How to su to Another User in Linux (and Without a Password)

Updated: 12 October 2026 · Applies to: su from util-linux 2.41 on Ubuntu 26.04 (with sudo-rs 0.2.13) and Debian 13 (with sudo 1.9.16), su from util-linux 2.40 on AlmaLinux 10.2 (with sudo 1.9.17); the same commands work on Rocky Linux, RHEL and Ubuntu 24.04

To switch to another user in Linux, run su - username and type that user's password; type exit to return to your own account. Root can su to any user without a password. If you have sudo rights, sudo -iu username does the same with your own password. To let one user switch to a service account (for example postgres) without any password, add a sudoers rule (section 4) or a PAM rule for su (section 5).

1. su to another user

su - alice                  # log in as alice: her home folder, PATH and environment
su alice                    # become alice but stay in the current folder
su - alice -c 'whoami'      # run one command as alice
su -                        # become root (needs the root password)

The dash matters. As root on our test server:

# su - alice -c 'whoami; pwd'
alice
/home/alice
# su alice -c 'whoami; pwd'
alice
/root

More on this in the difference between su and su with a hyphen. A normal user is asked for the target user's password (Password:), not their own.

2. su error messages

• su: Authentication failure: wrong password, or the target account has no password at all. Service accounts such as postgres are usually locked (sudo passwd -S postgres shows L), and so is root on Ubuntu: according to Ubuntu's server documentation, the root account is disabled by default. Use sudo instead (section 3).
• This account is currently not available. The account's shell is /usr/sbin/nologin, as for www-data. As root, give it a shell for this one session: su -s /bin/bash www-data, or use sudo -u www-data bash.
• su: user nosuchuser does not exist or the user entry does not contain all the required fields: check the name with getent passwd nosuchuser.
• su: Permission denied after a correct password (AlmaLinux, Rocky Linux, RHEL): su is limited to the wheel group (section 6).

3. su as another user with sudo

If your account is allowed to use sudo (see add a user to sudo on Debian or add a user to the wheel group), you type your own password instead of the other user's:

sudo -iu postgres            # login shell as postgres
sudo -u postgres whoami      # one command as postgres
sudo -i                      # root shell
sudo su - postgres           # also works, but takes a detour through su

As root, runuser -u alice -- whoami or runuser -l alice -c 'whoami' runs a command as another user without any password prompt. According to its manual, runuser can only be used by root, which is why it never asks for a password.

4. Without a password: a sudoers rule (recommended)

1. Create a rule file with sudo visudo -f /etc/sudoers.d/50-jarvis and add one line. This lets the user jarvis act as postgres, and only as postgres, without a password:

   jarvis ALL=(postgres) NOPASSWD: ALL

2. Check the files: sudo visudo -c should answer parsed OK.
3. As jarvis, switch with sudo -iu postgres. On our servers it opened a postgres shell without a prompt, and sudo -l listed (postgres) NOPASSWD: ALL. sudo -iu alice was still refused.

If your team is used to typing sudo su - postgres, this rule allows exactly that command:

jarvis ALL=(root) NOPASSWD: /usr/bin/su - postgres

sudo compares the arguments exactly: sudo su - postgres worked, but sudo su postgres and sudo su - postgres -c whoami were refused. Writing /bin/su instead of /usr/bin/su made no difference with sudo 1.9.16 or sudo-rs 0.2.13, because /bin is a link to /usr/bin on current systems. The first rule is still the better one: it never runs anything as root. For more on NOPASSWD, see how to run sudo without a password; if sudo stops working after an edit, see how to fix a broken sudoers file.

5. Without a password: a PAM rule for su

This keeps the plain su - postgres command and lets every member of the group postgres switch to the postgres account without a password.

1. Back up the file: sudo cp /etc/pam.d/su /root/su.pam.bak
2. Edit /etc/pam.d/su and add two lines directly below auth sufficient pam_rootok.so:

   auth  [success=ignore default=1] pam_succeed_if.so user = postgres
   auth  sufficient pam_succeed_if.so use_uid user ingroup postgres

   The first line checks whether the target user is postgres; if not, it skips the next line and su asks for a password as usual. The second line lets the request through when the calling user (use_uid) is in the group postgres.
3. Add the user to the group: sudo usermod -aG postgres jarvis
4. Test it as jarvis:

   $ su - postgres -c 'whoami; pwd'
   postgres
   /var/lib/postgresql

We tested this on Ubuntu 26.04, Debian 13 and AlmaLinux 10. jarvis still had to type a password for su - alice, and a user outside the group got su: Authentication failure for su - postgres. Keep the group small: every member can become postgres, and members also get whatever access files give to the group postgres.

6. Limit su to administrators (AlmaLinux, Rocky Linux, RHEL)

/etc/pam.d/su on AlmaLinux 10 contains this line, commented out:

#auth		required	pam_wheel.so use_uid

Remove the # and only members of the wheel group can use su. In our test, a user outside wheel typed the correct password and got su: Permission denied; after sudo usermod -aG wheel jarvis the same command worked.

To change a user's login shell rather than switch for a moment, see how to change the default shell in Linux.

Official documentation: su manual, runuser manual, pam_succeed_if manual and Ubuntu user management.