First it should be noted that by using su ubuntu
one would end up using the current user's environment, while what one usually wants to do is to use the target user's environment; so sudo - ubuntu
would be the way to go.
However, su
is not documented enough, but the fact that to login as an user which has no password is not allowed is probably just su
's policy.
To get the equivalent of su - ubuntu
, which would be an interactive login shell as the user ubuntu, one might be tempted to run sudo su - ubuntu
, which wouldn't prompt for a password; however this would be just redundant, since sudo
itself provide this functionality on its own; using sudo su - ubuntu
to get an interactive login shell as the user ubuntu would be exactly the same as running a script A which runs a script B in order to just run the script B.
So, to run an interactive login shell as the user ubuntu, just use sudo
:
sudo -i -u ubuntu
From the sudo
manpage for Trusty:
[...]
-i, --login
Run the shell specified by the target user's password
database entry as a login shell. This means that login-
specific resource files such as .profile or .login will be
read by the shell. If a command is specified, it is passed
to the shell for execution via the shell's -c option. If no
command is specified, an interactive shell is executed. sudo
attempts to change to that user's home directory before
running the shell. The command is run with an environment
similar to the one a user would receive at log in. The
Command Environment section in the sudoers(5) manual
documents how the -i option affects the environment in which
a command is run when the sudoers policy is in use.
[...]
-u user, --user=user
Run the command as a user other than the default target user
(usually root ). The user may be either a user name or a
numeric user ID (UID) prefixed with the ‘#’ character (e.g.
#0 for UID 0). When running commands as a UID, many shells
require that the ‘#’ be escaped with a backslash (‘\’). Some
security policies may restrict UIDs to those listed in the
password database. The sudoers policy allows UIDs that are
not in the password database as long as the targetpw option
is not set. Other security policies may not support this.
[...]
su
andsudo
, not the password of the user you want to become, I think. This probably requires the current user to be in the sudoers group though.