sudo and su both grant elevated privileges, but their models are genuinely different — and modern Linux security practice strongly favors one over the other for good reasons.
# su: switches to another user entirely (usually root), requires ROOT's password su - # Now you're a full root shell, indistinguishable from logging in as root directly # sudo: runs a SINGLE command as another user, using YOUR OWN password sudo apt update # Returns to your normal user immediately after the command finishes # sudo -i: an interactive root shell, but still logged/attributed to you sudo -i
Why sudo Is the Modern Default
- Auditability — every sudo command is logged with who ran it, not just “someone logged in as root”
- Granular permissions —
/etc/sudoerscan restrict a user to specific commands only, not full root access - No shared root password — each admin uses their own credentials, so revoking one person’s access doesn’t require rotating a shared secret
Many modern distros (Ubuntu notably) disable the root account’s password entirely by default, making su to root impossible unless you deliberately set one — sudo isn’t just preferred, it’s often the only path to elevated privileges at all.