su
become another usersu — substitute user — starts a shell as someone else. With no name it means root. It asks for the target account’s password, not yours, which is the main way it differs from sudo.
su asks for their password; sudo asks for yours.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
Nothing is shown as you type. You must know deploy’s password — yours will not do.
Every command from here runs with that account’s permissions.
With "su -" you land in the target’s home directory with their environment. Without it you keep your own directory and variables.
The substitute shell ends and you are back in your own, as yourself.
Switches
A switch changes how the command behaves. These are the ones used day to day; man su lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-- Start a login shell: the target’s environment and home directory. Also written -l.
-c COMMAND- Run one command as the target user, then return.
-s SHELL- Use this shell instead of the target’s default.
-p- Preserve your current environment.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
su -Becomes root with a full login environment.
su -c "systemctl restart nginx"Runs one command as root and returns.
sudo su - postgresBecomes a service account using your own sudo rights.
sudo -iA root login shell through sudo — no root password needed.
In cybersecurity
su works by sharing a password between everyone who needs the account.
With su, every administrator knows the root password and the log shows only "root". With sudo each person uses their own password and each command is logged against their name.
Plain "su" keeps your PATH and environment. A PATH containing a directory you can write to, carried into a root shell, is a known way to be tricked.
Failed and successful su attempts are written to the auth log. Repeated failures against root are worth an alert.