VMware ESXi and vSphere Cluster Management

The Root Account in Linux

Learn what the Linux root account is, how UID 0 differs from ordinary users, and how to use su and sudo safely for administration.

The root account is Linux's special administrative account. It has the conventional username root and the numeric user ID 0. Root is also called the superuser. An administrator may be a person who manages a system, while root is the highly privileged user identity used to perform system-level operations.

Root is not simply an ordinary account with a longer list of permissions. Linux generally allows the root identity to bypass normal discretionary access restrictions. This means root can usually read, modify, delete, or execute protected resources, including files that ordinary users cannot access.

To check the identity of the current shell, use:

whoami
id -u

whoami displays the effective username. The output of id -u is 0 for root. A non-root user normally has a different numeric UID.

What root can do

Root can generally access system commands, configuration files, services, device controls, and user data. Typical administrative tasks include:

• Installing and removing software with the distribution's package-management tools.
• Converting or managing packages when the distribution provides tools for those operations.
• Changing file ownership and permissions.
• Creating, removing, locking, and otherwise managing user accounts.
• Editing protected system configuration files.
• Starting, stopping, and configuring system services.
• Configuring network interfaces and other system devices.

The exact commands vary by distribution. For example, one Linux distribution may use one package manager while another uses a different one. The privilege requirement is the important concept: changing system-wide resources normally requires root or an authorized mechanism that temporarily acts as root.

Ordinary users and root

An ordinary user is a non-root account intended for routine work. Browsing the web, editing documents, writing code, and using normal desktop applications should usually happen from this account. Administrative commands should be run only when a particular task needs them.

When an ordinary user attempts to change a protected system resource, Linux normally rejects the operation with a permission or authorization error. This separation is a security boundary. If an application or command contains a mistake while running as an ordinary user, its ability to damage the operating system is more limited. The same application running with root privileges could alter system files, expose data, or damage the entire installation.

Why operating as root is risky

A command that is harmless in one directory or on one file can be destructive when run with root privileges. A mistyped path, an incorrect option, or a command that was not fully understood can cause:

• Accidental deletion of system files or user data.
• Incorrect ownership or permissions that prevent services or users from working.
• Damage to configuration files that stops the system from booting or networking correctly.
• Security exposure caused by making sensitive files readable or services unnecessarily accessible.

Use a privileged session only for the required task and duration. Before pressing Enter, verify the command, options, file paths, device names, and target account. When possible, inspect a command's effect without elevation first, and use the least privilege needed.

Privilege escalation

Privilege escalation means temporarily obtaining permissions greater than those of the current user to perform an administrative task. Linux commonly provides two command-line approaches: su and sudo. They do not have identical behavior or security policies.

Using su to switch users

su means “switch user.” It starts a shell under another user's identity, or runs a specified command as that identity. Without an account name, it commonly targets root.

The command below requests a login-style root shell:

su -

The hyphen asks for a login-style environment. This makes the shell behave more like a fresh login by setting the target user's environment and working directory appropriately. A root shell is persistent: commands entered afterward continue to run with root privileges until the shell ends.

Using su to become root normally requires knowing the root account's password. Once the administrative work is complete, leave the elevated shell with:

exit

Organizations may restrict direct root shells or discourage them in favor of per-command authorization. On systems where the root password is unavailable or locked, su - may fail even though authorized administrators can still use sudo.

Using sudo for one command

sudo runs a selected command with another identity's privileges, normally root, when the system policy allows it. For example:

sudo command

In typical configurations, sudo asks for the invoking user's password rather than the root password. The account must also be authorized by sudo policy. Authorization is commonly controlled through /etc/sudoers, files in /etc/sudoers.d/, or membership in an administrative group.

Use sudo for a single administrative command when possible. It narrows the privileged scope and avoids leaving an entire terminal session in a root shell. Sudo activity may be logged, depending on the system configuration.

To validate or refresh sudo authentication without running a separate administrative command, use:

sudo -v

Never edit sudo policy casually with a normal text editor. The visudo command checks the syntax and helps prevent a malformed policy from locking administrators out:

sudo visudo

Policy may be stored in /etc/sudoers and included files under /etc/sudoers.d/. Only an authorized administrator should change these files.

Example: changing a network interface

A network interface is a system network device, such as an Ethernet or Wi-Fi device. Bringing an interface down changes system networking and normally requires administrative authorization.

First identify the actual interface names on the machine:

ip link show

Older examples often use eth0. Modern systems may instead use names such as enp0s3 or ens33. Substitute the name reported by your system.

This example attempts to disable an interface as an ordinary user:

ip link set eth0 down

If the shell is unprivileged, the command should fail with a permission-denied or operation-not-permitted message. The failure is expected because network administration is protected.

An authorized user can perform the same targeted operation with sudo:

sudo ip link set eth0 down

Authenticate if prompted, and replace eth0 with the real interface name. This example can disconnect the machine from the network, so use it only on a test system or when you intentionally need to disable that interface.

Distribution-specific root behavior

Linux distributions make different choices about the root password and direct root login. Some permit an administrator to set a root password and use it with su. Others leave the root password locked by default and expect authorized users to administer the system through sudo.

A locked root password does not remove the root account. It prevents password-based direct root authentication, including the usual password-based su-to-root flow, unless an administrator explicitly changes that state. Ubuntu commonly delegates administrative access through sudo instead.

Troubleshooting privilege problems

Permission denied during a network change

If a normal user receives “permission denied” or “operation not permitted” while changing an interface, the operation requires administrative privileges. Use sudo if the account is authorized, or ask the system administrator for access.

Sudo says the user is not allowed

This usually means the account has no matching sudo policy or is not a member of the required administrative group. An authorized administrator should review the sudoers policy or group assignment. Do not bypass the access controls.

su - fails on Ubuntu-style systems

The root password may be locked by default. This is expected behavior, not necessarily a system failure. Use sudo for authorized administrative commands rather than assuming that direct password-based root login must be enabled.

The interface name does not exist

If a command using eth0 reports that the device does not exist, run ip link show and use the interface name shown by the system. Predictable interface naming commonly produces names such as enp0s3 or ens33.

You remain in a root shell

If you used su -, the elevated shell remains active until you leave it. Run:

exit

Then confirm that your normal account is active with whoami or id -u.

Sudo does not elevate shell expansion or redirection

Sudo elevates the command process; it does not automatically turn the invoking shell into a root shell. Shell features such as expansion and output redirection may be processed before sudo runs the command. For example, a redirection performed by the ordinary shell may still fail when writing to a protected file.

Use an appropriate privileged command structure for the specific operation, and verify it carefully. Do not use a broad root shell merely to avoid understanding which part of a command needs elevation.

Good administrative habits

• Use a normal account for browsing, editing documents, and other ordinary work.
• Use sudo only when the task actually needs elevated access.
• Use the least privilege needed for the task.
• Do not enable or share root credentials unnecessarily.
• Understand a command before running it with root privileges.
• Verify paths, options, usernames, device names, and destinations.
• Keep privileged sessions limited to the required task and duration.
• End an elevated shell with exit as soon as the work is complete.

Quick decision guide

1. If the task is routine, stay with the ordinary user account.
2. If one command needs administration, prefer sudo command.
3. If a complete root environment is genuinely required and permitted, use su -.
4. Check the command and its targets before execution.
5. After a root shell task, run exit and return to normal work.

For the related foundation, see Linux root account and privilege management.