Why does “sudo su - X” require password, but “sudo -u X bash” doesn't?

Question

I know "why" questions are dangerous :) I have sudo access on RHEL, and noticed this:

su -u fred su -
Password:

(I don't know fred's password).

sudo -u fred bash
[fred] $

Is there a way to not need fred's password to do the su? Is there a reason to want that?

Answer 1

The difference is that sudo uses privileges attached to the account you're running as, while su is more similar to logging in at a normal prompt as the user you're changing to.

Try su root as a regular user that doesn't have permissions in the sudoers file - you can use the root credentials to change to that user, regardless of your current user's rights.

Conversely, sudo and the permissions assigned in your /etc/sudoers file allow your current user to work as root without needing to know any password but your own. For instance, add sudo to the front of your su -u fred command - fred's password is no longer needed, since the su is then running with root privleges.

Answer 2

sudo temporarily caches your passwords ... is this the case here?