Loading...

VONDS ©

Lab 28: Switching Users and Sudo Access

Back to Lab Index

Practice privilege escalation the way it looks on a real host: run targeted commands with sudo, enter a root login shell, switch users with a full login environment, then verify sudo access through group membership.

users core security

Scenario

You are training a junior admin on switching users and using sudo correctly. The goal is to demonstrate safe escalation patterns: run a single privileged command, open a root login shell for multi-step work, create a temporary admin user, grant them sudo via the correct group, validate access, then clean everything up.

Operator context

The difference between I can run sudo and I understand privilege boundaries shows up in the command choices you make under pressure.

Objective

  • Run a privileged command with sudo.
  • Enter a root login shell using sudo -i.
  • Create a temporary user account.
  • Grant sudo access via group membership.
  • Switch into the new account with a full login environment using su -.
  • Prove sudo works with sudo whoami and clean up with userdel -r.

Concepts

  • Use sudo for single commands when possible. A full root shell increases blast radius if you mistype.
  • A root login shell via sudo -i matters because it loads root’s login environment, not just a root UID.
  • Group-based sudo is common. The allowed group name varies by distro family, so you verify group membership and then verify behavior.
  • Switching users with su - loads the target user’s login environment, which affects PATH and profile behavior.

Walkthrough

Step 1 : Run a single privileged command.
Command 
sudo ls /root

Use sudo for one-off privileged commands. It limits blast radius and keeps a clean audit trail. 

[sudo] password for lab:
file1.txt  backup.tar.gz
Step 2 : Open a root login shell for multi-step work.
Command 
sudo -i

sudo -i simulates a root login shell. Use it when you have several admin tasks to perform and want consistent root environment behavior.

Step 3 : Create a temporary user for sudo testing.
Command 
useradd tempsudo

Creating a temporary account is a safe way to validate group rules and sudo policy without touching production users.

Step 4 : Set a password for the new user.
Command 
passwd tempsudo

This makes the account usable for su - and for interactive sudo prompts.

Step 5 : Grant sudo via group membership.
Operator note

The privileged group name differs by distro family. Use the appropriate command for your host, then verify.

Command 
usermod -aG sudo tempsudo
Command 
usermod -aG wheel tempsudo

Group membership is not the same as effective capability. You still prove behavior with an actual sudo command.

Step 6 : Exit the root login shell back to the regular user.
Command 
exit

Dropping back to an unprivileged context is part of clean operational discipline.

Step 7 : Switch to the new user with a full login environment.
Command 
su - tempsudo

su - loads the target user’s login environment, which matters when you are testing PATH, profiles, and group membership behavior.

Step 8 : Prove sudo works from the new account.
Command 
sudo whoami

This is the quick identity proof. If sudo is working, the output should be root. 

root
Step 9 : Clean up the temporary user and home directory.
Command 
sudo userdel -r tempsudo

Always remove training accounts and test access once verification is complete.

Breakpoints

Sudo still fails after group change

Group membership may not apply to an existing session. Re-enter a full login session with su -, or log out and back in, then test again with sudo whoami.

Root shell confusion

If you used sudo -i and forget you are root, you may accidentally run risky commands. Confirm identity with whoami before changes, and exit back to a normal shell when you are done.

Cleanup checklist

  • Confirm the test account is gone.
  • Confirm there are no remaining processes owned by the test account.
Commands 
getent passwd tempsudo
ps -u tempsudo

Reference

  • sudo: Run commands with elevated privileges.
  • sudo -i: Start a root login shell.
    • -i: Use a login shell environment.
  • su: Switch user.
  • su -: Switch user with a full login environment.
    • -: Load the target user’s login environment.
  • useradd: Create a user account.
  • passwd: Set or change a user password.
  • usermod: Modify a user account.
    • -a: Append to supplementary groups.
    • -G: Set supplementary groups.
  • userdel: Delete a user account.
  • userdel -r: Delete a user and remove their home directory.
    • -r: Remove home directory and mail spool.
  • whoami: Print effective username.
  • ls: List directory contents.
  • /root: Root user’s home directory.
  • getent: Query system databases.
  • ps: List processes.