runuser tips — authorized user-switch literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run runuser on the lab host (syllabus box you own or were given access to; typically requires root).
2. Prefer documenting who / why / ticket before any user switch — never become production service users without change control.
3. Record short factual notes; quote short Evidence (target user name/UID, command label — never passwords).
4. Optional: login path → login-tips.
5. Optional: alternate-group path → sg-tips.
6. Prefer disposable lab users for runuser drills; quote id afterward as Evidence.
7. Prefer runuser -u labuser -- command for one-shot Evidence over lingering interactive shells when the syllabus allows.
8. Stop at literacy — no attack or unauthorized user-impersonation cookbooks.

Allowed framing

• Classroom labs reviewing runuser -u / -g on authorized disposable users.
• Binding short factual notes as Evidence (UID/name/command labels — no secrets).
• Documenting expected vs observed effective identity for authorized inventory notes.
• Comparing runuser ↔ login / sg / nologin peer tip pages under one binder.
• Testing PAM/session differences vs su only when the syllabus authorizes that drill.

Scope we will not cover

• No crack/pirate/keygen via runuser.
• No intentional unauthorized user impersonation against foreign hosts.
• No secret-theft or password harvesting against hosts you do not own.
• No cookbooks that abuse runuser as privilege escalation without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with util-linux installed.
2. Create a throwaway user via useradd-tips before any runuser drill.
3. With authorization (typically as root), run runuser -u labuser -- id; quote non-secret UID/name Evidence.
4. Optional: group peer with sg-tips; login peer with login-tips.
5. Stop at literacy — no attack or unauthorized user-switch cookbooks.

Practical notes for authorized labs

• runuser is the non-setuid companion often used from scripts/services — keep Evidence labels distinct from interactive su/login.
• Target-user passwords are irrelevant for root-started runuser — never invent password-bypass cookbooks.
• Pair with nologin-tips when documenting denied shells for service accounts (separate concern).
• Prefer documenting the exact user the syllabus authorized — avoid guessing production service accounts.
• Never commit PAM dumps or credential material to git — even for labs.
• Label lab-only identity switches clearly so they are not mistaken for production posture.

FAQ-aligned refusals (quick)

• Foreign-host user-switch drills → refuse.
• Unauthorized impersonation / privilege-escalation cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources