9 
$cat /etc/passwd |grep -i root
root:x:0:0:root:/root:/bin/bash

$sudo cat /etc/shadow |grep -i root
root:!:17179:0:99999:7:::

In the second field of shadow file, ! means root user cannot login but why can I login to root user by sudo su?

Why can't I login to root user by su root or su -?

Improve this question
3
  • 1
    "In the second field of shadow file, ! means root user cannot login" No, it doesn't. Where did you hear that?
    – Lightness Races in Orbit
    Feb 12, 2017 at 13:26
  • @LightnessRacesinOrbit, what does it mean?
    – George Udosen
    Feb 12, 2017 at 14:48
  • @George: muru quoted the manual in his answer and explained it in detail. You should read documentation!
    – Lightness Races in Orbit
    Feb 12, 2017 at 14:50

2 Answers 2

Reset to default
15

An ! in the shadow entry's encrypted password field means that no password can authenticate against it. From man shadow:

If the password field contains some string that is not a valid
result of crypt(3), for instance ! or *, the user will not be able
to use a unix password to log in (but the user may log in the
system by other means).

As the manual says, this does not mean that you can't login as root. It just means that you can't login as root using a password for the root account. (You can login as root via SSH using SSH keys, for example, if you had configured it earlier, even if the account is locked.)

sudo normally authenticates with your password, not root's. This can be changed by setting one of targetpw, rootpw or runaspw in sudoers. If you set one these options, and try to use a password when the password is locked, that will fail.

Improve this answer
2
  • Great, it means i can switch to any user by sudo with my password either it is active user or lock user,right?
    – Sinoosh
    Feb 12, 2017 at 11:32
  • 1
    @Sinoosh assuming no other restrictions, yes
    – muru
    Feb 12, 2017 at 12:11
4

Now let's look at the commands accordingly:

  1. sudo su:

    • sudo runs the command su (substitute user) with root privileges so even if the /etc/shadow says or has root:!:17179:0:99999:7::: it will still run commands with root privileges.

  2. su - or su root:

    • This actually switches to the root user which from the /etc/shadow file can not log in so using these commands will not work. If you want them to work then the root account must be unlocked by giving it a password.

Summary:

su - 0r su root switches to user root, does not exist so it can't happen, but sudo su runs switch command with root privileges, so in this case it will go if you are in the sudo group. You're not actually logging in as root in this case, just acting as root so it will go.

Source: What is the difference between 'su -' and 'su root'?

Improve this answer
2
  • Thank you, It means sudo su does not see pass fields in shadow file?
    – Sinoosh
    Feb 12, 2017 at 10:32
  • 1
    @Sinoosh sudo su is the wrong way to run sudo sh or sudo bash.
    – Bakuriu
    Feb 12, 2017 at 11:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .