Questions[su](ubuntu)

I am reading some tutorials about Linux configurations:

• To accomplish many of the configurations is important and mandatory be the root.

Well I did realize that in many places are used sudo su and sudo -i, even when both accomplish the the same goal, I have the doubt about:

• when is mandatory use one approach over the other?

I am doing this question because for some reason exists these two approaches

GPG fails with gpg: problem with the agent: Permission denied when I invoke it after switching my user with su:

su - user2
gpg --symmetric --passphrase=foo foo.txt

If I invoke the command from my own user, it doesn't fail. Is there a workaround?

I found a thread a thread in their mailing list about it but it's unanswered. It speculates that the error is because:

the tty is owned by the original user I logged into via SSH, not the user I switched to via su

Is there someway to restrict su to a specific group of users?

Upon searching over the web, I came across IBM AIX's concept of sugroup. Whenever a user is created, attribute sugroup can be set; and only members of this group are allowed to su to that user.

sugroup can help me solve my problem by creating a group which contains only certain users allowed to su. Assigning sugroup means users outside this group are not permitted to be su-ed to by other users. But this concept of sugroup is not available in Ubuntu. How can it be achieved in Ubuntu?

I made following entry in /etc/pam.d/su:

auth required pam_wheel.so group=sulogin

I created following:

• a group called sulogin which is for users allowed to su
• users who don't belong to sulogin are user1 and user2
• users who do belong to sulogin are admin1 and admin2

Now when I am logged in as user1 and try to su to admin1 or admin2, I am not permitted to do so. This is as per my requirement. When I am logged in as user1 and try to su to user2, I am not permitted to do this. This is not as per my requirement (although my requirements were not clearly mentioned in the original question).

I need to restrict all the users who are not in group sulogin from su-ing to any user who belongs to sulogin group. Basically, 2 levels of su privilege. So in the above mentioned scenario:

• user1 should be able to su to user2 and vice-versa
• user1 or user2 should not be able to su to admin1 or admin2
• admin1 should be able to su to user1 or user2

I tried to su to root so I could install lights, but I get an authentication error when I try:

user@host:~$ su
Password: 
su: Authentication failure

What is the actual benefit that Ubuntu (or Debian derivatives) achieve by disabling root user?

Everywhere I read, it says to prevent unintentional damages for inexperienced users. I want to know what exactly, since sudo can execute all commands (that I know/use).

So in what case root can cause damage whereas sudo can't?

PS: I know how sudo works.