How to Add a User to Sudoers
On Unix and Linux, the superuser account, also known as root, admin, or supervisor, is a special user account capable of making unrestricted, system-wide changes. It is mostly used for system administration tasks such as changing the ownership of files or binding network ports. However, it is sometimes necessary to allow standard user accounts to perform some of these sensitive actions, by granting them elevated privileges and access through the use of the [.inline-code]sudo[.inline-code] command.
In this article, we'll cover two methods for adding a user, or a group of users, to the sudoers list.
[#using-usermod]Add user to sudoers with the [.inline-code]usermod[.inline-code] command[#using-usermod]
In Linux, a group is a collection of accounts that can be given special or elevated permissions on the system. For example, a group can be given read permission on a file and another group read and write permissions on the same file.
To add a user account to a group, we can use the [.inline-code]usermod[.inline-code] command that essentially allows us to modify an existing account.
Where:
- The [.inline-code]-a[.inline-code] flag (short for append) is used to specify that we want to add a group to the specified user.
- The [.inline-code]-G[.inline-code] flag (short for groups) is used to specify which group we want to add.
Since most Linux distributions have a special group for sudoers, the easiest way to grant superuser privileges to a user account is to add it to this group.
[#in-ubuntu-or-debian]Add users to sudoers in Ubuntu or Debian[#in-ubuntu-or-debian]
On Ubuntu and Debian, this group is named [.inline-code]sudo[.inline-code].
[#in-centos-or-fedora]Add users to sudoers in CentOS or Fedora[#in-centos-or-fedora]
On CentOS and Fedora, this group is named [.inline-code]wheel[.inline-code].
[#verify-changes]Check whether adding users to sudoers was successful[#verify-changes]
To verify that a user was successfully added to the sudoers group, we can display the content of the [.inline-code]/etc/group[.inline-code] file using the [.inline-code]cat[.inline-code] command, which contains the list of groups (and their users) registered on the system.
[#using-sudoers-file]Add users to sudoers using the sudoers file[#using-sudoers-file]
In *nix systems, user accounts and groups with sudo privileges are stored into the [.inline-code]/etc/sudoers[.inline-code] file (sometimes called the “sudo file”), which contains a list of instructions called privilege lines, that can be edited to grant customized access to commands a user or a group can execute, or configure custom security policies.
The general syntax for a privilege line is the following:
Which can be roughly translated to "who where=(whom) what".
For example, the following line can be read as "the root user can run any command as any user from any group on any host."
And this line can be read as "the admin user can run the mkdir command as the root user on any host".
[#adding-a-group-to-sudoers]Adding a group to sudoers[#adding-a-group-to-sudoers]
The sudoers file also allows us to grant superuser privileges to an entire group of users by specifying the group name prefixed with a percentage character ([.inline-code]%[.inline-code]).
[#using-visudo]Use [.inline-code]visudo[.inline-code] to safely modify the sudoers file[#using-visudo]
Because of the sensitive nature of its content, it is highly recommended to only open it using the [.inline-code]visudo[.inline-code] utility — which uses the [.inline-code]vim[.inline-code] text editor under the hood — as it will automatically check for syntax errors before the file is saved, preventing us from ending up with a broken system where it is impossible to obtain elevated privileges.
Note that if you are not particularly experienced with [.inline-code]vim[.inline-code], you can always change the default editor using the following syntax.
Written by
