The su utility allows a user to run a shell with the user and group ID
of another user without having to log out and in as that other user.
By default, the environment is unmodified with the exception of
LOGNAME, HOME, SHELL, and USER. HOME and SHELL are set to the target
login's default values. LOGNAME and USER are set to the target login,
unless the target login has a user ID of 0 and the -l flag was not
specified, in which case it is unmodified. The invoked shell is the
target login's. This is the traditional behavior of su.
answered Nov 30 '18 at 16:15
PeschkePeschke
2,523924
As stated by Stephen Harris in the comments, su is not a login command. Rather, you are substituting your shells current identity with another one.
This is nicely explained in OpenBSD's man page for su.
The su utility allows a user to run a shell with the user and group ID
of another user without having to log out and in as that other user.
By default, the environment is unmodified with the exception of
LOGNAME, HOME, SHELL, and USER. HOME and SHELL are set to the target
login's default values. LOGNAME and USER are set to the target login,
unless the target login has a user ID of 0 and the -l flag was not
specified, in which case it is unmodified. The invoked shell is the
target login's. This is the traditional behavior of su.
answered Nov 30 '18 at 16:15
PeschkePeschke
2,523924
answered Nov 30 '18 at 16:15
PeschkePeschke
2,523924
answered Nov 30 '18 at 16:15
PeschkePeschke
2,523924
answered Nov 30 '18 at 16:15
PeschkePeschke
2,523924
2,523924
It's an augmentation rather than a substitution, as the original account remains available. jdebp.eu./FGA/dont-abuse-su-for-dropping-privileges.html
– JdeBP
Dec 1 '18 at 10:52
Thanks a lot for the info, I will take a look!
– WhiteGlove
Dec 1 '18 at 15:53
add a comment |
It's an augmentation rather than a substitution, as the original account remains available. jdebp.eu./FGA/dont-abuse-su-for-dropping-privileges.html
– JdeBP
Dec 1 '18 at 10:52
Thanks a lot for the info, I will take a look!
– WhiteGlove
Dec 1 '18 at 15:53
It's an augmentation rather than a substitution, as the original account remains available. jdebp.eu./FGA/dont-abuse-su-for-dropping-privileges.html
– JdeBP
Dec 1 '18 at 10:52
It's an augmentation rather than a substitution, as the original account remains available. jdebp.eu./FGA/dont-abuse-su-for-dropping-privileges.html
– JdeBP
Dec 1 '18 at 10:52
Thanks a lot for the info, I will take a look!
– WhiteGlove
Dec 1 '18 at 15:53
Thanks a lot for the info, I will take a look!
– WhiteGlove
Dec 1 '18 at 15:53
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f485187%2fquestion-about-login-logs-using-sudo-su-username%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Neither
sudonorsuare login programs. That's why they don't show up in the "last login" output; you're not logging in as that user; you're assuming that user's identity... a different function, entirely.– Stephen Harris
Nov 30 '18 at 16:09
So you access an account but don't log in? Can you explain me that in a solution? Thanks
– WhiteGlove
Nov 30 '18 at 16:10
Related: Is there ever a good reason to run sudo su?
– Kusalananda
Nov 30 '18 at 16:52
1
Please, don't post images of text.
– Kusalananda
Nov 30 '18 at 16:53