Why am I able to switch user only using hyphen?

Question

If I try to switch the user using sudo su - kshitiz it works, and doesn't ask me for any password.

But if I do sudo su kshitiz it asks me for that user's password.

Why is this? I understand that hyphen loads that user's environment variables where's no hyphen keeps my own.

So then why does it ask me for target user's password when I want to switch while keeping my own variables, but not when I switch and load target's profile?

Answer 1

In recent util-linux releases, su and su -l use different PAM configurations – /etc/pam.d/su and /etc/pam.d/su-l respectively. It's possible that the latter configuration is either missing on your system, or doesn't have the usual pam_wheel module (which normally allows root to switch to any other user).

Just use sudo -s -u kshitiz or sudo -i -u kshitiz directly; the su is redundant.