Issue
In my linux system i have two sudo users and another root. When i want to switch from sudo user to Root user, and put command SU to switch to root then system ask for Root user password.But when i enter same command with SUDO, like sudo su then my user switches to Root user and don't ask for Root user Password.
Tested on Ubuntu and Fedora, same behavior on both platform.
Solution
su will only ask for the root password if it's not already being run as root. sudo su runs su as root, by definition.
If you set up a user in sudoers without a command whitelist, you are giving that user free access to run anything as root. Don't be surprised for them to get a root shell without the root password. Also, restricting su via a command blacklist won't help either; there are many other ways to get a root shell. Whitelisting is your only defence.
(Blacklisting == user can do everything except X, Y, and Z. Whitelisting == user can only do X, Y, and Z.)
Answered By - Chris Jester-Young Answer Checked By - Marilyn (WPSolving Volunteer)