Switching users with su and setting passwords

su: substitute user

su starts a new shell as another user. With no argument it means root; with a name it means that user. Normally you must type the target's password, but root may become anyone without one, which is why, as root in the lab, su bob just works. When you are done, exit returns you to the shell you came from: su does not *change* your session, it nests a new one inside it.

The lone dash matters. su bob keeps your current directory and most of your environment; you are bob, but standing in root's folder with root's variables. su - bob (or su -l bob) is a login shell: it clears the environment, moves to bob's home and reads his profile, exactly as if bob had logged in. For testing "what does bob see" the dash form is the honest one. For a one-off command, -c runs it and comes straight back: su bob -c 'id'.

~% su bob -c whoami
bob
~% su bob -c 'touch /tmp/from-bob.txt; ls -l /tmp/from-bob.txt'
-rw-r--r--    1 bob      bob              0 Oct  4 18:53 /tmp/from-bob.txt
~% su bob -c 'cat /root/notes.txt'
cat: can't open '/root/notes.txt': Permission denied
~% su bob
/root $ whoami
bob
/root $ exit
~%

That Permission denied is the whole point of users: /root is drwx------, so bob cannot even look inside. The file bob created in /tmp belongs to bob, not to the root shell that launched su. This is how you test permissions without a second keyboard.

passwd: set, lock, unlock

passwd changes your own password; passwd bob changes bob's, something only root may do. It asks twice and writes a salted hash into /etc/shadow. Three flags manage the account state without knowing the password: -l locks it by putting ! in front of the hash, -u unlocks it by removing the !, and -d deletes it, leaving the field empty so no password is needed. BusyBox refuses very short passwords with Bad password: too short, which is a feature.

~% passwd bob
Changing password for bob
New password: 
Retype password: 
passwd: password for bob changed by root
~% grep '^bob:' /etc/shadow | cut -c1-24
bob:$1$yQpzV8RS$NpjS7F2
~% passwd -l bob
passwd: password for bob changed by root
~% grep '^bob:' /etc/shadow | cut -d: -f2 | cut -c1-3
!$1