Linux Labs
Where to start First steps track · 15 stages
Linux Labs
EN

sudo — running commands as another user

5 min Ubuntu 24.04 · sudo 1.9

Grants temporary root rights via sudoers; edit the file only through visudo, or a mistake locks everyone out of sudo.

Cheat sheet

6 commands Printable version
  • sudo apt update run a command as root
  • sudo -u postgres psql run as another user
  • sudo -i interactive root shell
  • sudo -l what I'm allowed to run
  • sudoedit /etc/nginx/nginx.conf safely edit a root-owned file
  • sudo visudo -f /etc/sudoers.d/10-x edit sudoers rules

Overview

sudo runs a command as another user (root by default), checking rights against the sudoers rules. Better than sitting under root all the time: targeted, logged, using your own user's password.

bash 
sudo apt update                   # run as root
sudo -u postgres psql             # as another user
sudo -i                           # interactive root shell (login shell)
sudo -s                           # a root shell without switching environment
sudo -l                           # which commands I'm allowed to run
sudo -k                           # reset the password cache (next sudo asks again)
sudo !!                           # rerun the previous command with sudo

Options

7

sudoers

Rights come from membership in the sudo group (Ubuntu) / wheel (RHEL), or an explicit rule. Never edit sudoers directly — only through visudo (it checks syntax, otherwise you can lock yourself out of sudo):

bash 
sudo visudo                       # the main /etc/sudoers file
sudo visudo -f /etc/sudoers.d/90-deploy   # a separate drop-in (recommended)
sudo visudo -c                    # check the syntax of all files

Rule format and aliases:

# who    where = (as whom)      what
alice   ALL = (ALL:ALL)      ALL
deploy  ALL = (root) NOPASSWD: /bin/systemctl restart myapp, /bin/systemctl status myapp
%devs   ALL = (root)         /usr/bin/apt        # %group
Cmnd_Alias SERVICES = /bin/systemctl restart nginx, /bin/systemctl reload nginx
web     ALL = (root) NOPASSWD: SERVICES

NOPASSWD: — no password prompt (for automation; keep the scope narrow!).

Options and sudoedit

Useful Defaults (in /etc/sudoers.d/):

Defaults        env_reset                          # a clean environment (safe)
Defaults        secure_path="/usr/sbin:/usr/bin:/sbin:/bin"
Defaults        timestamp_timeout=15               # password cache, minutes (0 = always ask)
Defaults:deploy !requiretty
Defaults        logfile="/var/log/sudo.log"        # a separate log
bash 
sudo -E cmd                       # preserve environment variables (if allowed)
sudoedit /etc/nginx/nginx.conf    # = sudo -e: safely edit a root file with your $EDITOR
sudo -v                           # extend the password cache (for long scripts)

sudoedit edits a copy under your own name and atomically puts it back — safer than sudo vim (which never runs the editor as root).

Option What it does Example
-u user Run the command as the given user instead of root. sudo -u postgres psql
-i Interactive root shell with root's own environment (login shell). sudo -i
-l List the commands the current user is allowed to run. sudo -l
-s A root shell without switching to the target user's environment. sudo -s
-k Reset the password cache — the next sudo call asks again. sudo -k
-E Preserve the calling user's environment variables, if the rule allows it. sudo -E make install
-v Refresh the password cache without running a command — useful before a long script. sudo -v

Nothing found. Try a shorter query.

Troubleshooting

5

user is not in the sudoers file

The user isn't in the sudo group. As root: usermod -aG sudo alice (needs a re-login, see users-groups).

sudo: a terminal is required to read the password

No TTY (over SSH without -t, or from a script). Options: NOPASSWD for the needed command, ssh -t, or sudo -S (password from stdin).

NOPASSWD doesn't work for switching users

(root) NOPASSWD: ALL allows commands as root, but not sudo -u other. For a passwordless switch, use an (other) rule or sudo runuser -u other -- cmd.

The command works by hand but not through sudo (PATH/env)

env_reset/secure_path clean the environment. Call it by its full path or configure secure_path; for variables, use sudo -E (if allowed).

Broke sudoers, lost access

visudo won't let you save a file with an error. If you still lost access, get in through a root console (recovery/hypervisor) and fix it.

Danger zone

NOPASSWD without a narrow command in the rule (NOPASSWD: ALL instead of a specific path) grants full root access with no check at all — keep the rule's scope as narrow as possible, especially for service accounts. Edit sudoers only through visudo: it checks syntax before saving, while a direct edit with a text editor can leave the system with no working way to get root at all.

Terms

2
authorization
Deciding which actions an established identity and its privileges permit. Also appears in: curl, HTTP
root (superuser)
The account with UID 0: the kernel skips most permission checks for it. Commands are usually run as root through sudo. Also appears in: Capabilities: root split into parts, PAM: login checks, password policy and lockout, Service hardening: User=, ProtectSystem, NoNewPrivileges, Docker and 71 more

See also

  • visudo — edit sudoers and /etc/sudoers.d files with checking.
  • permissions — The Unix permission model — read/write/execute, owner/group/others, special bits.
  • users-groups — Accounts, groups, membership; useradd/usermod, /etc/passwd and /etc/group.

Found an inaccuracy? Report an error in the article

Practice on this topic

Lessons on this topic

Tools on this topic

Topics
Loading…