First off, i can only emphasize what Neo already said. This is the best solution from a practical POV. But since you may want to understand your system better i will try to explain what happened anyway:

More or less - but not quite.

First, yes, the shutdown command can only be issued by the root user. UNIX is a multiuser system at its core so the "default use case" it was built with in mind is some dozens of users using the same system at the same time. You don't want any of them to shut down the system whenever they feel like it in such a setting. This is why only root (or sometimes a special user group "wheel") is allowed to do it.

Now, everybody can - in principle - use the command su to switch the user. What su does is to open a subshell (you are correct in your assumption that it does) with the new rights and you are that new user as long as you do not leave this shell again. Notice that there are two (three) ways to run su:

Code:

su newuser
su - newuser
su - newuser -c command

Let us first talk about the difference between the first and the second: without the dash ("-") in between the environment of your own user is preserved. Variables like "PATH" and everything else you have set remains even though the user credentials change. With the dash, though, your environment is completely overwritten by the environment of the new user, effectively it is like doing a login as the new user - complete with executing the profile and whatever else is done during a normal login. In both cases, once you leave the subshell this is reverted back because all the changes are made within that subshell.

The last variant (which i have written only once but in fact it can be done in the with-dash- or the without-dash-fashion) does the same but within the resulting subshell only the specified command is executed and the subshell is left immediately afterwards. This way you can do single commands*) as a different user.

When you try a su command you are asked for the password of the user you try to switch to, just like you are asked for the password when you log in as that user.

Finally, what does sudo do? Well, certain commands (like su, but also others, shutdown, halt, ...) are deemed so security-relevant that one doesn't want to rely on all users being prevented to use them by just not knowing the relevant password. So all these commands would be made unavailable for all (normal) users at all. Nobody could use su any more. No, a select few users should be able to do it, though, and for this there is sudo. It allows certain users to run certain commands under different rights.

So, basically it goes like this: su is forbidden to use for everybody. But userX can use sudo and it will executed su for him as root (which can't be prevented from using it) so userX can still - with the help of sudo - execute su. UserY, for which this rule does not exist, can't execute su even though knowing the root password, because su is not allowed for anybody - he would not even be asked for that password. Which user is allowed to do what using sudo is laid down in a list of rules in the file /etc/sudoers.

Since many UNIX systems are effectively single-user these days (perhaps only you use your Mac and nobody else) it is common to add a sudo-rule for that user that allows for any program to be called via sudo and in turn being executed as root. So, this is where sudo shutdown comes from. sudo does not ask for the password of the user it runs the command as but the password of the user who invokes it - to make sure it is the user for whom to check if there is a rule allowing that.

No, you don't - it is just common. If you know the root password you most probably can do a

Code:

su - root

(notice that the "root" is implied if no user is specified so su - is the same) and you will be asked for the password of root and then become root. When entering

Code:

sudo su - root

you will be asked for your own password instead (by sudo, not by su) and then sudo wil call su as root (no password question from su therefore) to do an su - root for you.

This results - as a side effect - in nobody having to know the root password any longer and that is a second reason why it is done that way. Usually the root password is generated by a software and then thrown away. So nobody can become root save for the "backdoor" by having a rule in sudo that does it for him. Since sudo rules can be broken and sudo will refuse to work if /etc/sudoers contains syntactical errors it is still a good idea to know the root password just in case. Simply switch to root using sudo and change the password to some value you know by using the passwd command. In big companies this is done too, usually by someone not from the administrator team. The password is then sealed and kept in a safe where you can obtain it should the need arise.

Finally, how should you do the backup: you should run the whole backup process as user root because this way you avoid the possibility that your user may not be allowed to access some data and hence cannot backup them. When you do it like this you can shutdown at the end or not without any additional password. Furthermore, instead of asking interactively, i would use an option to select an optional shutdown at the end:

Code:

mybackup -s   # shutdown at the end of the backup
mybackup      # no shutdown at the end of the backup

Interactive parts in script prevent them from being called by other scripts. If you use an option instead you could build some other script which as one step calls your backup script. You couldn't do that (actually you could but it would defy the reason for a script, namely to make things automatic) if it has interactive parts.

I hope this helps.

bakunin
________________
*) note that "single command" here includes scripts including several commands as well as lists of commands - to be precise this should read "list" instead, like i.e.:

Code:

su - newuser -c "command1; command2; command3"