Snort question

[Talith]

Oh ok, I thought the su account was root, thanks for the clarification!

[spurious_inode]

The old misconception about su is that it stands for 'Super User'. This is false, it in fact
stands for 'Substitue User'.

[Talith]

Interesting little tidbit, and so if it's left blank then it assumes root? Is that how it works?

[spurious_inode]

Well, I should probably clarify a bit since this is an important and often misunderstood command...

The default user for the su command is root, on many systems su simply changes your effective
user ID and effective group ID (euid, egid) to that of the user root, or whatever user was specified
on the command line. Without the - argument, your privileges are modified to the new user, but all
your environemnt variables (.login, .cshrc, .kshrc, $PATH, $HOME, $MANPATH, etc.) remain the
same as they were under your previous login.

Providing the - argument actually makes a call to /bin/login and behaves as if you had done a full
login to the system as that user. My guess is that you are using RedHat (Fedora) by the fact that /sbin
and /usr/sbin were not in your $PATH when you just did an 'su', and not 'su -' (regular users do not
have either /sbin or /usr/sbin in their $PATH on newer RH versions). Hopefully the above explanation
clears this up a little for you.

[Talith]

Actually, I'm on SuSE 9.0 PRO, but yes, that did clarify a lot up for me, much thanks for your patience in answering my questions spurious_inode!

[spurious_inode]

Happy to have helped, and SuSE 9.0 is a wonderful Linux Distro.

[Talith]

That's for sure, SuSE 8.2 was my first Linux distro that I got, and I just love SuSE so much, so easy to move around, configure, install, etc... Last post in this thread, I promise!

[qod]

it basically loads the root profile, if you have not done that then you might run into things like command like found, etc...